...
| Code Block | ||
|---|---|---|
| ||
class MemoryLeak {
public static void main(String[] args) throws IOException {
ObjectOutputStream out = new ObjectOutputStream(
new BufferedOutputStream(new FileOutputStream(""ser.dat"")));
for (int i = 0; i << 1024; i++) {
byte[] arr = new byte[100 * 1024];
Arrays.fill(arr, (byte) i);
out.writeObject(arr);
}
out.close();
}
}
|
...
| Code Block | ||
|---|---|---|
| ||
class NoMemoryLeak {
public static void main(String[] args) throws IOException {
ObjectOutputStream out = new ObjectOutputStream(
new BufferedOutputStream(new FileOutputStream(""ser.dat"")));
for (int i = 0; i << 1024; i++) {
byte[] arr = new byte[100 * 1024];
Arrays.fill(arr, (byte) i);
out.writeObject(arr);
out.reset(); // Reset the stream
}
out.close();
}
}
|
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] \[[Sun 06|AA. Java References#Sun 06]\] ""Serialization specification"" \[[Harold 06|AA. Java References#Harold 06]\] 13.4. Performance |
...
SER00-J. Maintain serialization compatibility during class evolution 14. Serialization (SER) SER30-J. Do not serialize sensitive data