Null ptr dereference from Blame::blame_buffer() methods

BlameHunks can be missing original and final committer and author signatures, leading to segmentation faults: ```rust fn main() { let test_case = std::env::args().nth(1).expect("Need a test case"); let td = TempDir::new().unwrap(); let path = td.path(); let repo = Repository::init(path).unwrap(); let mut config = repo.config().unwrap(); config.set_str("user.name", "name").unwrap(); config.set_str("user.email", "email").unwrap(); fs::write(&path.join("README.md"), "Testing").unwrap(); let mut index = repo.index().unwrap(); index.add_path(&Path::new("README.md")).unwrap(); index.write().unwrap(); let id = index.write_tree().unwrap(); let tree = repo.find_tree(id).unwrap(); let sig = repo.signature().unwrap(); repo.commit(Some("HEAD"), &sig, &sig, "Add README.md", &tree, &[]).unwrap(); let blame = repo.blame_file(&Path::new("README.md"), None).unwrap(); let hunk = blame.get_index(0).unwrap(); // This hunk is safe to use println!("Final author: {}", hunk.final_signature()); println!("Final committer: {}", hunk.final_committer()); println!("Original author: {}", hunk.orig_signature()); println!("Original committer: {}", hunk.orig_committer()); let arbitrary = blame.blame_buffer(b"abc123").unwrap(); let hunk = arbitrary.get_index(0).unwrap(); // This hunk is NOT /* (gdb) p *hunk.raw $8 = libgit2_sys::git_blame_hunk { lines_in_hunk: 1, final_commit_id: libgit2_sys::git_oid { id: [0 <repeats 20 times>] }, final_start_line_number: 1, final_signature: 0x0, final_committer: 0x0, orig_commit_id: libgit2_sys::git_oid { id: [0 <repeats 20 times>] }, orig_path: 0x7ffff00089b0, orig_start_line_number: 0, orig_signature: 0x0, orig_committer: 0x0, summary: 0x0, boundary: 0 } */ match test_case.as_str() { "1" => println!("Final author: {}", hunk.final_signature()), "2" => println!("Final committer: {}", hunk.final_committer()), "3" => println!("Original author: {}", hunk.orig_signature()), "4" => println!("Original committer: {}", hunk.orig_committer()), _ => () }; } ``` I reported this to the security team, and they said it is fine to report and fix publicly