[PATCH v2 xserver] Fix a crash with XDMCP error handler

[Olivier Fourdan]

The XdmcpFatal() error handler uses a string format that the
vpnprintf() routine does not understand, as a result any XDMCP
fatal error leads to a server crash:

    (EE) (EE) BUG: triggered 'if (f[f_idx])'
    (EE) BUG: log.c:474 in vpnprintf()
    (EE) Unsupported printf directive '*'

Rework the XdmcpFatal() code to use a simpler string format
instead.

Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>
---
 v2: Use malloc() instead of a fixed char array

 os/xdmcp.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/os/xdmcp.c b/os/xdmcp.c
index b6e97c9..0e9e625 100644
--- a/os/xdmcp.c
+++ b/os/xdmcp.c
@@ -1409,8 +1409,16 @@ recv_alive_msg(unsigned length)
 static void
 XdmcpFatal(const char *type, ARRAY8Ptr status)
 {
-    FatalError("XDMCP fatal error: %s %*.*s\n", type,
-               status->length, status->length, status->data);
+    char *error_message;
+
+    /* error_message is leaked, but that's fine, we're aborting */
+    error_message = malloc (status->length + 1);
+    if (!error_message)
+        FatalError("XDMCP fatal error: %s", type);
+
+    memcpy(error_message, status->data, status->length);
+    error_message[status->length] = '\0';
+    FatalError("XDMCP fatal error: %s %s\n", type, error_message);
 }
 
 static void
-- 
2.1.0