Cloudbleed: == instead of >= made Cloudflare leak private data

transcript

One character let Cloudflare leak private data. Leaks were possible for months. Cookies. Login tokens. Form data. Inside ordinary web pages.

00:11 UTC. Tavis Ormandy of Google's Project Zero tweets. He needs a Cloudflare contact. 00:32. Details arrive. Pages through Cloudflare are coming back corrupted. 01:19. Cloudflare switches off email obfuscation, worldwide. 47 minutes.

A page looks normal at the top. Then, past the end, raw server memory. Cookies. Login tokens. And search engines had cached some of it.

The villain? One line of generated C code. It asks: has the pointer reached the end? With double equals.

The parser walks through the page. One pointer step at a time. But if it jumps past the end, equals never fires. It keeps reading memory. Into the response.

But here's the twist. That bug sat in the old parser for years. Harmless. The buffers never let it fire. Then Cloudflare started replacing it. The new parser changed the buffers. And woke the old bug up.

At peak, about 1 in every 3 point 3 million requests could leak. The full fix was out in under 7 hours. Then the hunt. 770 cached pages, across 161 domains, purged.

Never check a boundary with equals. Check greater-or-equal. And fuzz old code before you change what's around it.

Full story in the article.