Page History

...

This noncompliant code example places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap spacereads lines of text from a file, and adds each one to a vector, until a line with the word "quit" is encountered.

public class ShowHeapError {
    private Vector<String> names = new Vector<String>();
    private final InputStreamReader input;
    private final BufferedReader reader;

    public ShowHeapError(String filename) throws IOException {
        this.input = new InputStreamReaderFileReader(System.infilename);
  BufferedReader       this.reader = new BufferedReader(input);
    }

    public void addNames() throws IOException {
        String newName;
    do {   while (((newName 
      // Adding unknown number of records to a list; user can exhaust the heap
      newName = reader.readLine();    
= reader.readLine()) != null) &&
               (newName.equalsIgnoreCase("quit") == false)) {
            names.addElement(newName);
       
    } while(newName.equalsIgnoreCase("quit") == false); // Enter "quit" to quit the program System.out.println("adding " + newName);
        }
    // Close "reader" and "input".close();
    }

    public static void main(String[] args) throws IOException {
        if (args.length != 1) {
            System.out.println("Arguments: [filename]");
            return;
        }
        ShowHeapError demo = new ShowHeapError(args[0]);
        demo.addNames();
    }
}

The code places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap space in two ways. First, an attacker can supply arbitrarily many lines in the file, causing the vector to grow until memory is exhausted.  Second, an attacker can simply supply an arbitrarily long line, causing the {{readLine()}} method to exhaust memory. According to the Java API \[[API 2006|AA. Bibliography#API 06]\], {{BufferedReader.readLine()}} method documentation

...

Any code that uses this method is susceptible to abuse because the user can enter a string of any length. This does not require the noncompliant code example to read input using a loop.

Compliant Solution (

...

If the objects or data structures are large enough to potentially cause heap exhaustion, the programmer must consider using databases instead.

...

limited length input)

This compliant solution imposes limits, both on the length of each line, and on the total number of items to add to the vector.

class ShowHeapError {
    // ... other methods

    static public String readLimitedLine(Reader reader, int limit) throws IOException {
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < limit; i++) {
            int c = reader.read();
            if (c == -1) {
                return null;
            }
            if (((char) c == '\n') || ((char) c == '\r')) {
                break;
            }
            sb.append((char) c);
        }
        return sb.toString();
    }

    static public final int lineLengthLimit = 1024;
    static public final int lineCountLimit = 1000000;

    public void addNames() throws IOException {
        String newName;
        for (int i = 0; i < lineCountLimit; i++) {
            newName = readLimitedLine( reader, lineLengthLimit);
            if (newName == null) {
                break;
            }
            if (newName.equalsIgnoreCase("quit")) {
                break;
            }

            names.addElement(newName);
            System.out.println("adding " + newName);
        }
        input.close();
    }

}

The readLimitedLine() method defined above takes a numeric limit, indicating the total number of characters that may exist on one line. If a line contains more characters, the line is truncated, and they are returned on the next invocation. This prevents an attacker from exhausting memory by supplying input with no line breaks.

Compliant Solution (Java 1.7, limited file size)

This compliant solution impose a limit on the size of the file being read. This is accomplished with the Files.size() method which is new to Java 1.7. If the file is within the limit, we can assume the standard readLine() method will not exhaust memory, nor will memory be exhausted by the while loop.

class ShowHeapError {
    // ...other methods
    static public final int fileSizeLimit = 1000000;

    public ShowHeapError(String filename) throws IOException {
        if (Files.size( Paths.get( filename)) > fileSizeLimit) {
            throw new IOException("File too large");
        }
        this.input = new FileReader(filename);
        this.reader = new BufferedReader(input);
    }

Noncompliant Code Example

...