log_pgsql: bound username and sessionid in log header

set_hdr() copied the session username and sessionid into the message
header chunk with strcpy(). That chunk comes from chunk_pool and holds
only LOG_CHUNK_SIZE + 1 bytes, while the username is peer supplied and
may be up to 255 bytes long (PAP), so a long username overflowed the
chunk and corrupted the heap when log-pgsql was enabled.

Use snprintf() to truncate both fields to the space left in the chunk.

0 files changed, 0 insertions, 0 deletions