...
3. The program requires more memory than is present by default in the heap
Non Compliant Code Example
A heap error will be generated if the heap is continued to be accessed even if there is no memory left in the heap.
Code Block |
---|
 import java.io.*; import java.util.*; public class ShowHeapError { //assume that the vector has a very large number of entries. This could be possible if the query results returned from a database are stored in the vector Vector v = new Vector(50000); public void main(String[] args)Vector<String> names = new Vector<String>(); String newName=null; InputStreamReader input = new InputStreamReader(System.in); BufferedReader reader = new BufferedReader(input); public void addNames(){ do{ //adding unknown number of records to a list System.out.print(" To quit, enter \"quit\"\nEnter record: "); try { ListIterator iter newName = vreader.listIteratorreadLine(); while (iter.hasNext()) if(!newName.equalsIgnoreCase("quit")){ //names are continued to be added without bothering about the size on the heap names.addElement(newName); } } catch (IOException e) { } System.out.println(newName); } while (!newName.equalsIgnoreCase("quit")); } public static void main(String)iter.next()[] args) { ShowHeapError demo = new ShowHeapError(); }demo.addNames(); } } |
Compliant solution
This exception can be avoided by either making sure that there are no infinite loops or memory leaks. If the programmer knows that the application would require a lot of memory then, he can increase the heap size in Java using the following runtime run time parameters:
java -Xms<initial heap size> -Xmx<maximum heap size>
...
This setting can be done either in the Java Control Panel or on the command line. This setting cannot be controlled in the application itself.
Risk Assessment
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
FIO37-J | low medium | probable | medium | P3 | L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website