This isn't how I remember it nor what the code looks like [1]. Briefly: 1. tls1_process_heartbeat() retrieves type and 16-bit length from the SSL record. 2. I

This isn't how I remember it nor what the code looks like [1]. Briefly: 1. tls1_process_heartbeat() retrieves type and 16-bit length from the SSL record. 2. It stores a pointer to the payload (which is after the two length bytes). 3. For the response, it allocates an output buffer and memcpy()s from the payload pointer to the output buffer. 4. If the specified payload length (the two bytes preceding the payload) is less than the actual length of the payload, memcpy() will read past the actual payload in the SSL record and will copy arbitrary memory contents to the response. This looks like a pretty traditional buffer overrun to me. As far as I can tell, nowhere in the code was the input ever extended to match the specified rather than the actual payload length and the fix was to insert a sanity check to abort if there's a mismatch. [1] http://git.openssl.org/gitweb/?p=openssl.git;a=blob;f=ssl/t1_lib.c;h=a2e2475d136f33fa26958fd192b8ace158c4899d#l3964 http://git.openssl.org/gitweb/?p=openssl.git;a=blob;f=ssl/t1...