From the link that you supply in [0]: > What if the requester didn't actually supply payload bytes, like she said she did? What if pl really is only one byte?

From the link that you supply in [0]: > What if the requester didn't actually supply payload bytes, like she said she did? What if pl really is only one byte? Then the read from memcpy is going to read whatever memory was near the SSLv3 record and within the same process.