[gitk] bad quoting of user input for command line injection, with possible unintended side effects

Hi,

So I pasted the following line (without quotes) into the 'find' textbox
of gitk, whilst in 'touching paths' mode, intending to switch to
add/remove afterwards.

"*pp_es = (i_es > 0) ? calloc( i_es, sizeof(**pp_es) ) : NULL;"

This results in an error dialog stating the following:

----
can't read output from command: standard output was redirected
can't read output from command: standard output was redirected
    while executing
"open $cmd r+"
    (procedure "do_file_hl" line 28)
    invoked from within
"do_file_hl 46"
    ("after" script)
----

What prompted me to report this at this time (I've encountered and
ignored this previously) is that subsequently I switched back to git-
gui and refreshed, and was surprised to find that a new empty file had
been created called "0)".

Clearly the text has made it into some commandline execution without
proper quoting, thus the "> 0)" portion of the text has resulted in
creation of the file.

I'm using version 1:2.28.0-1 on Debian.