I think you have misunderstood the bug, actually. It has nothing to do with read(2) returning less data than requested. There are two length fields at play here

I think you have misunderstood the bug, actually. It has nothing to do with read(2) returning less data than requested. There are two length fields at play here, the SSL record layer length field, and a second length field in the heartbeat field. Both are 16 bits. OpenSSL correctly reads the whole packet using the SSL record length. It then passes the packet off to the `tls1_process_heartbeat` function, which uses the second length field to do (variable names changed because the originals were terrible): outgoing_packet = malloc(heartbeat_len) memcpy(outgoing_packet, incoming_packet, heartbeat_len) So when the two length fields disagree, SSL's network code correctly reads the short packet, and the heartbeat code incorrectly reads past the end of the incoming packet buffer and copies it into the outgoing packet buffer. Edit: As a shortcut to establish my bona fides, I wrote a honeypot for this issue so I ought to know what I'm talking about: https://twitter.com/moyix/status/453760960671383552 https://twitter.com/moyix/status/453760960671383552