So I have been googling about this OpenSSL heart-bleed thing and somehow sees that it is caused by the heartbeat extension which requires client to ping the server to show its aliveness and it all comes to this memcpy function in C which is meant to copy from the source array to the destination array with the user specified size.
If the size was a lie (which means the source contains lesser byte than the size claims) then memcpy will grab the arbitrary memory around and allocated to the destination and in this case send back to the client…
payloadis controlled by the attacker, and it's quite large at 64KB. If the actual
HeartbeatMessagesent by the attacker only has a payload of, say, one byte, and its payload_length is a lie, then the above
memcpy()will read beyond the end of the received
HeartbeatMessageand start reading from the victim process's memory...
If my understanding above is correct, then I have a question here maybe naive one, why do we have to do array (char array here) copying here? Can't we just pass on the source char array that the client sent to us?
i.e. If you send me
Then I would just need to send back that very array