cve: CVE-2014-0160
alias: Heartbleed
cwe_primary: CWE-125
cwe_acceptable: [CWE-125, CWE-119, CWE-126, CWE-200, CWE-787]
target_file: source.c
vuln_lines: [37, 38, 45, 46]
severity: high
vuln_class: out_of_bounds_read
exploit_pattern_regex: 'payload\s*[><]|memcpy.*pl.*payload|attacker.*controlled.*length'
must_mention_any:
  - bounds check
  - payload length
  - attacker controlled
  - memcpy
  - out-of-bounds read
  - information disclosure
points: 30
notes: |
  Vulnerability: `payload` is read from the network (n2s on line 37) into a 16-bit
  unsigned int. The implementation trusts that `payload` reflects the actual data
  length in the heartbeat record and uses it on line 46 (memcpy) and as
  allocation size (line 41). No comparison against `s->s3_rrec_length` is performed
  before the memcpy, leaking up to 64 KiB of process memory.
  Hunter MUST identify:
    1. Missing bounds check between declared payload length and actual record length
    2. memcpy from `pl` (network pointer) for `payload` bytes
    3. The result is an out-of-bounds read disclosing memory.