Merge branch 'master' into fix-1173-dump-utf8-tz

diff --cc CHANGES
index 6f2dbcf73b42d6d24cf1b1186875faca7ed43c5d,8817e784c336d8348babf934cb6c972f211ae5f2..f723445a57e501ecc526075c1b89340e7e8ebd08
--- 1/CHANGES
--- 2/CHANGES
+++ b/CHANGES
@@@ -3,15 -3,28 +3,37 @@@ RRDtool - master ..
  ====================
  Bugfixes
  --------
 +* `rrdtool dump` now uses a numeric UTC offset (`%z`, e.g. `+0900`) instead
 +  of the locale timezone name (`%Z`) in XML comments. Locale timezone names
 +  can be encoded in a non-UTF-8 encoding (e.g. CJK locales), which breaks
 +  the XML declaration and causes `rrdtool restore` to fail with
 +  "Input is not proper UTF-8". The numeric offset is always ASCII.
 +  Note: existing dump files already containing locale timezone names remain
 +  valid XML as long as their encoding matches; newly created dumps will
 +  always contain pure ASCII in these comments. Issue #1173
 +  reported by @k79e, fix by @oetiker.
+ * Fix segfault when `--x-grid` is given without a trailing date-format
+   field. The `%n` conversion in `sscanf()` is not counted in its return
+   value, so `stroff` remained uninitialized when the input ended before
+   the final `:` separator; the subsequent `stroff != 0` guard read
+   garbage and could branch into `strdup()` with a bogus offset. Fixed by
+   initialising `stroff = 0` so a partial match safely falls through to
+   the existing "invalid x-grid format" error path. Issue #1291
+   reported by @anvilvapre, fixed by @oetiker
+ * libdbi /derive now returns 0 instead of NaN when the underlying
+   counter is constant (zero delta). Previously the strict `d_value > 0`
+   guard skipped zero deltas the same way it skips negative ones (counter
+   resets). Changed to `d_value >= 0`. Issue #550 reported by
+   @bitionaire, fix by @oetiker.
+ * Fix a 1-byte heap buffer overflow in `checkUnusedValues()` that
+   triggered `*** buffer overflow detected ***` SIGABRT under glibc
+   fortified `strcat()` when reporting unused graph arguments. The
+   function under-allocated by one byte and silently relied on that
+   overflow to make its trailing `:` strip land on the right index.
+   Refactored to size buffers correctly and prepend the separator
+   rather than build-then-strip, so the two no longer have to agree.
+   Reported and original fix attempt in PR #1329 by @ppisar,
+   refactored fix by @oetiker
  * Pad the Perl `$RRDs::VERSION` / `$RRDp::VERSION` numeric encoding so
    two-digit minor releases compare monotonically. The numeric version
    now uses three-digit zero-padded minor and patch fields, e.g.

diff --cc src/rrd_dump.c
Simple merge