Page History

The Object.wait() method temporarily cedes possession of a lock so that another thread that is other threads that may be requesting the lock can proceed. Object.wait() must always be called from a synchronized block or method. To resume the The waiting thread resumes execution only after it has been notified, the requesting thread must invoke the generally due to invocation of the notify() method to notify it. Furthermore, the or notifyAll() method by some other thread. The wait() method should be must invoked in from a loop that checks if whether a condition predicate holds. Note that a condition predicate is the negation of the condition expression in the loop. For example, the condition predicate for removing an element from a vector is !isEmpty(), whereas the condition expression for the while loop condition is isEmpty(). The correct way to invoke the wait() method when the vector is empty is shown below.

...

The notification mechanism notifies the waiting thread and lets allows it to check its condition predicate. The invocation of notify() or notifyAll() in another thread cannot precisely determine which waiting thread is will be resumed. A condition predicate statement is provided so that only the correct thread will Condition predicate statements allow notified threads to determine whether they should resume upon receiving the notification. A condition Condition predicate are also helps useful when a thread is required to block until a condition becomes true, such as reading data from for example waiting for data to arrive on an input stream before proceedingreading the data.

SafetyBoth safety and liveness are both concerns when using the wait/notify mechanism. SafetyThe safety property requires that all objects maintain consistent states in a multithreaded environment \[[Lea 2000|AA. Bibliography#Lea 00]\]. The liveness Livenessproperty requires that every operation or method invocation execute to completion without interruption.

To guarantee liveness, programs must test the while loop condition must be tested before invoking the wait() method is invoked. This is done in case early test checks whether another thread has already satisfied the condition predicate and sent a notification. Invoking the wait() method after the notification has been sent results in indefinite blocking.

To guarantee safety, programs must test the {{while}} loop condition mustafter bereturning testedfrom even after the {{wait()}} method is invoked. WhileAlthough {{wait()}} is meantintended to block indefinitely until a notification is received, it must still be encased within a loop to prevent the following vulnerabilities \[[Bloch 2001|AA. Bibliography#Bloch 01]\]:

• thread in the middle—A third thread can acquire the lock on the shared object during the interval between a notification being sent and the receiving thread resuming execution. This third thread can change the state of the object, leaving it inconsistent. This is a time-of-check-to-time-of-use (TOCTOU) condition.
• malicious notification—There is no guarantee that a random notification will not notification—A random or malicious notification can be received when the condition predicate is false. This means that the invocation of Such a notification would cancel the wait() could be nullified by the notification.
• misdelivered notification—Sometimes on notification—The order in which threads execute after receipt of a notifyAll() signal is unspecified. Consequently, an unrelated thread can could start executing , and it is possible for and discover that its condition predicate to be trueis satisfied. Consequently, it could resume execution, although it was required to remain dormant.

• Wiki Markup
  spurious wake-ups—Certain JVM implementations are vulnerable to spurious wake-ups that result in waiting threads waking up even without a notification \[[API 2006|AA. Bibliography#API 06]\].

For these reasons, programs must check the condition predicate must be checked after the wait() method is invokedreturns. A while loop is the best choice for checking the condition predicate both before and after invoking wait().

...

New code should use the java.util.concurrent concurrency utilities instead in place of the wait/notify mechanism. However, legacy code may that complies with the other requirements of this rule is permitted to depend upon the wait/notify mechanism.

...

This noncompliant code example invokes the wait() method inside a traditional if block and fails to check the post-condition after the notification is received. If When the notification is was accidental or malicious, the thread can could wake up prematurely.

synchronized (object) {
  if (<condition does not hold>) {
    object.wait();
  }
  // Proceed when condition holds
}

...

This compliant solution calls the wait() method from within a while loop to check the condition both before and after the call to wait() is called.

synchronized (object) {
  while (<condition does not hold>) {
    object.wait();
  }
  // Proceed when condition holds
}

Similarly, invocations Invocations of the await() method of the java.util.concurrent.locks.Condition interface must also be enclosed in a similar loop.

Risk Assessment

To guarantee liveness and safety, the wait() and await() methods must always be invoked inside a while loop.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

...