Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: files closed properly, in accordance with FIO04-J

...

Code Block
bgColor#FFcccc
class ShowHeapError {
  private Vector<String> names = new Vector<String>();
  private final InputStreamReader input;
  private final BufferedReader reader;

  public ShowHeapError(String filename) throws IOException {
    this.input = new FileReader(filename);
    this.reader = new BufferedReader(input);
  }

  public void addNames() throws IOException {
    try {
      String newName;
      while (((newName = reader.readLine()) != null) &&
             (newName.equalsIgnoreCase("quit") == false)) {
        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

  public static void main(String[] args) throws IOException {
    if (args.length != 1) {
      System.out.println("Arguments: [filename]");
      return;
    }
    ShowHeapError demo = new ShowHeapError(args[0]);
    demo.addNames();
  }
}

...

Code Block
bgColor#ccccff
class ShowHeapError {
  // ... other methods

  static public String readLimitedLine(Reader reader, int limit) throws IOException {
    StringBuilder sb = new StringBuilder();
    for (int i = 0; i < limit; i++) {
      int c = reader.read();
      if (c == -1) {
        return null;
      }
      if (((char) c == '\n') || ((char) c == '\r')) {
        break;
      }
      sb.append((char) c);
    }
    return sb.toString();
  }

  static public final int lineLengthLimit = 1024;
  static public final int lineCountLimit = 1000000;

  public void addNames() throws IOException {
    try {
      String newName;
      for (int i = 0; i < lineCountLimit; i++) {
        newName = readLimitedLine( reader, lineLengthLimit);
        if (newName == null) {
          break;
        }
        if (newName.equalsIgnoreCase("quit")) {
          break;
        }

        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

}

The readLimitedLine() method defined above takes a numeric limit, indicating the total number of characters that may exist on one line. If a line contains more characters, the line is truncated, and they are returned on the next invocation. This prevents an attacker from exhausting memory by supplying input with no line breaks.

...

Code Block
bgColor#ccccff
class ShowHeapError {
  // ...other methods
  static public final int fileSizeLimit = 1000000;

  public ShowHeapError(String filename) throws IOException {
    if (Files.size( Paths.get( filename)) > fileSizeLimit) {
      throw new IOException("File too large");
    }
    this.input = new FileReader(filename);
    this.reader = new BufferedReader(input);
  }

  // ...other methods
}

Noncompliant Code Example

...

Code Block
bgColor#FFcccc
/** Assuming the heap size as 512 MB (calculated as 1/4th of 2 GB RAM = 512 MB)
 *  Considering long values being entered (64 bits each, the max number of elements
 *  would be 512 MB/64bits = 67108864)
 */
public class ShowHeapError {
  Vector<Long> names = new Vector<Long>(); // Accepts unknown number of records
  long newID = 0L;
  int count = 67108865;
  int i = 0;
  InputStreamReader input = new InputStreamReader(System.in);
  Scanner reader = new Scanner(input);

  public void addNames() {
    try {
      do {
        // Adding unknown number of records to a list
        // The user can enter more IDs than the heap can support and thus 
        // exhaust the heap. Assume that the record ID is a 64 bit long value

    
      System.out.print("Enter recordID (To quit, enter -1): ");
        newID = reader.nextLong();
   
  
      names.addElement(newID);
        i++;
      } while (i < count || newID != -1);
    } finally {
  // Close "reader" and "input"input.close();
    }
  }

  public static void main(String[] args) {
    ShowHeapError demo = new ShowHeapError();
    demo.addNames();
  }
}

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2915eae91305ac63-67a344e0-491844e7-a1b697a7-bbfa37f601eeaba0acd7b03d"><ac:plain-text-body><![CDATA[

[[MITRE 2009

AA. Bibliography#MITRE 09]]

[CWE-400

http://cwe.mitre.org/data/definitions/400.html] "Uncontrolled Resource Consumption ('Resource Exhaustion')"

]]></ac:plain-text-body></ac:structured-macro>

 

CWE-770 "Allocation of Resources Without Limits or Throttling"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e0c82c42ad852216-17a42ea6-4abe418f-9e2f81ba-fba7cb8309d08f3ac9903a7f"><ac:plain-text-body><![CDATA[

[[Sun 2006

AA. Bibliography#Sun 06]]

[Garbage Collection Ergonomics

http://java.sun.com/javase/6/docs/technotes/guides/vm/gc-ergonomics.html ], "Default values for the Initial and Maximum heap size"

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="543d65dfae84dbc8-eaf82c7c-4d6a4c2e-80f39c08-be37c0e9790a9970da87f6ea"><ac:plain-text-body><![CDATA[

[[Java 2006

AA. Bibliography#Java 06]]

[java - the Java application launcher

http://java.sun.com/javase/6/docs/technotes/tools/windows/java.html ], "Syntax for increasing the heap size"

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3d6ad7c55f21b63b-6c1a66f8-482e4b77-9e5a862d-4efa1816db8c782b91cf5b91"><ac:plain-text-body><![CDATA[

[[Sun 2003

AA. Bibliography#Sun 03]]

Chapter 5: Tuning the Java Runtime System, [Tuning the Java Heap

http://docs.sun.com/source/817-2180-10/pt_chap5.html#wp57027]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="94cedada5508ad3a-084cbc6c-4fc54a10-b6b3abd5-ee2c433f785b083df6f25599"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

Class ObjectInputStream and ObjectOutputStream

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4984179fb0322412-77aef6d5-4e664e48-ad93aacd-765e4a4b3259874c81817990"><ac:plain-text-body><![CDATA[

[[SDN 2008

AA. Bibliography#SDN 08]]

[Serialization FAQ

http://java.sun.com/javase/technologies/core/basic/serializationFAQ.jsp]

]]></ac:plain-text-body></ac:structured-macro>

...