git format-patch --output with multiple commits crashes.

(The error message when it crashes can be different between different runs of the same command.)

Here is how I reproduce this (in hasher):

[builder@localhost ~]$ cat /.in/test-git-format-patch-segfault.sh 
#!/bin/sh -efuC
set -o pipefail

# set up
case "${1-}" in
    --ini*)
	mkdir tmp-workdir
	cd tmp-workdir
	git init
	echo a >a
	git add a
	git commit -m A
	echo b >b
	git add b
	git commit -m B
	echo c >c
	git add c
	git commit -m C
	;;
    *)
	cd tmp-workdir
	;;
esac

# test
git format-patch @^^..@ --output=out.txt
[builder@localhost ~]$ git config --global user.email "you@example.com"
[builder@localhost ~]$   git config --global user.name "Your Name"
[builder@localhost ~]$ /.in/test-git-format-patch-segfault.sh --ini
Initialized empty Git repository in /usr/src/tmp-workdir/.git/
[master (root-commit) 09a1525] A
 1 file changed, 1 insertion(+)
 create mode 100644 a
[master 2cc5aff] B
 1 file changed, 1 insertion(+)
 create mode 100644 b
[master e029363] C
 1 file changed, 1 insertion(+)
 create mode 100644 c
0001-B.patch
free(): double free detected in tcache 2
/.in/test-git-format-patch-segfault.sh: line 26: 236210 Aborted                 git format-patch @^^..@ --output=out.txt
[builder@localhost ~]$ /.in/test-git-format-patch-segfault.sh      
0001-B.patch
0002-C.patch
[builder@localhost ~]$ /.in/test-git-format-patch-segfault.sh 
0001-B.patch
free(): double free detected in tcache 2
/.in/test-git-format-patch-segfault.sh: line 26: 236221 Aborted                 git format-patch @^^..@ --output=out.txt
[builder@localhost ~]$ rpm -q git glibc-core
git-2.29.3-alt2.x86_64
glibc-core-2.32-alt3.x86_64