datastax/cpp-driver — pull request #42 by planetbeing (2014-06-13 00:38:12+00:00)
Title: Fix MessageBody::prepare in OptionsRequest and ReadyResponse where 0 bytes are allocated.

Found this with:

(lldb) env DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib
(lldb) env MALLOC_STRICT_SIZE=1
(lldb) env MALLOC_FILL_SPACE=1

Initializing size to reserved after calling new char[size] causes a buffer of length 0 to be allocated for output. This is because Message::prepare initializes size to 0 before calling MessageBody::prepare. This causes a buffer overrun when Message::prepare attempts to write the header in the allocated buffer.