Live data from Hacker News

OpenSSL Heartbeat Code

1–5 of 5 posts

Post by MIT_Hacker » Sat, Apr 12, 2014, 12:27 AM UTC

Re: OpenSSL Heartbeat Code

Post by [deleted] » Sat, Apr 12, 2014, 1:26 AM UTC

[deleted]

Post by smtddr » Sat, Apr 12, 2014, 1:26 AM UTC

Amelek is being a bit harsh or just plain wrong; I learned a few days ago that checking malloc's return value means almost nothing:

Post by askQi » Sat, Apr 12, 2014, 1:27 AM UTC

Can someone explain which part of the code contains the bug and why it is a bug?

Post by syncerr » Sat, Apr 12, 2014, 2:50 AM UTC

OpenSSL heartbeat bug patch (CVE-2014-0160):

> A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.