[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

xorg-server: Changes to 'debian-unstable'



 ChangeLog                             |  224 +++++++++
 Xi/xiquerypointer.c                   |   25 -
 configure.ac                          |    4 
 debian/changelog                      |   14 
 dix/devices.c                         |    2 
 dix/dispatch.c                        |    4 
 dix/getevents.c                       |    2 
 hw/dmx/dmxlog.c                       |   13 
 hw/dmx/dmxlog.h                       |   19 
 hw/xfree86/dixmods/extmod/xf86vmode.c |  826 +++++++++++++++++++---------------
 include/Xprintf.h                     |   12 
 os/log.c                              |  105 ++--
 os/xprintf.c                          |   44 +
 13 files changed, 866 insertions(+), 428 deletions(-)

New commits:
commit 4f8394c0a6d17d38e88bd73c9ce743e4f66e661a
Author: Cyril Brulebois <kibi@debian.org>
Date:   Sun May 20 10:36:27 2012 +0200

    Upload to unstable.

diff --git a/debian/changelog b/debian/changelog
index a2c3ac7..e538edd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-xorg-server (2:1.12.1.902-1) UNRELEASED; urgency=medium
+xorg-server (2:1.12.1.902-1) unstable; urgency=medium
 
   [ Julien Cristau ]
   * xvfb-run: kill Xvfb when the script dies.
@@ -20,7 +20,7 @@ xorg-server (2:1.12.1.902-1) UNRELEASED; urgency=medium
       is CVE-2012-2118 (Closes: #673148).
   * Bump severity to “medium” for those two important fixes.
 
- -- Cyril Brulebois <kibi@debian.org>  Sun, 20 May 2012 10:28:32 +0200
+ -- Cyril Brulebois <kibi@debian.org>  Sun, 20 May 2012 10:52:52 +0200
 
 xorg-server (2:1.12.1-2) unstable; urgency=low
 

commit 248da77e7595ea02fb29cac911ff8674270c0d55
Author: Cyril Brulebois <kibi@debian.org>
Date:   Sun May 20 10:36:22 2012 +0200

    Bump severity to “medium” for those two important fixes.

diff --git a/debian/changelog b/debian/changelog
index 3146b65..a2c3ac7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-xorg-server (2:1.12.1.902-1) UNRELEASED; urgency=low
+xorg-server (2:1.12.1.902-1) UNRELEASED; urgency=medium
 
   [ Julien Cristau ]
   * xvfb-run: kill Xvfb when the script dies.
@@ -18,6 +18,7 @@ xorg-server (2:1.12.1.902-1) UNRELEASED; urgency=low
     - Refactor logging, fixing a format string vulnerability which could lead
       to a denial of service (“only”, thanks to the fortified sources). This
       is CVE-2012-2118 (Closes: #673148).
+  * Bump severity to “medium” for those two important fixes.
 
  -- Cyril Brulebois <kibi@debian.org>  Sun, 20 May 2012 10:28:32 +0200
 

commit c4914f5c425e7781709a2d79efc9fff16135e4f4
Author: Cyril Brulebois <kibi@debian.org>
Date:   Sun May 20 10:35:27 2012 +0200

    Bump changelogs.

diff --git a/ChangeLog b/ChangeLog
index 3d7e7d2..33bbced 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,227 @@
+commit 4a2b8eebd1e93a8a0d003e9f5a594430eff08dad
+Author: Jeremy Huddleston <jeremyhu@apple.com>
+Date:   Sat May 19 22:11:19 2012 -0700
+
+    configure.ac: Version bump to 1.12.1.902 (1.12.2 RC2)
+    
+    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
+
+commit 32235e978685d3ebe9c418fecfe3ec584c402008
+Merge: 58dfb13 dab90b6
+Author: Jeremy Huddleston <jeremyhu@apple.com>
+Date:   Thu May 17 09:56:29 2012 -0700
+
+    Merge remote-tracking branch 'whot/server-1.12-branch' into server-1.12-branch
+
+commit dab90b60f3b2ebfd8df4fa761f3f34859250f4db
+Author: Chase Douglas <chase.douglas@canonical.com>
+Date:   Tue May 1 10:21:12 2012 -0700
+
+    Report touch emulated buttons in XIQueryPointer for XI 2.1 and earlier
+    
+    XInput 2.1 and earlier clients do not know about touches. We must report
+    touch emulated button presses for these clients. For later clients, we
+    only report true pointer button presses.
+    
+    Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit ee542b85590814ee25369babce1ad14feeb137af)
+
+commit 04474fc6a4c21a06c1a65c7afcbc4e0a27e3d0f7
+Author: Chase Douglas <chase.douglas@canonical.com>
+Date:   Tue May 1 10:21:11 2012 -0700
+
+    Report logical button state in ProcXIQueryPointer
+    
+    Physical button state is usually meaningless to an X client.
+    
+    Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit 1e7b500a8e1d79b91a4e857a2da06194efe8cf69)
+
+commit 3b25ed442ca9152841fa821ac3b01c2c9cb4e0d1
+Author: Daniel Kurtz <djkurtz@chromium.org>
+Date:   Wed Apr 18 17:51:53 2012 +0800
+
+    os/log: refactor logging
+    
+    It is not safe to ever use an arbitrary (possibly user supplied) string as
+    part of the format for a *sprintf() call.
+    
+    For example:
+      1. Name a Bluetooth keyboard "%n%n%n%n%n%n%n%n"
+      2. Pair it with a computer running X and try to use it
+      3. X is not happy when trying to do the following in xf86-input-evdev:
+         xf86IDrvMsg(pInfo, X_CONFIG, "Device: \"%s\"\n", device);
+         because LogVHdrMessageVerb() has put the %n from the device name
+         into a format string of the form:
+            "evdev: %n%n%n%n%n%n%n%n: Device: \"%s\"\n"
+    
+    Instead, build up a log message in place by appending successive formatted
+    strings by sncprintf'ing to the end of the previous.
+    
+    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
+    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit c91d00e0f330b9de604068e1bfcb0a307096434f)
+
+commit 34a82b393a037788fbebbc423bfdcdd6f94f3577
+Author: Daniel Kurtz <djkurtz@chromium.org>
+Date:   Wed Apr 18 17:51:52 2012 +0800
+
+    os/log: only write timestamp if a message is actually written to logfile
+    
+    The current code will write a timestamps into the logFile whenever
+    the last message ended with a '\n' - even if the verb for that timestamp
+    is at too high a level.  This timestamp will sit there with no matching
+    message until the next call to LogVWrite with a valid verb.
+    
+    In other words, in some cases, timestamps in the X.org.log are for some
+    completely unrelated message that was previously ignored due to
+    insufficient verbosity, and not for the message that appears next to it
+    in the log file.
+    
+    We keep the current policy which appears to be to only apply timestamps if
+    a message is actually written to a log file.  That is, no timestamps on
+    stderr, or in the mem buffer.  Therefore, the timestamp stringification
+    is moved to the conditional where it is used.
+    
+    Since logging uses a fixed length buffer, this patch also forces a '\n'
+    whenever a buffer is terminated due to a too-long write request.  This
+    allows the newline detection to work even on overflow, and also cleans up
+    the log a bit in the overflow case.
+    
+    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
+    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit 6ce0eac4f8a05f6d7401445cab95027709d3a479)
+
+commit 8998037f183fd1f73fe0d272b4e072e53c7f3bcc
+Author: Daniel Kurtz <djkurtz@chromium.org>
+Date:   Wed Apr 18 09:51:51 2012 +0000
+
+    os/xprintf: add Xvscnprintf and Xscnprintf
+    
+    Normal snprintf() usually returns the number of bytes that would have been
+    written into a buffer had the buffer been long enough.
+    
+    The scnprintf() variants return the actual number of bytes written,
+    excluding the trailing '\0'.
+    
+    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
+    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit 5c2e2a164d615ab06be28a663734e782614b5cc7)
+
+commit 9a2030ea26a2a0821d87afea502f5446ae002a6d
+Author: Daniel Kurtz <djkurtz@chromium.org>
+Date:   Wed Apr 18 17:51:50 2012 +0800
+
+    os/log: trivial cleanups
+    
+     * space->tab
+     * remove comment that doesn't make any sense
+    
+    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
+    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit c30862879d2c766519780bb7f353f35edf0daa9b)
+
+commit 58dfb13953af71021317b9d85230b1163198f031
+Author: Jeremy Huddleston <jeremyhu@apple.com>
+Date:   Thu May 10 00:53:20 2012 -0700
+
+    Revert "dix: when disabling a device, release all buttons and keys"
+    
+    This reverts commit 90299556db24543bb7365e8c2897deca3aa219e7.
+    
+    The commit being reverted triggered a segfault on server shutdown when a
+    device posts raw events after the root windows are forced to NULL.
+    
+    https://lists.debian.org/debian-x/2012/05/msg00240.html
+    
+    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
+
+commit f012f0c48dedba4df69cc1a1ecdf8ee5d37daca9
+Author: Michal Suchanek <hramrach@gmail.com>
+Date:   Thu Apr 26 15:11:20 2012 +0200
+
+    dmx: Annotate dmxlog.c with _X_ATTRIBUTE_PRINTF and _X_NORETURN
+    
+    and fix resulting printf warning in dmxLogVisual
+    
+    Signed-off-by: Michal Suchanek <hramrach@gmail.com>
+    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit d662fa2450856777b59c4b62b912395a8bfd52fd)
+
+commit f8d2ca759ad37d5e99d462f21a2259ce17bb1a00
+Author: Peter Hutterer <peter.hutterer@who-t.net>
+Date:   Wed Apr 18 15:56:37 2012 +1000
+
+    dix: indentation fix
+    
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit ebf214876a4885a98ded4f5525925b69005fae05)
+
+commit 15607cf2dc87405606b20113011f1ebd97637d32
+Author: Daniel Kurtz <djkurtz@chromium.org>
+Date:   Thu Apr 12 10:11:10 2012 +1000
+
+    dix: don't BUG_WARN for button events from button-only device
+    
+    Events from button-only devices still need coordinates, and they get them
+    from scale_to_desktop().  Therefore, a dev without valuators is not a bug.
+    However, a dev with valuators, but less than two of them still is a bug.
+    
+    This was noticed when unplugging a "Creative Technology SB Arena Headset",
+    which has some BTNs and some KEYs, but no REL or ABS valuators.
+    It emits [BTN_3] = 0 on unplug, which would trigger the BUG_WARN.
+    
+    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
+    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    (cherry picked from commit c5a45b0f7658c77725adce2b64a0fbd62f208328)
+
+commit 3ad72a80088fe3236f38bd0696b04f399e24fe3d
+Author: Keith Packard <keithp@keithp.com>
+Date:   Wed Apr 11 09:33:54 2012 -0700
+
+    hw/xfree86: Re-indent xf86vmode.c
+    
+    This is the result of re-running the 'x-indent.sh' script over
+    xf86vmode.c to clean up the disaster caused by broken syntax in the
+    file.
+    
+    Signed-off-by: Keith Packard <keithp@keithp.com>
+    (cherry picked from commit 9779b904c7c0b49c74054c22c420012c40595cdc)
+
+commit b5bf0ac5405eab77f26bb2f8726644232af17178
+Author: Keith Packard <keithp@keithp.com>
+Date:   Wed Apr 11 09:28:21 2012 -0700
+
+    hw/xfree86: Spurious ');' in xf86vmode.c messed up indentation badly
+    
+    Inside the unfinished XF86VIDMODE_EVENTS #ifdef block the
+    function definition for xf86VidModeNotifyEvent had an extra ');'
+    before the prototype argument declarations. This was harmless for the
+    compiler as the code never gets used, but completely messed up the
+    file re-indentation. This patch removes the spurious characters in
+    preparation for re-indenting the file.
+    
+    Signed-off-by: Keith Packard <keithp@keithp.com>
+    (cherry picked from commit 592bd0ae2b60cd6f6afd3efc40f5f659b12900b4)
+
+commit 943cac51e4cb79dcbd143d4bd6b22ca9327e7703
+Author: Jeremy Huddleston <jeremyhu@apple.com>
+Date:   Mon May 7 00:03:01 2012 -0700
+
+    configure.ac: Bump to 1.12.1.901 (1.12.2 RC1)
+    
+    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
+
 commit 22a1953c4a2747d637bb926034f11134809b8d06
 Author: Jeremy Huddleston <jeremyhu@apple.com>
 Date:   Thu Apr 26 21:17:54 2012 -0700
diff --git a/debian/changelog b/debian/changelog
index 4f0991f..3146b65 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,6 @@
-xorg-server (2:1.12.1-2) UNRELEASED; urgency=low
+xorg-server (2:1.12.1.902-1) UNRELEASED; urgency=low
 
+  [ Julien Cristau ]
   * xvfb-run: kill Xvfb when the script dies.
   * xvfb-run: instead of waiting 3 seconds and hoping that's enough for Xvfb
     to come up (and waiting 2.9 seconds too many in the general case), tell it
@@ -10,7 +11,15 @@ xorg-server (2:1.12.1-2) UNRELEASED; urgency=low
     instead.  Somehow this seems to have been broken all these years and
     nobody noticed...
 
- -- Julien Cristau <jcristau@debian.org>  Mon, 19 Mar 2012 21:16:07 +0100
+  [ Cyril Brulebois ]
+  * New upstream release candidate for the 1.12 stable branch:
+    - Bring the usual lot of stability fixes.
+    - Fix segfault on server shutdown (Closes: #671812).
+    - Refactor logging, fixing a format string vulnerability which could lead
+      to a denial of service (“only”, thanks to the fortified sources). This
+      is CVE-2012-2118 (Closes: #673148).
+
+ -- Cyril Brulebois <kibi@debian.org>  Sun, 20 May 2012 10:28:32 +0200
 
 xorg-server (2:1.12.1-2) unstable; urgency=low
 

commit 4a2b8eebd1e93a8a0d003e9f5a594430eff08dad
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Sat May 19 22:11:19 2012 -0700

    configure.ac: Version bump to 1.12.1.902 (1.12.2 RC2)
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>

diff --git a/configure.ac b/configure.ac
index e6c434e..5e38d50 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.12.1.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2012-05-06"
+AC_INIT([xorg-server], 1.12.1.902, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2012-05-19"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AM_MAINTAINER_MODE

commit dab90b60f3b2ebfd8df4fa761f3f34859250f4db
Author: Chase Douglas <chase.douglas@canonical.com>
Date:   Tue May 1 10:21:12 2012 -0700

    Report touch emulated buttons in XIQueryPointer for XI 2.1 and earlier
    
    XInput 2.1 and earlier clients do not know about touches. We must report
    touch emulated button presses for these clients. For later clients, we
    only report true pointer button presses.
    
    Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit ee542b85590814ee25369babce1ad14feeb137af)

diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
index ba99752..169436e 100644
--- a/Xi/xiquerypointer.c
+++ b/Xi/xiquerypointer.c
@@ -79,10 +79,21 @@ ProcXIQueryPointer(ClientPtr client)
     XkbStatePtr state;
     char *buttons = NULL;
     int buttons_size = 0;       /* size of buttons array */
+    XIClientPtr xi_client;
+    Bool have_xi22 = FALSE;
 
     REQUEST(xXIQueryPointerReq);
     REQUEST_SIZE_MATCH(xXIQueryPointerReq);
 
+    /* Check if client is compliant with XInput 2.2 or later. Earlier clients
+     * do not know about touches, so we must report emulated button presses. 2.2
+     * and later clients are aware of touches, so we don't include emulated
+     * button presses in the reply. */
+    xi_client = dixLookupPrivate(&client->devPrivates, XIClientPrivateKey);
+    if (version_compare(xi_client->major_version,
+                        xi_client->minor_version, 2, 2) >= 0)
+        have_xi22 = TRUE;
+
     rc = dixLookupDevice(&pDev, stuff->deviceid, client, DixReadAccess);
     if (rc != Success) {
         client->errorValue = stuff->deviceid;
@@ -145,6 +156,9 @@ ProcXIQueryPointer(ClientPtr client)
         for (i = 1; i < pDev->button->numButtons; i++)
             if (BitIsOn(pDev->button->down, i))
                 SetBit(buttons, pDev->button->map[i]);
+
+        if (!have_xi22 && pDev->touch && pDev->touch->buttonsDown > 0)
+            SetBit(buttons, pDev->button->map[1]);
     }
     else
         rep.buttons_len = 0;

commit 04474fc6a4c21a06c1a65c7afcbc4e0a27e3d0f7
Author: Chase Douglas <chase.douglas@canonical.com>
Date:   Tue May 1 10:21:11 2012 -0700

    Report logical button state in ProcXIQueryPointer
    
    Physical button state is usually meaningless to an X client.
    
    Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 1e7b500a8e1d79b91a4e857a2da06194efe8cf69)

diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
index a2e7442..ba99752 100644
--- a/Xi/xiquerypointer.c
+++ b/Xi/xiquerypointer.c
@@ -132,7 +132,7 @@ ProcXIQueryPointer(ClientPtr client)
     }
 
     if (pDev->button) {
-        int i, down;
+        int i;
 
         rep.buttons_len =
             bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
@@ -142,14 +142,9 @@ ProcXIQueryPointer(ClientPtr client)
         if (!buttons)
             return BadAlloc;
 
-        down = pDev->button->buttonsDown;
-
-        for (i = 0; i < pDev->button->numButtons && down; i++) {
-            if (BitIsOn(pDev->button->down, i)) {
-                SetBit(buttons, i);
-                down--;
-            }
-        }
+        for (i = 1; i < pDev->button->numButtons; i++)
+            if (BitIsOn(pDev->button->down, i))
+                SetBit(buttons, pDev->button->map[i]);
     }
     else
         rep.buttons_len = 0;

commit 3b25ed442ca9152841fa821ac3b01c2c9cb4e0d1
Author: Daniel Kurtz <djkurtz@chromium.org>
Date:   Wed Apr 18 17:51:53 2012 +0800

    os/log: refactor logging
    
    It is not safe to ever use an arbitrary (possibly user supplied) string as
    part of the format for a *sprintf() call.
    
    For example:
      1. Name a Bluetooth keyboard "%n%n%n%n%n%n%n%n"
      2. Pair it with a computer running X and try to use it
      3. X is not happy when trying to do the following in xf86-input-evdev:
         xf86IDrvMsg(pInfo, X_CONFIG, "Device: \"%s\"\n", device);
         because LogVHdrMessageVerb() has put the %n from the device name
         into a format string of the form:
            "evdev: %n%n%n%n%n%n%n%n: Device: \"%s\"\n"
    
    Instead, build up a log message in place by appending successive formatted
    strings by sncprintf'ing to the end of the previous.
    
    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit c91d00e0f330b9de604068e1bfcb0a307096434f)

diff --git a/os/log.c b/os/log.c
index b790306..0e49572 100644
--- a/os/log.c
+++ b/os/log.c
@@ -265,36 +265,19 @@ LogSetParameter(LogParameter param, int value)
 }
 
 /* This function does the actual log message writes. */
-
-void
-LogVWrite(int verb, const char *f, va_list args)
+static void
+LogSWrite(int verb, const char *buf, size_t len, Bool end_line)
 {
-    static char tmpBuffer[1024];
-    int len = 0;
     static Bool newline = TRUE;
 
-    if (verb > logFileVerbosity && verb > logVerbosity)
-        return;
-
-    /*
-     * Since a va_list can only be processed once, write the string to a
-     * buffer, and then write the buffer out to the appropriate output
-     * stream(s).
-     */
-    if (verb < 0 || logFileVerbosity >= verb || logVerbosity >= verb) {
-        len = Xvscnprintf(tmpBuffer, sizeof(tmpBuffer), f, args);
-        /* If message is truncated, terminate with '\n' */
-        if (sizeof(tmpBuffer) - len == 1)
-            tmpBuffer[len - 1] = '\n';
-    }
-    if ((verb < 0 || logVerbosity >= verb) && len > 0)
-        fwrite(tmpBuffer, len, 1, stderr);
-    if ((verb < 0 || logFileVerbosity >= verb) && len > 0) {
+    if (verb < 0 || logVerbosity >= verb)
+        fwrite(buf, len, 1, stderr);
+    if (verb < 0 || logFileVerbosity >= verb) {
         if (logFile) {
             if (newline)
                 fprintf(logFile, "[%10.3f] ", GetTimeInMillis() / 1000.0);
-            newline = (tmpBuffer[len - 1] == '\n');
-            fwrite(tmpBuffer, len, 1, logFile);
+            newline = end_line;
+            fwrite(buf, len, 1, logFile);
             if (logFlush) {
                 fflush(logFile);
 #ifndef WIN32
@@ -312,13 +295,19 @@ LogVWrite(int verb, const char *f, va_list args)
                     FatalError("realloc() failed while saving log messages\n");
             }
             bufferUnused -= len;
-            memcpy(saveBuffer + bufferPos, tmpBuffer, len);
+            memcpy(saveBuffer + bufferPos, buf, len);
             bufferPos += len;
         }
     }
 }
 
 void
+LogVWrite(int verb, const char *f, va_list args)
+{
+    return LogVMessageVerb(X_NONE, verb, f, args);
+}
+
+void
 LogWrite(int verb, const char *f, ...)
 {
     va_list args;
@@ -371,22 +360,28 @@ void
 LogVMessageVerb(MessageType type, int verb, const char *format, va_list args)
 {
     const char *type_str;
-    char tmpFormat[1024];
-    const char *new_format;
+    char buf[1024];
+    const size_t size = sizeof(buf);
+    Bool newline;
+    size_t len = 0;
 
     type_str = LogMessageTypeVerbString(type, verb);
     if (!type_str)
         return;
 
-    /* if type_str is not "", prepend it and ' ', to format */
-    if (type_str[0] == '\0')
-        new_format = format;
-    else {
-        new_format = tmpFormat;
-        snprintf(tmpFormat, sizeof(tmpFormat), "%s %s", type_str, format);
-    }
+    /* if type_str is not "", prepend it and ' ', to message */
+    if (type_str[0] != '\0')
+        len += Xscnprintf(&buf[len], size - len, "%s ", type_str);
+
+    if (size - len > 1)
+        len += Xvscnprintf(&buf[len], size - len, format, args);
+
+    /* Force '\n' at end of truncated line */
+    if (size - len == 1)
+        buf[len - 1] = '\n';
 
-    LogVWrite(verb, new_format, args);
+    newline = (buf[len - 1] == '\n');
+    LogSWrite(verb, buf, len, newline);
 }
 
 /* Log message with verbosity level specified. */
@@ -416,31 +411,31 @@ LogVHdrMessageVerb(MessageType type, int verb, const char *msg_format,
                    va_list msg_args, const char *hdr_format, va_list hdr_args)
 {
     const char *type_str;
-    char tmpFormat[1024];
-    char *tmpFormat_end = &tmpFormat[sizeof(tmpFormat)];
-    char *p;
-    int left;
+    char buf[1024];
+    const size_t size = sizeof(buf);
+    Bool newline;
+    size_t len = 0;
 
     type_str = LogMessageTypeVerbString(type, verb);
     if (!type_str)
         return;
 
-    /* if type_str != "", copy it and ' ' to tmpFormat; set p after ' ' */
-    p = tmpFormat;
+    /* if type_str is not "", prepend it and ' ', to message */
     if (type_str[0] != '\0')
-        p += snprintf(tmpFormat, sizeof(tmpFormat), "%s ", type_str);
+        len += Xscnprintf(&buf[len], size - len, "%s ", type_str);
+
+    if (hdr_format && size - len > 1)
+        len += Xvscnprintf(&buf[len], size - len, hdr_format, hdr_args);
 
-    /* append as much of hdr as fits after type_str (if there was one) */
-    left = tmpFormat_end - p;
-    if (left > 1)
-        p += vsnprintf(p, left, hdr_format, hdr_args);
+    if (msg_format && size - len > 1)
+        len += Xvscnprintf(&buf[len], size - len, msg_format, msg_args);
 
-    /* append as much of msg_format as will fit after hdr */
-    left = tmpFormat_end - p;
-    if (left > 1)
-        snprintf(p, left, "%s", msg_format);
+    /* Force '\n' at end of truncated line */
+    if (size - len == 1)
+        buf[len - 1] = '\n';
 
-    LogVWrite(verb, tmpFormat, msg_args);
+    newline = (buf[len - 1] == '\n');
+    LogSWrite(verb, buf, len, newline);
 }
 
 void

commit 34a82b393a037788fbebbc423bfdcdd6f94f3577
Author: Daniel Kurtz <djkurtz@chromium.org>
Date:   Wed Apr 18 17:51:52 2012 +0800

    os/log: only write timestamp if a message is actually written to logfile
    
    The current code will write a timestamps into the logFile whenever
    the last message ended with a '\n' - even if the verb for that timestamp
    is at too high a level.  This timestamp will sit there with no matching
    message until the next call to LogVWrite with a valid verb.
    
    In other words, in some cases, timestamps in the X.org.log are for some
    completely unrelated message that was previously ignored due to
    insufficient verbosity, and not for the message that appears next to it
    in the log file.
    
    We keep the current policy which appears to be to only apply timestamps if
    a message is actually written to a log file.  That is, no timestamps on
    stderr, or in the mem buffer.  Therefore, the timestamp stringification
    is moved to the conditional where it is used.
    
    Since logging uses a fixed length buffer, this patch also forces a '\n'
    whenever a buffer is terminated due to a too-long write request.  This
    allows the newline detection to work even on overflow, and also cleans up
    the log a bit in the overflow case.
    
    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 6ce0eac4f8a05f6d7401445cab95027709d3a479)

diff --git a/os/log.c b/os/log.c
index 297b46a..b790306 100644
--- a/os/log.c
+++ b/os/log.c
@@ -273,12 +273,8 @@ LogVWrite(int verb, const char *f, va_list args)
     int len = 0;
     static Bool newline = TRUE;
 
-    if (newline) {
-        sprintf(tmpBuffer, "[%10.3f] ", GetTimeInMillis() / 1000.0);
-        len = strlen(tmpBuffer);
-        if (logFile)
-            fwrite(tmpBuffer, len, 1, logFile);
-    }
+    if (verb > logFileVerbosity && verb > logVerbosity)
+        return;
 
     /*
      * Since a va_list can only be processed once, write the string to a
@@ -286,14 +282,18 @@ LogVWrite(int verb, const char *f, va_list args)
      * stream(s).
      */
     if (verb < 0 || logFileVerbosity >= verb || logVerbosity >= verb) {
-        vsnprintf(tmpBuffer, sizeof(tmpBuffer), f, args);
-        len = strlen(tmpBuffer);
+        len = Xvscnprintf(tmpBuffer, sizeof(tmpBuffer), f, args);
+        /* If message is truncated, terminate with '\n' */
+        if (sizeof(tmpBuffer) - len == 1)
+            tmpBuffer[len - 1] = '\n';
     }
-    newline = (tmpBuffer[len - 1] == '\n');
     if ((verb < 0 || logVerbosity >= verb) && len > 0)
         fwrite(tmpBuffer, len, 1, stderr);
     if ((verb < 0 || logFileVerbosity >= verb) && len > 0) {
         if (logFile) {
+            if (newline)
+                fprintf(logFile, "[%10.3f] ", GetTimeInMillis() / 1000.0);
+            newline = (tmpBuffer[len - 1] == '\n');
             fwrite(tmpBuffer, len, 1, logFile);
             if (logFlush) {
                 fflush(logFile);

commit 8998037f183fd1f73fe0d272b4e072e53c7f3bcc
Author: Daniel Kurtz <djkurtz@chromium.org>
Date:   Wed Apr 18 09:51:51 2012 +0000

    os/xprintf: add Xvscnprintf and Xscnprintf
    
    Normal snprintf() usually returns the number of bytes that would have been
    written into a buffer had the buffer been long enough.
    
    The scnprintf() variants return the actual number of bytes written,
    excluding the trailing '\0'.
    
    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 5c2e2a164d615ab06be28a663734e782614b5cc7)

diff --git a/include/Xprintf.h b/include/Xprintf.h
index 414fd46..9e8cdc5 100644
--- a/include/Xprintf.h
+++ b/include/Xprintf.h
@@ -66,4 +66,16 @@ _X_ATTRIBUTE_PRINTF(2, 0);
 #define vasprintf Xvasprintf
 #endif
 
+/*
+ * These functions provide a portable implementation of the linux kernel
+ * scnprintf & vscnprintf routines that return the number of bytes actually
+ * copied during a snprintf, (excluding the final '\0').
+ */
+extern _X_EXPORT int
+Xscnprintf(char *s, int n, const char * _X_RESTRICT_KYWD fmt, ...)
+_X_ATTRIBUTE_PRINTF(3,4);
+extern _X_EXPORT int
+Xvscnprintf(char *s, int n, const char * _X_RESTRICT_KYWD fmt, va_list va)
+_X_ATTRIBUTE_PRINTF(3,0);
+
 #endif                          /* XPRINTF_H */
diff --git a/os/xprintf.c b/os/xprintf.c
index 17fea2e..80caa57 100644
--- a/os/xprintf.c
+++ b/os/xprintf.c
@@ -186,6 +186,50 @@ XNFasprintf(char **ret, const char *_X_RESTRICT_KYWD format, ...)
     return size;
 }
 
+/**
+ * Varargs snprintf that returns the actual number of bytes (excluding final
+ * '\0') that were copied into the buffer.
+ * This is opposed to the normal sprintf() usually returns the number of bytes
+ * that would have been written.
+ *
+ * @param s       buffer to copy into
+ * @param n       size of buffer s
+ * @param format  printf style format string
+ * @param va      variable argument list
+ * @return        number of bytes actually copied, excluding final '\0'
+ */
+int
+Xvscnprintf(char *s, int n, const char *format, va_list args)
+{
+    int x;
+    if (n == 0)
+        return 0;
+    x = vsnprintf(s, n , format, args);
+    return (x >= n) ? (n - 1) : x;
+}
+
+/**
+ * snprintf that returns the actual number of bytes (excluding final '\0') that
+ * were copied into the buffer.
+ * This is opposed to the normal sprintf() usually returns the number of bytes
+ * that would have been written.
+ *
+ * @param s       buffer to copy into
+ * @param n       size of buffer s
+ * @param format  printf style format string
+ * @param ...     arguments for specified format
+ * @return        number of bytes actually copied, excluding final '\0'
+ */
+int Xscnprintf(char *s, int n, const char *format, ...)
+{
+    int x;
+    va_list ap;
+    va_start(ap, format);
+    x = Xvscnprintf(s, n, format, ap);
+    va_end(ap);
+    return x;
+}
+
 /* Old api, now deprecated, may be removed in the future */
 char *
 Xvprintf(const char *format, va_list va)

commit 9a2030ea26a2a0821d87afea502f5446ae002a6d
Author: Daniel Kurtz <djkurtz@chromium.org>
Date:   Wed Apr 18 17:51:50 2012 +0800

    os/log: trivial cleanups
    
     * space->tab
     * remove comment that doesn't make any sense
    
    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit c30862879d2c766519780bb7f353f35edf0daa9b)

diff --git a/os/log.c b/os/log.c
index 0ccd126..297b46a 100644
--- a/os/log.c
+++ b/os/log.c
@@ -165,7 +165,7 @@ asm(".desc ___crashreporter_info__, 0x10");
 #define X_NOT_IMPLEMENTED_STRING	"(NI)"
 #endif
 #ifndef X_NONE_STRING
-#define X_NONE_STRING                   ""
+#define X_NONE_STRING			""
 #endif
 
 /*
@@ -223,7 +223,7 @@ LogInit(const char *fname, const char *backup)
      * needed.
      */
     if (saveBuffer && bufferSize > 0) {
-        free(saveBuffer);       /* Must be free(), not free() */
+        free(saveBuffer);
         saveBuffer = NULL;
         bufferSize = 0;
     }

commit 58dfb13953af71021317b9d85230b1163198f031
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Thu May 10 00:53:20 2012 -0700

    Revert "dix: when disabling a device, release all buttons and keys"
    
    This reverts commit 90299556db24543bb7365e8c2897deca3aa219e7.
    
    The commit being reverted triggered a segfault on server shutdown when a
    device posts raw events after the root windows are forced to NULL.
    
    https://lists.debian.org/debian-x/2012/05/msg00240.html
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>

diff --git a/dix/devices.c b/dix/devices.c
index d0e99bd..0125504 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -432,8 +432,6 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
     if (*prev != dev)
         return FALSE;
 
-    ReleaseButtonsAndKeys(dev);
-
     /* float attached devices */
     if (IsMaster(dev)) {
         for (other = inputInfo.devices; other; other = other->next) {

commit f012f0c48dedba4df69cc1a1ecdf8ee5d37daca9
Author: Michal Suchanek <hramrach@gmail.com>
Date:   Thu Apr 26 15:11:20 2012 +0200

    dmx: Annotate dmxlog.c with _X_ATTRIBUTE_PRINTF and _X_NORETURN
    
    and fix resulting printf warning in dmxLogVisual
    
    Signed-off-by: Michal Suchanek <hramrach@gmail.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit d662fa2450856777b59c4b62b912395a8bfd52fd)

diff --git a/hw/dmx/dmxlog.c b/hw/dmx/dmxlog.c
index b56bb93..151f672 100644
--- a/hw/dmx/dmxlog.c
+++ b/hw/dmx/dmxlog.c
@@ -86,6 +86,8 @@ ErrorF(const char *format, ...)
 
 /** Provide an VFatalError function when used stand-alone. */
 static void
+VFatalError(const char *format, va_list args) _X_ATTRIBUTE_PRINTF(1, 0) _X_NORETURN;
+static void
 VFatalError(const char *format, va_list args)
 {
     vfprintf(stderr, format, args);     /* RATS: We assume the format string
@@ -104,7 +106,9 @@ VErrorF(const char *format, va_list args)
 }
 #else
 /** This function was removed between XFree86 4.3.0 and XFree86 4.4.0. */
-extern void AbortServer(void);
+extern void AbortServer(void) _X_NORETURN;
+static void
+VFatalError(const char *format, va_list args) _X_ATTRIBUTE_PRINTF(1, 0) _X_NORETURN;
 static void
 VFatalError(const char *format, va_list args)
 {
@@ -166,6 +170,8 @@ dmxHeader(dmxLogLevel logLevel, DMXInputInfo * dmxInput,
 /* Prints the error message with the appropriate low-level X output
  * routine. */
 static void
+dmxMessage(dmxLogLevel logLevel, const char *format, va_list args) _X_ATTRIBUTE_PRINTF(2, 0);
+static void
 dmxMessage(dmxLogLevel logLevel, const char *format, va_list args)
 {
     if (logLevel == dmxFatal || logLevel >= dmxCurrentLogLevel) {
@@ -303,10 +309,11 @@ dmxLogVisual(DMXScreenInfo * dmxScreen, XVisualInfo * vi, int defaultVisual)
         class = "DirectColor";
         break;
     }
+#define VisualLogFormat "0x%02lx %s %2db %db/rgb %3d 0x%04lx 0x%04lx 0x%04lx%s\n"
 
     if (dmxScreen) {
         dmxLogOutput(dmxScreen,
-                     "0x%02x %s %2db %db/rgb %3d 0x%04x 0x%04x 0x%04x%s\n",
+                     VisualLogFormat,
                      vi->visualid, class, vi->depth, vi->bits_per_rgb,
                      vi->colormap_size,
                      vi->red_mask, vi->green_mask, vi->blue_mask,
@@ -314,7 +321,7 @@ dmxLogVisual(DMXScreenInfo * dmxScreen, XVisualInfo * vi, int defaultVisual)
     }
     else {
         dmxLog(dmxInfo,
-               "  0x%02x %s %2db %db/rgb %3d 0x%04x 0x%04x 0x%04x%s\n",
+               "  " VisualLogFormat,
                vi->visualid, class, vi->depth, vi->bits_per_rgb,
                vi->colormap_size,
                vi->red_mask, vi->green_mask, vi->blue_mask,
diff --git a/hw/dmx/dmxlog.h b/hw/dmx/dmxlog.h
index 4d4cd26..162484b 100644
--- a/hw/dmx/dmxlog.h
+++ b/hw/dmx/dmxlog.h
@@ -55,18 +55,23 @@ typedef enum {
 /* Logging functions used by Xserver/hw/dmx routines. */
 extern dmxLogLevel dmxSetLogLevel(dmxLogLevel newLevel);
 extern dmxLogLevel dmxGetLogLevel(void);
-extern void dmxLog(dmxLogLevel logLevel, const char *format, ...);
-extern void dmxLogCont(dmxLogLevel logLevel, const char *format, ...);
+extern void dmxLog(dmxLogLevel logLevel, const char *format,
+                             ...) _X_ATTRIBUTE_PRINTF(2, 3);
+extern void dmxLogCont(dmxLogLevel logLevel, const char *format,
+                             ...) _X_ATTRIBUTE_PRINTF(2, 3);
 extern const char *dmxEventName(int type);
 
 #ifndef DMX_LOG_STANDALONE
-extern void dmxLogOutput(DMXScreenInfo * dmxScreen, const char *format, ...);
+extern void dmxLogOutput(DMXScreenInfo * dmxScreen, const char *format,
+                             ...) _X_ATTRIBUTE_PRINTF(2, 3);
 extern void dmxLogOutputCont(DMXScreenInfo * dmxScreen, const char *format,
-                             ...);
+                             ...) _X_ATTRIBUTE_PRINTF(2, 3);
 extern void dmxLogOutputWarning(DMXScreenInfo * dmxScreen, const char *format,
-                                ...);
-extern void dmxLogInput(DMXInputInfo * dmxInput, const char *format, ...);
-extern void dmxLogInputCont(DMXInputInfo * dmxInput, const char *format, ...);
+                             ...) _X_ATTRIBUTE_PRINTF(2, 3);
+extern void dmxLogInput(DMXInputInfo * dmxInput, const char *format,
+                             ...) _X_ATTRIBUTE_PRINTF(2, 3);
+extern void dmxLogInputCont(DMXInputInfo * dmxInput, const char *format,
+                             ...) _X_ATTRIBUTE_PRINTF(2, 3);
 extern void dmxLogArgs(dmxLogLevel logLevel, int argc, char **argv);
 extern void dmxLogVisual(DMXScreenInfo * dmxScreen, XVisualInfo * vi,
                          int defaultVisual);

commit f8d2ca759ad37d5e99d462f21a2259ce17bb1a00
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Apr 18 15:56:37 2012 +1000

    dix: indentation fix
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit ebf214876a4885a98ded4f5525925b69005fae05)

diff --git a/dix/dispatch.c b/dix/dispatch.c
index 9a2e22f..d971805 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -416,8 +416,8 @@ Dispatch(void)
                 if (XSERVER_REQUEST_START_ENABLED())
                     XSERVER_REQUEST_START(LookupMajorName(client->majorOp),
                                           client->majorOp,
-                                          ((xReq *) client->requestBuffer)->
-                                          length, client->index,
+                                          ((xReq *) client->requestBuffer)->length,
+                                          client->index,
                                           client->requestBuffer);
 #endif
                 if (result > (maxBigRequestSize << 2))


Reply to: