3 ms·
calloc is not relevant to that issue - it's an out-of-bounds read. (Good ASLR does help, by turning such issues into crash bugs.)
by JoachimSchipper 11y ago
calloc is not relevant to that issue - it's an out-of-bounds read.
(Good ASLR does help, by turning such issues into crash bugs.)
- anon1385 11y agohttps://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-077... >- "out_start == out_last" (lines 205-206): no data was ever written to out_buf (and both out_start and out_last are still equal to 0) because no data was ever sent to the server after roaming_reply() was called, but the client sends (leaks) the entire uninitialized out_buf to the server (line 214), as if out_buf_size bytes of data were available.
- TazeTSchnitzel 11y agoHeartbleed wasn't an out-of-bounds read.
- user9982 11y agoThis bug isn't heartbleed. Also Heartbleed was SSL, not SSH.
- TazeTSchnitzel 11y agoI'm aware.
- notalaser 11y agoIf OpenSSL had used calloc() everywhere instead of malloc(), Heartbleed would have still happened.