Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

OpenBSD's malloc is much more strict for security reasons. A crash sucks, but it's infinitely preferable to an undetected bug that leaks data.

Heartbleed was famously possible even when using OpenSSL on OpenBSD because OpenSSL (if I understand right) used its own custom allocator instead of the system malloc, thus bypassing the various attack mitigations OpenBSD's malloc provides (and that would have prevented Heartbleed from affecting OpenBSD systems). This (among other instances of similar behavior) is what prompted the OpenBSD folks to fork OpenSSL into libressl.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: