Incident report on memory leak caused by Cloudflare parser bug

Calling this a "memory leak" is rather misleading. The problem is literally leaking the contents of memory, yes, but the term memory leak usually means something else, something that is usually not as problematic as dumping random memory to the internet.

@jgrahamc:

What are your thoughts about Tavis' remark that Cloudflare's communications (the "draft", post-mortem, etc.) "severely downplays" this issue?

See also the Project Zero ticket https://bugs.chromium.org/p/project-zero/issues/detail?id=11... and associated Hacker News discussion https://news.ycombinator.com/item?id=13718752

It's interesting that there was another recent Cloudflare bug caused by using an "==" vs "<=" or ">=".

It's good to know that programs can get into states that you don't expect.

https://blog.cloudflare.com/how-and-why-the-leap-second-affe...

I'm a Cloudflare (free) customer, and I've had no email or contact of any kind from Cloudflare.

My understanding from reading this and Travis' post is that all Cloudflare customers are affected, is that correct?

> "With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory... The leaked memory has been purged with the help of the search engines."

I wonder if the search engines found any interesting patterns of searches performed whose results contained these 770 unique URIs.

I wonder if they rewrite their unsafe C code with Rust, would this bug still likely to happen?