3 ms·
Isn't that roughly how heartbleed works? Trusting the provided length?
by fbdab103 4y ago
Isn't that roughly how heartbleed works? Trusting the provided length?
- MereInterest 4y agoIf the caller is an external actor, yes, their provided length should not be trusted. However, this is not always the case. The caller may be another part of the same program, trusted not to perform malicious actions to the same extent that the rest of the program is trusted.
- magicalhippo 4y agoHearbleed was due to failure to sanitize external data[1], not sure how that's directly relevant to what I wrote. I mean sure if the caller fails to sanitize and as a result passes a size that's bigger than the actual buffer, the callee doesn't have much in the way of detecting that. But that's a general C issue, nothing specific to what I wrote. [1]: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=96db9023b881d7cd9f379b0c154650d6c108e9a3 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h...