Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

In Java, data is stored in big-endian format (also called network order). That is, all data is represented sequentially starting from the most significant bit to the least significant. JDK versions prior to JDK 1.4 required definition of custom methods that manage reversing byte order to maintain compatibility with little-endian systems. Correct handling of byte order-related issues is critical when exchanging data in a networked environment that includes both big-endian and little-endian machines , or when working with other languages via JNI. Failure to handle byte-ordering issues can cause unexpected program behavior.

...

The read methods (readByte(), readShort(), readInt(), readLong(), readFloat(), and readDouble()) and the corresponding write methods defined by class java.io.DataInputStream operate only on big-endian data. Use of these methods while interoperating with traditional languages, such as C or C++, is insecure because such languages lack any guarantees about endianness. This noncompliant code example shows such a discrepancy.

Code Block
bgColor#FFcccc
try {
  DataInputStream dis = null;
  try {
    dis = new DataInputStream( new FileInputStream("data"));
    // Little-endian data might be read as big-endian
    int serialNumber = dis.readInt();
  } finally {
    if (dis != null) {
      dis.close();
    }
  } catch (IOException x) {
    // handle error
  }
}

Compliant Solution (

...

ByteBuffer)

Wiki Markup
This compliant solution uses methods provided by class {{ByteBuffer}} (see \[[API 2006|AA. Bibliography#API 06]\] [ByteBuffer|http://download.oracle.com/javase/6/docs/api/java/nio/ByteBuffer.html]) to correctly extract an {{int}} from the original input value. It wraps the input byte array with a {{ByteBuffer}}, sets the byte order to little-endian, and extracts the {{int}}. The result is stored in the integer {{serialNumber}}. 

Code Block
bgColor#ccccff
	 
try {
  DataInputStream dis = null;
  try {
    dis = new DataInputStream( new FileInputStream("data"));
    byte[] buffer = new byte[4];
    int bytesRead = dis.read(buffer);  // Bytes are read into buffer
    if (bytesRead != 4) {
      throw new IOException("Unexpected End of Stream");
    }
    int serialNumber = 
        ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN).getInt();
  } finally {
    if (dis != null) {
      dis.close();
    }
  }
} catch (IOException x) {
  // handle error
}

...

An alternative compliant solution is to define read and write methods that support the necessary byte-swapping while reading from or writing to the file. In this example, the readLittleEndianInteger() method reads four bytes into a byte buffer and then pieces together the integer in the correct order. The writeLittleEndianInteger() method obtains bytes by repeatedly casting the integer so that the least significant byte is extracted on successive right shifts. Long values can be handled by defining a byte buffer of size eight8.

Code Block
bgColor#ccccff
	 
// readRead method
public static int readLittleEndianInteger(InputStream ips)
                                          throws IOException {
  byte[] buffer = new byte[4];
  int check = ips.read(buffer);

  if (check != 4) {
    throw new IOException("Unexpected End of Stream");
  }
 
  int result = (buffer[3] << 24) | (buffer[2] << 16) |
               (buffer[1] << 8)  | buffer[0];
  return result;
}

// writeWrite method
public static void writeLittleEndianInteger(int i, OutputStream ops)
  throws IOException {
  byte[] buffer = new byte[4];
  buffer[0] = (byte) i;
  buffer[1] = (byte) (i >> 8);
  buffer[2] = (byte) (i >> 16);
  buffer[3] = (byte) (i >> 24);
  ops.write(buffer);
}

Compliant Solution (

...

reverseBytes())

When programming for JDK 1.5+, use the reverseBytes() method defined in the classes Character, Short, Integer, and Long to reverse the order of the integral value's bytes. Note that classes Float and Double lack such a method.

...

Related Guidelines

MITRE CWE

CWE-198. Use of Incorrect Byte Ordering incorrect byte ordering

Bibliography

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c5cbcdb3171f9383-b14b9a8e-48214791-85d2b579-ad88eb0ca20bf5d0c6e2150e"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

[Class [ ByteBuffer

http://download.oracle.com/javase/6/docs/api/java/nio/ByteBuffer.html]: Methods wrap and order. [Class [ Integer

http://download.oracle.com/javase/6/docs/api/java/lang/Integer.html]: method reverseBytes

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c5a914f4e8a09490-a04a6220-47f74886-9ee0a363-2f3006f7185df56404cf2858"><ac:plain-text-body><![CDATA[

[[Cohen 1981

AA. Bibliography#Cohen 81]]

" On Holy Wars and a Plea for Peace "

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="90842d59cf469d98-9a1e3155-4a434bb4-8baaac92-6e4d1c6fbe876992080930d6"><ac:plain-text-body><![CDATA[

[[Harold 1997

AA. Bibliography#Harold 97]]

Chapter 2: ", Primitive Data Types, Cross-Platform issues" Issues

]]></ac:plain-text-body></ac:structured-macro>

...