diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-11 21:00:46 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-08-11 21:00:46 +0300 |
| commit | bb62ae7b29a20f7c2d4e26b9f5ad330f1bcc3d73 (patch) | |
| tree | 15ad174152334ccf645f6269f7f12fb3ce7e49e5 /tests/common/accel_pppd_process.py | |
| parent | 1719b4ab756158f4a102bcf5036ff250d67ed015 (diff) | |
| download | accel-ppp-bb62ae7b29a20f7c2d4e26b9f5ad330f1bcc3d73.tar.gz accel-ppp-bb62ae7b29a20f7c2d4e26b9f5ad330f1bcc3d73.zip | |
log_pgsql: bound username and sessionid in log header
set_hdr() copied the session username and sessionid into the message
header chunk with strcpy(). That chunk comes from chunk_pool and holds
only LOG_CHUNK_SIZE + 1 bytes, while the username is peer supplied and
may be up to 255 bytes long (PAP), so a long username overflowed the
chunk and corrupted the heap when log-pgsql was enabled.
Use snprintf() to truncate both fields to the space left in the chunk.
Diffstat (limited to 'tests/common/accel_pppd_process.py')
0 files changed, 0 insertions, 0 deletions