flawopen.com/安全事件/Citrix Bleed
你让助理把一段通知抄在只能容纳 50 个字的小卡片上，并询问这篇通知有多长。助理抄写了前 50 个字，但据实回答'这篇通知原稿共 800 字'。随后你命令传令员从卡片上念出 800 个字：传令员念完卡片上的 50 个字后，把桌上摊着的机密文件、领导口令全当作通知内容一股脑念了出去。
This is the operational lesson teams repeatedly missed, and it mirrors the GitLab path traversal two years later. Upgrading the appliance stopped further memory disclosure — but any session tokens already stolen remained valid. Attackers who had harvested tokens before the patch simply continued using them afterwards.
Citrix's guidance was therefore explicit that remediation required both upgrading and terminating all active sessions on the appliance. Organisations that patched without killing sessions stayed compromised, and several high-profile intrusions followed exactly that path.
snprintf for truncation, always. The idiom if (n >= sizeof(buf)) should be reflexive. Treating the return value as bytes-written is one of the most common serious bugs in C code.Both are out-of-bounds reads that leak adjacent process memory to an unauthenticated attacker, and both leaked credentials. The underlying mistake differs: Heartbleed trusted an attacker-supplied length field directly, while Citrix Bleed trusted a length derived from a standard library function whose semantics were misunderstood.
Often you cannot determine this conclusively from appliance logs, which is precisely why the guidance is to terminate all sessions unconditionally rather than attempt to establish exposure first.