April 2014. Heartbleed. OpenSSL's heartbeat let a client say how many bytes to echo back, and the server believed it, no questions asked. Ask for 64 kilobytes while sending almost nothing, and the reply came back padded with whatever was next in the server's memory: private keys, passwords, session cookies. Around half a million trusted web servers were exposed. The whole disaster was one missing check. Add it.
Objective
Return how many heartbeat bytes are safe to echo: honor the request only when it fits in what was actually received.
Steps
$ bytes_to_echo(3, 64)
3
$ bytes_to_echo(65535, 64)
0
$ bytes_to_echo(64, 64)
64
Expected files
Allowed functions
None. Write every helper yourself.
Loading solutions...