Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Wiki Markup
The code places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap space in two ways. First, an attacker can supply arbitrarily many lines in the file, causing the vector to grow until memory is exhausted. Second, an attacker can simply supply an arbitrarily long line, causing the {{readLine()}} method to exhaust memory. According to the Java API documentation \[[API 2006|AA. Bibliography#APIReferences#API 06]\], the {{BufferedReader.readLine()}} method

...

Wiki Markup
In a server-class machine using a parallel garbage collector, the default initial and maximum heap sizes are as follows for Java SE 6 \[[Sun 2006|AA. Bibliography#SunReferences#Sun 06]\]:

  • initial heap size: larger of 1/64 of the machine's physical memory or some reasonable minimum.
  • maximum heap size: smaller of 1/4 of the physical memory or 1GB.

...

Wiki Markup
The {{OutOfMemoryError}} can be avoided by ensuring the absence of infinite loops, memory leaks, and unnecessary object retention. When memory requirements are known ahead of time, the heap size can be tailored to fit the requirements using the following runtime parameters \[[Java 2006|AA. Bibliography#JavaReferences#Java 06]\]:

java -Xms<initial heap size> -Xmx<maximum heap size>

...

CERT C Secure Coding Standard

MEM11-C. Do not assume infinite heap space

CERT C++ Secure Coding Standard

MEM12-CPP. Do not assume infinite heap space

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b249c87a98384d34-7b6f6bf3-436b471a-943ebe3d-5c0ddf07dd1dfb89594cb689"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

Resource Exhaustion [XZP]

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-400. Uncontrolled resource consumption ("resource exhaustion")

 

CWE-770. Allocation of resources without limits or throttling

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="550875d965907c8b-fc355c1a-487649a6-8446a016-d57f9d465104c0d9b2fc97a6"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API References#API 06]]

Class ObjectInputStream and ObjectOutputStream

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b240bf9a4e56c26a-4572df15-4780461c-a826a909-25d93108c79fa51d31626038"><ac:plain-text-body><![CDATA[

[[Java 2006

AA. Bibliography#Java References#Java 06]]

[java – The Java application launcher

http://java.sun.com/javase/6/docs/technotes/tools/windows/java.html], Syntax for increasing the heap size

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="12f3a4d5ad5c377d-1ac7fbd6-43454f93-b2aca470-394a11f4df6959e515f3f353"><ac:plain-text-body><![CDATA[

[[SDN 2008

AA. Bibliography#SDN References#SDN 08]]

[Serialization FAQ

http://java.sun.com/javase/technologies/core/basic/serializationFAQ.jsp]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ab2e82c8083d4ff8-3664312a-4d3b46d8-a1209b73-0c176abbf639335993346969"><ac:plain-text-body><![CDATA[

[[Sun 2003

AA. Bibliography#Sun References#Sun 03]]

Chapter 5, Tuning the Java Runtime System, [Tuning the Java Heap

http://docs.sun.com/source/817-2180-10/pt_chap5.html#wp57027]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5690bb1cb9afcaea-3698a324-446c40d0-a428b1a3-16003077700981478eee6def"><ac:plain-text-body><![CDATA[

[[Sun 2006

AA. Bibliography#Sun References#Sun 06]]

[Garbage Collection Ergonomics

http://java.sun.com/javase/6/docs/technotes/guides/vm/gc-ergonomics.html ], Default values for the Initial and Maximum Heap Size

]]></ac:plain-text-body></ac:structured-macro>

...