From d3080d421bf0d91daea2e39bfc391c43d7fdad75 Mon Sep 17 00:00:00 2001
From: Jon TURNEY <jon.turney@dronecode.org.uk>
Date: Thu, 5 Feb 2015 20:29:48 +0000
Subject: [PATCH] os: Teach vpnprintf() how to handle "%*.*s"

XdmcpFatal uses the format specifier %*.*s, which vpnprintf() doesn't
understand, which causes a backtrace and prevents the reason for the XDMCP
failure being logged.

See also:
https://bugs.freedesktop.org/show_bug.cgi?id=66862
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758574

"%*.*s" is also currently used in a few other places, so teach vpnprintf() how
to handle it

$ fgrep -r "%*.*s" *
hw/dmx/config/scanner.l:    fprintf(stderr, "parse error on line %d at token \"%*.*s\"\n",
hw/dmx/dmxlog.c:        ErrorF("(%s) dmx[i%d/%*.*s]: ", type,
hw/dmx/input/dmxinputinit.c:                dmxLogCont(dmxInfo, "\t[i%d/%*.*s",
os/access.c:        ErrorF("Xserver: siAddrMatch(): type = %s, value = %*.*s -- %s\n",
os/access.c:                ("Xserver: siCheckAddr(): type = %s, value = %*.*s, len = %d -- %s\n",
os/xdmcp.c:    FatalError("XDMCP fatal error: %s %*.*s\n", type,

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
---
 os/log.c | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/os/log.c b/os/log.c
index 0532c2eb7..3db5c5333 100644
--- a/os/log.c
+++ b/os/log.c
@@ -355,6 +355,7 @@ vpnprintf(char *string, int size_in, const char *f, va_list args)
     uint64_t ui;
     int64_t si;
     size_t size = size_in;
+    int precision;
 
     for (; f_idx < f_len && s_idx < size - 1; f_idx++) {
         int length_modifier = 0;
@@ -365,9 +366,29 @@ vpnprintf(char *string, int size_in, const char *f, va_list args)
 
         f_idx++;
 
-        /* silently swallow digit length modifiers */
-        while (f_idx < f_len && ((f[f_idx] >= '0' && f[f_idx] <= '9') || f[f_idx] == '.'))
+        /* silently swallow minimum field width */
+        if (f[f_idx] == '*') {
             f_idx++;
+            va_arg(args, int);
+        } else {
+            while (f_idx < f_len && ((f[f_idx] >= '0' && f[f_idx] <= '9')))
+                f_idx++;
+        }
+
+        /* is there a precision? */
+        precision = size;
+        if (f[f_idx] == '.') {
+            f_idx++;
+            if (f[f_idx] == '*') {
+                f_idx++;
+                /* precision is supplied in an int argument */
+                precision = va_arg(args, int);
+            } else {
+                /* silently swallow precision digits */
+                while (f_idx < f_len && ((f[f_idx] >= '0' && f[f_idx] <= '9')))
+                    f_idx++;
+            }
+        }
 
         /* non-digit length modifiers */
         if (f_idx < f_len) {
@@ -383,9 +404,8 @@ vpnprintf(char *string, int size_in, const char *f, va_list args)
         switch (f[f_idx]) {
         case 's':
             string_arg = va_arg(args, char*);
-            p_len = strlen_sigsafe(string_arg);
 
-            for (i = 0; i < p_len && s_idx < size - 1; i++)
+            for (i = 0; string_arg[i] != 0 && s_idx < size - 1 && s_idx < precision; i++)
                 string[s_idx++] = string_arg[i];
             break;