...
The code places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap space in two ways. First, an attacker can supply arbitrarily many lines in the file, causing the vector to grow until memory is exhausted. Second, an attacker can simply supply an arbitrarily long line, causing the readLine() method to exhaust memory. According to the Java API documentation [API 2006], the BufferedReader.readLine() method
...
In a server-class machine using a parallel garbage collector, the default initial and maximum heap sizes are as follows for Java SE 6 [Sun 2006]:
- initial heap size: larger of 1/64 of the machine's physical memory or some reasonable minimum.
- maximum heap size: smaller of 1/4 of the physical memory or 1GB.
...
The OutOfMemoryError can be avoided by ensuring the absence of infinite loops, memory leaks, and unnecessary object retention. When memory requirements are known ahead of time, the heap size can be tailored to fit the requirements using the following runtime parameters [Java 2006]:
java -Xms<initial heap size> -Xmx<maximum heap size>
...
The Apache Geronimo bug described by GERONIMO-4224 results in an OutOfMemoryError exception thrown by the WebAccessLogViewer when the access log file size is too large.
Related Guidelines
Resource Exhaustion [XZP] | |
CWE-400. Uncontrolled resource consumption ("resource exhaustion") | |
| CWE-770. Allocation of resources without limits or throttling |
Bibliography
[API 2006] | Class |
java – The Java application launcher, Syntax for increasing the heap size | |
[SDN 2008] | |
[Sun 2003] | Chapter 5, Tuning the Java Runtime System, Tuning the Java Heap |
[Sun 2006] | Garbage Collection Ergonomics, Default values for the Initial and Maximum Heap Size |
...