Johannes Schindelin [off-list ref] writes:
sha1_to_hex() returns a pointer to a static buffer. Some of its users
modify that buffer by appending a newline character. Other users rely
on the fact that you can call
printf("%s", sha1_to_hex(sha1));
Just to be on the safe side, terminate the SHA1 in sha1_to_hex().
Good catch, thanks. The worst one is:
diff.c:727: memcpy(one_sha1, sha1_to_hex(one->sha1), 41);