3 ms·
Heartbleed occurred because the size of the buffer was based on the size provided by the malicious packet, the buffer was not zeroed, and then the user-provided
by akerl_ 12y ago
Heartbleed occurred because the size of the buffer was based on the size provided by the malicious packet, the buffer was not zeroed, and then the user-provided data was written to the buffer. If user-provided-data size was less than what you said it was, the rest of the buffer contained whatever it had previously contained.
- MichaelGG 12y agoAnd since people were able to recover SSL keys, does this not mean that this buffer was used for... everything? Having a non zeroing allocator for an entire library seems rather ambitious. It's significantly worse then just having a buffer pool for, say, incoming packets or something.
- akerl_ 12y agoOh yes, using buffers without zeroing them is a terrible idea, and sharing those buffers among different types of things is a terrible idea. I was specifically commenting on the fact that what the parent comment described as "terribly unlikely" is in fact what happened.
- legulere 12y agoThere was no buffer reuse like in the linked rust demonstration, but it was data from previous allocations.