Dr. Stephen Henson 731f431497 Add heartbeat extension bounds check. ...

A missing bounds check in the handling of the TLS heartbeat extension
can be used to reveal up to 64k of memory to a connected client or
server.

Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix (CVE-2014-0160)
(cherry picked from commit 96db9023b8)

2014-04-07 19:44:38 +01:00

41 KiB

Raw Blame History

View Raw