# Heartbleed: length of heatbeat message?

What is the right length of heartbeat message between 2^14 and 2^16 ?

The RFC https://tools.ietf.org/html/rfc6520 says that

The total length of a HeartbeatMessage MUST NOT exceed 2^14 or
max_fragment_length when negotiated as defined in [RFC6066].

In this Heartbleed PoC the size is `40 00` in hex so 16 384 -> 2^14

But if I check these explanations (two from many):

Then the maximum length is 65 535 -> 2^16

EDIT SOLVED ?

I test Heartbleed PoC code, the hb code is :

``````hb = h2bin('''
18 03 02 00 03
01 40 00
''')
``````

`40 00` -> 16 384 -> 2^14

If i print the length received, it show 16 384

If i replace `40 00` by `FF FF` -> 2^16, the length of the data received is still 16 384 four time.

``````16 384
16 384
16 384
16 384
``````

=> 2^16

Interesting

So the max is 2^16 but it will be divided on packets length 2^14

• The designed message length is 2^14, but there is overhead added to it (padding, etc)? Message is supposed to be one size, but to exploit it, you need the extra length. – schroeder Mar 8 '15 at 18:39

• you mean 2^14 at the first line no ? rfc say `The total length of a HeartbeatMessage MUST NOT exceed 2^14` – mpgn Mar 9 '15 at 6:46
• @mpgn Yes you are right, amended the answer for that. Note that if you chose exactly `0xFFFF` as Heartbeat message length, you will not receive the last 19 bytes as these are being buffered. – Lekensteyn Mar 9 '15 at 9:39