This question already has an answer here:

I've read lots of reports of the HeartBleed bug but have not been able to find a description at the source-code level, such as this one for the goto fail bug. Can anyone provide, or point to, such an explanation?

marked as duplicate by AviD Apr 10 '14 at 13:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


The blog existentialize did a simple, easy to read writeup.

The basics are:

unsigned char *buffer, *bp;
int r;

/* Allocate memory for the response, size is 1 byte
 * message type, plus 2 bytes payload length, plus
 * payload, plus padding
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;

Allocate what the requestor asked for. Without zeroing it out.

/* Enter response type, length and copy payload */
s2n(payload, bp);
memcpy(bp, pl, payload);

Copy the sender's payload to send it back to them.

Except... the sender didn't send a payload.

Directly from the blog: "What if the requester didn't actually supply payload bytes, like she said she did? What if pl really is only one byte? Then the read from memcpy is going to read whatever memory was near the SSLv3 record and within the same process."

Not the answer you're looking for? Browse other questions tagged or ask your own question.