Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#FFcccc
class ShowHeapErrorReadNames {
  private Vector<String> names = new Vector<String>();
  private final InputStreamReader input;
  private final BufferedReader reader;

  public ShowHeapErrorReadNames(String filename) throws IOException {
    this.input = new FileReader(filename);
    this.reader = new BufferedReader(input);
  }

  public void addNames() throws IOException {
    try {
      String newName;
      while (((newName = reader.readLine()) != null) &&
             !(newName.equalsIgnoreCase("quit") == false)) {
        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

  public static void main(String[] args) throws IOException {
    if (args.length != 1) {
      System.out.println("Arguments: [filename]");
      return;
    }
    ShowHeapError demo = new ShowHeapError(args[0]);
    demo.addNames();
  }
}

Wiki Markup
The code places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap space in two ways. First, an attacker can supply arbitrarily many lines in the file, causing the vector to grow until memory is exhausted. Second, an attacker can simply supply an arbitrarily long line, causing the {{readLine()}} method to exhaust memory. According to the Java API documentation \[[API 2006|AA. Bibliography#API 06]\] for, the {{BufferedReader.readLine()}} method:

Wiki Markup\[{{readLine()}}\] Reads a line of text. A line is considered to be terminated by any one of a line feed ('{{\n}}'), a carriage return ('{{\r}}'), or a carriage return followed immediately by a linefeed.

Any code that uses this method is susceptible to a resource exhaustion attack because the user can enter a string of any length.

...

Code Block
bgColor#ccccff
class ShowHeapErrorReadNames {
  public static public final int fileSizeLimit = 1000000;

  public ShowHeapErrorReadNames(String filename) throws IOException {
    if (Files.size(Paths.get(filename)) > fileSizeLimit) {
      throw new IOException("File too large");
    }
    this.input = new FileReader(filename);
    this.reader = new BufferedReader(input);
  }

  // ...other methods
}

...

Code Block
bgColor#ccccff
class ShowHeapErrorReadNames {
  // ... other methods

  public static public String readLimitedLine(Reader reader, int limit) 
                                       throws IOException {
    StringBuilder sb = new StringBuilder();
    for (int i = 0; i < limit; i++) {
      int c = reader.read();
      if (c == -1) {
        return null;
      }
      if (((char) c == '\n') || ((char) c == '\r')) {
        break;
      }
      sb.append((char) c);
    }
    return sb.toString();
  }

  public static public final int lineLengthLimit = 1024;
  public static public final int lineCountLimit = 1000000;

  public void addNames() throws IOException {
    try {
      String newName;
      for (int i = 0; i < lineCountLimit; i++) {
        newName = readLimitedLine(reader, lineLengthLimit);
        if (newName == null || newName.equalsIgnoreCase("quit")) {
          break;
        }
        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

}

...

Code Block
bgColor#FFcccc
/** Assuming the heap size as 512 MB 
 *   (calculated as 1/4th of 2 GB RAM = 512 MB)
 *  Considering long values being entered (64 bits each, 
 *  the max number of elements would be 512 MB/64bits = 
 *  67108864)
 */
public class ShowHeapErrorReadNames {
  // Accepts unknown number of records
  Vector<Long> names = new Vector<Long>(); 
  long newID = 0L;
  int count = 67108865;
  int i = 0;
  InputStreamReader input = new InputStreamReader(System.in);
  Scanner reader = new Scanner(input);

  public void addNames() {
    try {
      do {
        // Adding unknown number of records to a list
        // The user can enter more IDs than the heap can support and,
        // as a result, exhaust the heap. Assume that the record ID
        // is a 64 bit long value
        System.out.print("Enter recordID (To quit, enter -1): ");
        newID = reader.nextLong();

        names.addElement(newID);
        i++;
      } while (i < count || newID != -1);
    } finally {
      input.close();
    }
  }

  public static void main(String[] args) {
    ShowHeapError demo = new ShowHeapError();
    demo.addNames();
  }
}

...

Here the initial heap size is set to 128 MB and the maximum heap size to 512MB.

This setting These settings can be changed either using the Java Control Panel or from the command line. It They cannot be adjusted through the application itself.

...

CERT C Secure Coding Standard

MEM11-C. Do not assume infinite heap space

CERT C++ Secure Coding Standard

MEM12-CPP. Do not assume infinite heap space

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f70c319d3e9a8745-e8423347-4e034f54-aac5a800-6484cbe051f6b22007931680"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

Resource Exhaustion [XZP]

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-400. Uncontrolled resource consumption ("resource exhaustion")

 

CWE-770. Allocation of resources without limits or throttling

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="511a1c7bf7608288-acd2b31a-4ffc4e0b-8bd09940-6dac432f84970ef45dbae59a"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

Class ObjectInputStream and ObjectOutputStream

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="723a63834c563d89-fafd5128-4e254ab5-a16ab17b-e26279cc5183322cc132a0e5"><ac:plain-text-body><![CDATA[

[[Java 2006

AA. Bibliography#Java 06]]

[java – The Java application launcher

http://java.sun.com/javase/6/docs/technotes/tools/windows/java.html], Syntax for increasing the heap size

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="dade16b1019deaa3-dede99bf-4eca419d-9cddb21d-a09e1d4f7b8b3d4e6c38f3dc"><ac:plain-text-body><![CDATA[

[[SDN 2008

AA. Bibliography#SDN 08]]

[Serialization FAQ

http://java.sun.com/javase/technologies/core/basic/serializationFAQ.jsp]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="75ebab0f4c9af795-b48d4925-4f0a4360-8d7d8f15-7816dd6f16ed76922ed6f051"><ac:plain-text-body><![CDATA[

[[Sun 2003

AA. Bibliography#Sun 03]]

Chapter 5, Tuning the Java Runtime System, [Tuning the Java Heap

http://docs.sun.com/source/817-2180-10/pt_chap5.html#wp57027]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2a851ffec9351fdc-61688d71-444f495e-9e2e8fc5-03ccbf2f352f529a985803e7"><ac:plain-text-body><![CDATA[

[[Sun 2006

AA. Bibliography#Sun 06]]

[Garbage Collection Ergonomics

http://java.sun.com/javase/6/docs/technotes/guides/vm/gc-ergonomics.html ], Default values for the Initial and Maximum Heap Size

]]></ac:plain-text-body></ac:structured-macro>

...