Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's also more secure. We've just this week now had an SSH bug where random chunks of memory get dumped somewhere they shouldn't (not that I'm clear on if calloc would help in this case, but the issue remains).

Zeroing memory is just good habit - it's means you don't wind up accidentally leaking things when you make a mistake. And you should assume you will.



calloc is not relevant to that issue - it's an out-of-bounds read.

(Good ASLR does help, by turning such issues into crash bugs.)


https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-077...

>- "out_start == out_last" (lines 205-206): no data was ever written to out_buf (and both out_start and out_last are still equal to 0) because no data was ever sent to the server after roaming_reply() was called, but the client sends (leaks) the entire uninitialized out_buf to the server (line 214), as if out_buf_size bytes of data were available.


Heartbleed wasn't an out-of-bounds read.


If OpenSSL had used calloc() everywhere instead of malloc(), Heartbleed would have still happened.


This bug isn't heartbleed. Also Heartbleed was SSL, not SSH.


I'm aware.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: