Hi, On 1/21/15, Olivier Fourdan <ofour...@redhat.com> wrote: > The XdmpcpFatal() error handler uses a string format that the > vpnprintf() routine does not understand, as a result any XDMCP > fatal error leads to a server crash: > > (EE) (EE) BUG: triggered 'if (f[f_idx])' > (EE) BUG: log.c:474 in vpnprintf() > (EE) Unsupported printf directive '*' > > Rework the XdmpcpFatal() code to use a simpler string format > instead. > > Signed-off-by: Olivier Fourdan <ofour...@redhat.com> > --- > os/xdmcp.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/os/xdmcp.c b/os/xdmcp.c > index b6e97c9..374ac08 100644 > --- a/os/xdmcp.c > +++ b/os/xdmcp.c > @@ -1409,8 +1409,11 @@ recv_alive_msg(unsigned length) > static void > XdmcpFatal(const char *type, ARRAY8Ptr status) > { > - FatalError("XDMCP fatal error: %s %*.*s\n", type, > - status->length, status->length, status->data); > + char error_message[256]; /* status length is CARD8 */
Excuse my naive observation; I'm possibly missing something. The comment states "status length is CARD8" but the header file (If I'm looking at the correct one) states it is CARD16: http://cgit.freedesktop.org/xorg/lib/libXdmcp/tree/include/X11/Xdmcp.h#n80 Possibly a mistake/oversight in type definition as ARRAY{16,32} do have lengths of type CARD8. --patrick > + > + memcpy(error_message, status->data, status->length); > + error_message[status->length] = '\0'; > + FatalError("XDMCP fatal error: %s. %s\n", type, error_message); > } > > static void > -- > 2.1.0 > > _______________________________________________ > xorg-devel@lists.x.org: X.Org development > Archives: http://lists.x.org/archives/xorg-devel > Info: http://lists.x.org/mailman/listinfo/xorg-devel _______________________________________________ xorg-devel@lists.x.org: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel