A buffer overflow occurs when user-controlled data exceeds its allocated bounds and overwrites adjacent memory. If executable areas are changed, an attacker may take control of a server. section 10.6
Heartbeat memory failure
Heartbleed illustrates the related danger of unchecked lengths: a client requests a long heartbeat response while supplying little data, causing the server to read beyond its heartbeat buffer. In OpenSSL 1.0.1f, memcpy(bp, pl, payload) trusts the claimed payload length without validating the available input.
Reduce exposure by combining implementation discipline with platform defenses:
- Avoid C/C++ functions without length checks, including strcpy(), sprintf(), gets(), and scanf(). section 10.6
- Use bounded alternatives such as strncpy(), snprintf(), fgets(), and sscanf(); treat memcpy() as safe only when bounds are verified. section 10.6
- Recognize mitigations such as address space layout randomization, data execution prevention, and stack canaries, alongside bypasses such as return-oriented programming. section 10.6
