Page History

final class Adder {
  // ...

  public synchronized void update(BigInteger f, BigInteger s){
    first.set(f);
    second.set(s);
  }

  public synchronized BigInteger add() {
    return first.get().add(second.get()); 
  }
}
{code}


h2. Noncompliant Code Example ({{synchronizedList}})

This noncompliant code example uses a {{java

}}. 

{code:bgColor=#FFCCCC}
final class IPHolder {
  private final List<InetAddress> ips = Collections.synchronizedList(new ArrayList<InetAddress>());
   
  public void addIPAddressaddAndPrintIPAddresses(InetAddress address) {
    ips.add(address);
  }
  
  public void addAndPrintIPAddresses(InetAddress address) {
    addIPAddress(address);
    InetAddress[] addressCopy = (InetAddress[]) ips.toArray(new InetAddress[0]);      
    // Iterate through array addressCopy ...
  }
}

{code}

Even though the {{Collection}} wrapper offers thread-safety guarantees for individual method invocations, a sequence of method calls is not atomic. For example, when multiple threads invoke the {{addAndPrintIPAddresses()}} method to add an IP address and iterate over the array {{addressCopy}}, each thread can observe {{addressCopy}} to contain a different number of IP addresses because of the race condition in the {{addAndPrintIPAddresses()}} method. 

h2. Compliant Solution (Synchronized Block)

The race condition can be eliminated by synchronizing on the underlying list's lock. This compliant solution encapsulates all references to the array list within synchronized blocks. 

{code:bgColor=#ccccff}
final class IPHolder {
  private final List<InetAddress> ips = Collections.synchronizedList(new ArrayList<InetAddress>());

  public void addIPAddress(InetAddress address) { 
    synchronized (ips) { 
      ips.add(address);
    }
  }

  public void addAndPrintIPAddresses(InetAddress address) {
    synchronized (ips) {
      addIPAddress(address);
      InetAddress[] addressCopy = (InetAddress[]) ips.toArray(new InetAddress[0]);           
      // Iterate through array addressCopy ...
    }
  }
}
{code}

final class KeyedCounter {
  private final Map<String, Integer> map =
    Collections.synchronizedMap(new HashMap<String, Integer>());

  public void increment(String key) {
    Integer old = map.get(key);
    int oldValue = (old == null) ? 0 : old.intValue();
    if (oldValue == Integer.MAX_VALUE) {    
      throw new ArithmeticException("Out of range");
    }
    map.put( key, value + 1);
  }

  public Integer getCount(String key) {
    return map.get(key);
  }
}

final class KeyedCounter {
  private final Map<String, Integer> map = new HashMap<String, Integer>(); 
  private final Object lock = new Object();

  public void increment(String key) {
    synchronized (lock) {
      Integer old = map.get(key);
      int oldValue = (old == null) ? 0 : old.intValue();
      if (oldValue == Integer.MAX_VALUE) {    
        throw new ArithmeticException("Out of range");
      }
      map.put(key, value + 1);
    }
  }

  public Integer getCount(String key) {
    synchronized (lock) {
      return map.get(key

{mc}the following paragraph seems out of place here. -rCs{{mc}}

Although expensive in terms of performance, the {{CopyOnWriteArrayList}} and {{CopyOnWriteArraySet}} classes are sometimes used to create copies of the core {{Collection}} so that iterators do not fail with a runtime exception when some data in the {{Collection}} is modified. However, any updates to the {{Collection}} are not immediately visible to other threads. Consequently, the use of these classes is limited to boosting performance in code where the writes are fewer (or non-existent) as compared to the reads  \[[JavaThreads 04|AA. Java References#JavaThreads 04]\]. In most other cases they must be avoided (see [MSC13-J. Do not modify the underlying collection when an iteration is in progress] for details on using these classes).    

This code does not violate [CON40-J. Do not synchronize on a collection view if the backing collection is accessible], because while it does synchronize on a collection view (the {{synchronizedList}}), the backing collection is inaccessible, and therefore cannot be modified by any code.


h2. Noncompliant Code Example ({{synchronizedMap}})

This noncompliant code example defines a class {{KeyedCounter}} which is not thread-safe. Although the {{HashMap}} is wrapped in a {{synchronizedMap}}, the overall increment operation is not atomic \[[Lee 09|AA. Java References#Lee 09]\].   

{code:bgColor=#FFCCCC}
final class KeyedCounter {
  private final Map<String, Integer> map =
    Collections.synchronizedMap(new HashMap<String, Integer>());

  public void increment(String key) {
    Integer old = map.get(key);
    int oldValue = (old == null) ? 0 : old.intValue();
    if (oldValue == Integer.MAX_VALUE) {    
      throw new ArithmeticException("Out of range");
    }
    map.put( key, value + 1);
  }

  public Integer getCount(String key) {
    return map.get(key);
  }
}
{code}


h2. Compliant Solution (synchronization)

To ensure atomicity, this compliant solution uses an internal private lock object to synchronize the statements of the {{increment()}} and {{getCount()}} methods. 

{code:bgColor=#ccccff}
final class KeyedCounter {
  private final Map<String, Integer> map = new HashMap<String, Integer>(); 
  private final Object lock = new Object();

  public void increment(String key) {
    synchronized (lock) {
      Integer old = map.get(key);
      int oldValue = (old == null) ? 0 : old.intValue();
  }
}

final class KeyedCounter {
  private final ConcurrentMap<String, AtomicInteger> map =
    new ConcurrentHashMap<String, AtomicInteger>();

  public void increment(String key) {
    AtomicInteger value = new AtomicInteger();
    AtomicInteger old = map.putIfAbsent(key, value);
   
    if (oldValueold =!= Integer.MAX_VALUEnull) {    
      value  throw new ArithmeticException("Out of range");
 = old; 
     }

    if  map(value.put(key, value + 1get() == Integer.MAX_VALUE) {
      throw new ArithmeticException("Out of range");
    } 

    value.incrementAndGet(); // Increment the value atomically
  }

  public Integer getCount(String key) {
    synchronizedAtomicInteger (lock) {
      returnvalue = map.get(key);
    }
return  }
}
{code}

This compliant solution does not use {{Collections.synchronizedMap()}} because locking on the unsynchronized map provides sufficient thread-safety for this application. The guideline [CON40-J. Do not synchronize on a collection view if the backing collection is accessible] provides more information about synchronizing on {{synchronizedMap}} objects.

To prevent overflow, the caller must ensure that the {{increment()}} method is called no more than {{Integer.MAX_VALUE}} times for any key. Refer to [INT00-J. Perform explicit range checking to ensure integer operations do not overflow] for more information. 

h2. Compliant Solution ({{ConcurrentHashMap}})

The previous compliant solution is safe for multithreaded use, however, it does not scale well because of excessive synchronization which can lead to contention and deadlock.

The {{ConcurrentHashMap}} class used in this compliant solution provides several utility methods for performing atomic operations and is often a good choice for algorithms that must scale \[[Lee 09|AA. Java References#Lee 09]\]. 

{code:bgColor=#ccccff}
final class KeyedCounter {
  private final ConcurrentMap<String, AtomicInteger> map =
    new ConcurrentHashMap<String, AtomicInteger>();

  public void increment(String key) {
    AtomicInteger value = new AtomicInteger();
    AtomicInteger old = map.putIfAbsent(key, value);
   
    if (old != null) { 
      value = old; 
    }

    if (value.get() == Integer.MAX_VALUE) {
      throw new ArithmeticException("Out of range");
    } 

    value.incrementAndGet(); // Increment the value atomically
  }

  public Integer getCount(String key) {
    AtomicInteger value = map.get(key);
    return (value == null) ? null : value.get();
  }

  // Other accessors ...
}
{code}

According to Goetz et al. \[[Goetz 06|AA. Java References#Goetz 06]\] section 5.2.1. ConcurrentHashMap:

{quote}
{{ConcurrentHashMap}}, along with the other concurrent collections, further improve on the synchronized collection classes by providing iterators that do not throw {{ConcurrentModificationException}}, as a result eliminating the need to lock the collection during iteration. The iterators returned by {{ConcurrentHashMap}} are weakly consistent instead of fail-fast. A weakly consistent iterator can tolerate concurrent modification, traverses elements as they existed when the iterator was constructed, and may (but is not guaranteed to) reflect modifications to the collection after the construction of the iterator.
{quote}

Note that methods such as {{size()}} and {{isEmpty()}} are allowed to return an approximate result for performance reasons. Code should not rely on these return values for deriving exact results. 

h2. Risk Assessment

Failing to ensure that atomicity of two or more operations that need to be performed as a single atomic operation can result in race conditions in multithreaded applications.

|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| CON07- J | low | probable | medium | {color:green}{*}P4{*}{color} | {color:green}{*}L3{*}{color} |



h3. Automated Detection

TODO


h3. Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+CON38-J].

h2. References

\[[API 06|AA. Java References#API 06]\] 
\[[JavaThreads 04|AA. Java References#JavaThreads 04]\] Section 8.2, "Synchronization and Collection Classes"
\[[Goetz 06|AA. Java References#Goetz 06]\] Section 4.4.1, "Client-side Locking", Section 5.2.1, "ConcurrentHashMap"
\[[Lee 09|AA. Java References#Lee 09]\] "Map & Compound Operation"

----
[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!|VOID CON06-J. Do not defer a thread that is holding a lock]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!|11. Concurrency (CON)]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!|CON08-J. Do not call alien methods that synchronize on the same objects as any callers in the execution chain]

(value == null) ? null : value.get();
  }

  // Other accessors ...
}