shallow: fix NULL dereference in write_one_shallow verbose path

write_one_shallow() calls lookup_commit() to find the commit
object for a shallow graft entry, then checks "if (!c || ...)".
Inside that block, when the VERBOSE flag is set, it prints the
OID being removed via c->object.oid. But c can be NULL (the first
condition in the || check), in which case c->object.oid is a NULL
dereference.

This happens when a shallow graft entry references a commit object
that is not in the object store (e.g., after a partial fetch or
in a corrupted repository). lookup_commit() returns NULL because
the object cannot be found, the SEEN_ONLY check correctly decides
to remove this entry from .git/shallow, but the verbose message
crashes before the removal can complete.

Use graft->oid instead of c->object.oid for the message. The
graft entry's OID is the same value (it was used as the lookup
key at line 366) and is always available regardless of whether
the commit object exists.

Pointed out by Coverity.

Assisted-by: Claude Opus 4.6
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

shallow.c

@@ -367,7 +367,7 @@ static int write_one_shallow(const struct commit_graft *graft, void *cb_data)
 		if (!c || !(c->object.flags & SEEN)) {
 			if (data->flags & VERBOSE)
 				printf("Removing %s from .git/shallow\n",
-				       oid_to_hex(&c->object.oid));
+				       oid_to_hex(&graft->oid));
 			return 0;
 		}
 	}