summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFlorian Lohoff <f@zz.de>2021-02-15 15:34:07 +0100
committerJan Wagner <waja@cyconet.org>2021-02-15 15:34:07 +0100
commitdae075e65a38c65352d04f8c8fdfa21e2056d01c (patch)
treea9606e752ff105f10653d4ac48b279c0fd800fef
parent05d7f70d4553e19ea5eb27ec5c97098f014550df (diff)
downloadmonitoring-plugins-dae075e65a38c65352d04f8c8fdfa21e2056d01c.tar.gz
Using snprintf which honors the buffers size and guarantees null termination. (Closes: #1601)
As strcpy may overflow the resulting buffer: flo@p5:~$ /tmp/f/usr/lib/nagios/plugins/check_pgsql -d "$(seq 1 10000)" *** buffer overflow detected ***: terminated Aborted I would propose to change the code rather like this, using snprintf which honors the buffers size and guarantees null termination.
-rw-r--r--plugins/check_pgsql.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/plugins/check_pgsql.c b/plugins/check_pgsql.c
index 11ce6916..b8fc5f1d 100644
--- a/plugins/check_pgsql.c
+++ b/plugins/check_pgsql.c
@@ -347,7 +347,7 @@ process_arguments (int argc, char **argv)
347 if (!is_pg_dbname (optarg)) /* checks length and valid chars */ 347 if (!is_pg_dbname (optarg)) /* checks length and valid chars */
348 usage2 (_("Database name is not valid"), optarg); 348 usage2 (_("Database name is not valid"), optarg);
349 else /* we know length, and know optarg is terminated, so us strcpy */ 349 else /* we know length, and know optarg is terminated, so us strcpy */
350 strcpy (dbName, optarg); 350 snprintf(dbName, NAMEDATALEN, "%s", optarg);
351 break; 351 break;
352 case 'l': /* login name */ 352 case 'l': /* login name */
353 if (!is_pg_logname (optarg)) 353 if (!is_pg_logname (optarg))