OpenSSL heartbeat bug patch (CVE-2014-0160):<p><a href="https://github.com/openssl/openssl/commit/731f431497f463f3a2a97236fe0187b11c44aead" rel="nofollow">https://github.com/openssl/openssl/commit/731f431497f463f3a2...</a><p>> A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.<p>Previous discussion: <a href="https://news.ycombinator.com/item?id=7557825" rel="nofollow">https://news.ycombinator.com/item?id=7557825</a>
<a href="https://github.com/openssl/openssl/commit/bd6941cfaa31ee8a3f8661cb98227a5cbcc0f9f3?resubmit#commitcomment-5945571" rel="nofollow">https://github.com/openssl/openssl/commit/bd6941cfaa31ee8a3f...</a><p>Amelek is being a bit harsh or just plain wrong; I learned a few days ago that checking malloc's return value means almost nothing:<p><a href="https://news.ycombinator.com/item?id=7541585" rel="nofollow">https://news.ycombinator.com/item?id=7541585</a>