Fix buffer over-run in health_check().

If helth_check_user length is greater than 32 byte, buffer over-run
was caused by strcpy(). It uses strncpy() instead of strcpy().

Patch contributed by Taiki Yamaguchi.

diff --git a/child.c b/child.c
index e46822cb2e5a2be16da304816c5d32f856259539..3fcab648245f6e1ff2c97361fbe8bf51e3b3458d 100644 (file)
--- a/child.c
+++ b/child.c
@@ -1037,7 +1037,7 @@ int health_check(void)
        mysp.len = htonl(296);
        mysp.sp.protoVersion = htonl(PROTO_MAJOR_V2 << 16);
        strcpy(mysp.sp.database, "template1");
-       strcpy(mysp.sp.user, pool_config.health_check_user);
+       strncpy(mysp.sp.user, pool_config.health_check_user, sizeof(mysp.sp.user) - 1);
        *mysp.sp.options = '\0';
        *mysp.sp.unused = '\0';
        *mysp.sp.tty = '\0';