Lesson 2 of 81972–today8 min
Variables and memory
In April 2014 researchers disclosed Heartbleed (CVE-2014-0160), a flaw in OpenSSL, the library that encrypted a large share of the web's traffic. A client could send a heartbeat message saying, in effect, "here are 1 byte, send them back, and by the way they are 64 KB long". The server believed the length field, copied 64 KB starting from that 1 byte, and sent back whatever happened to be next in its memory: session cookies, passwords, sometimes private keys.
The bug was one missing bounds check in C, a language that lets a program read any memory it can name. To understand why that is possible, and why Python makes it impossible, you have to look at what a variable really is.
The rest of this lesson is part of Pro
Create a free account to read the first lesson of every path, and go Pro for the rest.
Sources
- Data model: objects, values and types — Python documentation
- The Heartbleed Bug — Synopsys / Codenomicon
- CVE-2014-0160 Detail — NIST National Vulnerability Database
- The Development of the C Language (Dennis M. Ritchie) — Bell Labs