...
Because of these problems, finalizers must not be used in new classes.
Noncompliant Code Example (Superclass finalizer())
Superclasses that use finalizers impose additional constraints on their extending classes. Consider an example from JDK 1.5 and earlier. The following noncompliant code example allocates a 16 MB buffer used to back a Swing Jframe object. Although none of the JFrame APIs have a finalize() method, JFrame extends AWT.Frame which does have a finalize() method. When a MyFrame object becomes unreachable, the garbage collector cannot reclaim the storage for the byte buffer because code in the inherited finalize() method might refer to it. Consequently, the byte buffer must persist at least until the inherited finalize() method for class MyFrame completes its execution, and cannot be reclaimed until the following garbage collection cycle.
| Code Block | ||
|---|---|---|
| ||
class MyFrame extends Jframe {
private byte[] buffer = new byte[16 * 1024 * 1024]; // persists for at least two GC cycles
}
|
Compliant Solution (Superclass finalizer())
When a superclass defines a finalize() method, make sure to decouple the objects that can be immediately garbage collected from those that must depend on the finalizer. This compliant solution ensures that the buffer can be reclaimed as soon as the object becomes unreachable.
| Code Block | ||
|---|---|---|
| ||
Class MyFrame {
private JFrame frame;
private byte[] buffer = new byte[16 * 1024 * 1024]; // now decoupled
}
|
Noncompliant Code Example (System.runFinalizersOnExit())
This noncompliant code example uses the System.runFinalizersOnExit() method to simulate a garbage collection run. Note that this method is deprecated because of thread-safety issues; see rule MET02-J. Do not use deprecated or obsolete classes or methods.
...
| Code Block |
|---|
Subclass finalize! Superclass finalize! This is sub-class! The date object is: null |
Compliant Solution
| Wiki Markup |
|---|
Joshua Bloch \[[Bloch 2008|AA. Bibliography#Bloch 08]\] suggests implementing a {{stop()}} method explicitly such that it leaves the class in an unusable state beyond its lifetime. A {{private}} field within the class can signal whether the class is unusable. All the class methods must check this field prior to operating on the class. This is akin to [the first exception|OBJ11-J. Prevent access to partially initialized objects#OBJ04-EX1] discussed in rule [OBJ11-J. Prevent access to partially initialized objects]. As always, a good place to call the termination logic is in the {{finally}} block. |
Exceptions
MET18-EX0: Finalizers may be used when working with native code because the garbage collector cannot reclaim memory used by code written in another language and because the lifetime of the object is often unknown. Again, the native process must not perform any critical jobs that require immediate resource deallocation.
...
The ordering problem can be dangerous when dealing with native code. For example, if object A references object B (either directly or reflectively) and the latter gets finalized first, A's finalizer may end up dereferencing dangling native pointers. To impose an explicit ordering on finalizers, make sure that B remains reachable until A's finalizer has concluded. This can be achieved by adding a reference to B in some global state variable and removing it when A's finalizer executes. An alternative is to use the java.lang.ref references.
Risk Assessment
Improper use of finalizers can result in resurrection of garbage-collection ready objects and result in denial of service vulnerabilities.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MET18-J | medium | probable | medium | P8 | L2 |
Related Vulnerabilities
Related Guidelines
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3e1c1477433b7e46-817e4f4f-43394da5-a6cbb7b7-9d999262db7b1db705145e83"><ac:plain-text-body><![CDATA[ | [[MITRE 2009 | AA. Bibliography#MITRE 09]] | [CWE ID 586 | http://cwe.mitre.org/data/definitions/586.html] "Explicit Call to Finalize()", [CWE ID 583 | http://cwe.mitre.org/data/definitions/583.html] "finalize() Method Declared Public" | ]]></ac:plain-text-body></ac:structured-macro> |
| CWE ID 568 "finalize() Method Without super.finalize()" |
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6a5f8de0b02ec6df-a32dd9eb-4f854f3e-adf1ac6b-2778e1a7c4ae04e35ccb948b"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | [finalize() | http://java.sun.com/j2se/1.4.2/docs/api/java/lang/Object.html#finalize()] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a5b3eb3ea9c02eca-b1ae5c72-4e4f4a42-b4949b24-1fc15db4e10f6fafaac26eaf"><ac:plain-text-body><![CDATA[ | [[Bloch 2008 | AA. Bibliography#Bloch 08]] | Item 7, Avoid finalizers | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="79d1712955a17114-409070fb-40784ecb-86c99573-9eac1ab501cf093db47a1ffa"><ac:plain-text-body><![CDATA[ | [[Boehm 2005 | AA. Bibliography#Boehm 05]] |
| ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4bb41b87063eb388-1c587553-451e4336-862191de-a51b17d8d53a867893dbf072"><ac:plain-text-body><![CDATA[ | [[Coomes 2007 | AA. Bibliography#Coomes 07]] | "Sneaky" Memory Retention | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="25c61db54503b304-728185b4-40b1449c-a9cd906c-e463d8e6d0dc14cd68e596f9"><ac:plain-text-body><![CDATA[ | [[Darwin 2004 | AA. Bibliography#Darwin 04]] | Section 9.5, The Finalize Method | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6bc12ac066bf313d-36b5ad66-45b6482e-bd7cae6c-0fcd7c33426b56fb2c571305"><ac:plain-text-body><![CDATA[ | [[Flanagan 2005 | AA. Bibliography#Flanagan 05]] | Section 3.3, Destroying and Finalizing Objects | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6411e78fa27c8689-f7e0903b-403d40c4-a15fb429-abb1c94ab11908b05b5a3015"><ac:plain-text-body><![CDATA[ | [[JLS 2005 | AA. Bibliography#JLS 05]] | Section 12.6, Finalization of Class Instances | ]]></ac:plain-text-body></ac:structured-macro> |
...