...
This rule is a specific instance of the more general rule MSC11-J. Do not assume infinite heap space.
Noncompliant Code Example
This noncompliant code example reads and serializes data from an external sensor. Each invocation of the readSensorData() method returns a newly created SensorData instance, containing a megabyte of data. SensorData instances contain data and arrays, but lack any references to other SensorData objects; this is a pure data stream.
...
| Code Block | ||
|---|---|---|
| ||
class SensorData implements Serializable {
// 1MB of data per instance!
...
public static SensorData readSensorData() {...}
public static boolean continueReading() {...}
}
class SerializeSensorData {
public static void main(String[] args) throws IOException {
ObjectOutputStream out = new ObjectOutputStream(
new BufferedOutputStream(new FileOutputStream("ser.dat")));
while (SensorData.continueReading()) {
// note that each SensorData object is 1MB in size
SensorData sd = SensorData.readSensorData();
out.writeObject(sd);
}
out.close();
}
}
|
Compliant Solution
This compliant solution takes advantage of the known properties of the sensor data by resetting the output stream after each write. The reset clears the output stream's internal object cache; consequently, the cache no longer maintains references to previously-written SensorData objects. The garbage collector is able to collect SensorData instances that are no longer needed.
| Code Block | ||
|---|---|---|
| ||
class SerializeSensorData {
public static void main(String[] args) throws IOException {
ObjectOutputStream out = new ObjectOutputStream(
new BufferedOutputStream(new FileOutputStream("ser.dat")));
while (SensorData.continueReading()) {
// note that each SensorData object is 1MB in size
SensorData sd = SensorData.readSensorData();
out.writeObject(sd);
out.reset(); // reset the stream
}
out.close();
}
}
|
Risk Assessment
Memory and resource leaks during serialization can consume all available memory or crash the JVM.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SER12-J | low | unlikely | low | P3 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0cda94ddea978ac3-9b877ca8-4ed94722-aa1ebf0b-2b081e025e27f25d32feb856"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4a5f866ec35cf356-26e39785-45f540ee-8b3f8508-950f492c7e202809dc2143d2"><ac:plain-text-body><![CDATA[ | [[Harold 2006 | AA. Bibliography#Harold 06]] | 13.4. Performance | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="87bd04183d32f260-d43723b8-42094815-9112bf95-18071687307d76b21a02fa2c"><ac:plain-text-body><![CDATA[ | [[Sun 2006 | AA. Bibliography#Sun 06]] | "Serialization specification" | ]]></ac:plain-text-body></ac:structured-macro> |
...