The Object.wait() method temporarily cedes possession of a lock so that another thread that is other threads that may be requesting the lock can proceed. Object.wait() must always be called from a synchronized block or method. To resume the The waiting thread resumes execution only after it has been notified, the requesting thread must notify() it. Furthermore, the generally as the result of the invocation of the notify() or notifyAll() method by some other thread. The wait() method should must be invoked in from a loop that checks if whether a condition predicate holds. Note that a condition predicate is the negation of the condition expression in the loop. For example, the condition predicate for removing an element from a vector is !isEmpty(), whereas the condition expression for the while loop condition is isEmpty(). The Following is the correct way to invoke the wait() method when the vector is empty is shown below.
| Code Block |
|---|
private Vector vector; // ... public void consumeElement() throws InterruptedException { synchronized (vector) { while (vector.isEmpty()) { vector.wait(); } // ConsumeResume when condition holds } } |
The notification mechanism notifies the waiting thread and lets allows it to check its condition predicate. The invocation of notify() or notifyAll() in another thread cannot precisely determine which waiting thread is will be resumed. A condition predicate statement is provided so that only the correct thread will Condition predicate statements allow notified threads to determine whether they should resume upon receiving the notification. A condition predicate also helps Condition predicates are also useful when a thread is required to block until a condition becomes true such as reading data from , for example, when waiting for data to arrive on an input stream before proceedingreading the data.
Wiki Markup
To guarantee liveness, programs must test the while loop condition must be tested before invoking the wait() method. This is in case early test checks whether another thread has already satisfied the condition predicate and sent a notification. Invoking the wait() method after the notification has been sent results in indefinite blocking.unmigrated-wiki-markup
To guarantee _ safety_, the {{while}} loop condition must be tested even after invoking {{wait()}}. While {{wait()}} is meant to block indefinitely until a notification is received, it must still be encased within a loop to prevent the following vulnerabilities \[[Bloch 01|AA. Java References#Bloch 01]\programs must test the while loop condition after returning from the wait() method. Although wait() is intended to block indefinitely until a notification is received, it still must be encased within a loop to prevent the following vulnerabilities [Bloch 2001]:
- Thread in the middle: A third thread can acquire the lock on the shared object during the interval between a notification being sent and the receiving thread resuming execution. This third thread can change the state of the object, leaving it inconsistent. This is a time-of-check, time-of-use (TOCTOU) race condition.
- Malicious notification: There is no guarantee that a random notification will not A random or malicious notification can be received when the condition predicate is false. This means that the invocation of Such a notification would cancel the
wait()may be nullified by the notification method. - Misdelivered notification: Sometimes on The order in which threads execute after receipt of a
notifyAll()signal is unspecified. Consequently, an unrelated thread can could start executing and it is possible for discover that its condition predicate to be trueis satisfied. Consequently, it may could resume execution although it was despite being required to remain dormant. Wiki Markup
For these reasons, it is necessary to programs must check the condition predicate after the wait() is invoked method returns. A while loop is the best choice for checking the condition predicate both before and after invoking wait().unmigrated-wiki-markup
Similarly, the {{await()}} method of interface {{Condition}} must also be invoked inside a loop. According to the Java API \[[API 06|AA. Java References#API 06]\], Interface {{Condition}}:the Condition interface also must be invoked inside a loop. According to the Java API [API 2014], Interface Condition
When waiting upon a Condition, a "spurious wakeup" is permitted to occur, in general, as a concession to the underlying platform semantics. This has little practical impact on most application programs as a Condition should always be waited upon in a loop, testing the state predicate that is being waited for. An implementation is free to remove the possibility of spurious wakeups but it is recommended that applications programmers always assume that they can occur and so always wait in a loop.
New code should use the java.util.concurrent.locks concurrency utilities instead in place of the wait/notify mechanism. However, legacy code may depend upon that complies with the other requirements of this rule is permitted to depend on the wait/notify mechanism.
...
This noncompliant code example invokes the wait() method inside a traditional if block and fails to check the post-condition postcondition after the notification is received. If the notification is were accidental or malicious, the thread can could wake up prematurely.
| Code Block | ||
|---|---|---|
| ||
synchronized (object) {
if (<condition does not hold>) {
object.wait();
}
// Proceed when condition holds
}
|
...
This compliant solution calls the wait() method from within a while loop to check the condition both before and after the call to wait() is called.:
| Code Block | ||
|---|---|---|
| ||
synchronized (object) {
while (<condition does not hold>) {
object.wait();
}
// Proceed when condition holds
}
|
Similarly, invocations of the await() method Invocations of the java.util.concurrent.locks.Condition interface .await() method also must be enclosed in a similar loop.
Risk Assessment
To guarantee liveness and safety, Failure to encase the wait() and or await() methods must always be invoked inside a while loop can lead to indefinite blocking and denial of service (DoS).
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|
THI03-J |
Low |
Unlikely |
Medium | P2 | L3 |
Automated Detection
...
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.THI03.UWIL | Call 'wait()' and 'await()' only inside a loop that tests the liveness condition | ||||||
| SonarQube |
| S2274 | "Object.wait(...)" and "Condition.await(...)" should be called inside a "while" loop |
Bibliography
[API 2014] | |
Item 50, "Never Invoke | |
Section 14.2, "Using Condition Queues" | |
[Lea 2000] | Section 1.3.2, "Liveness" |
...
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] [Class Object|http://java.sun.com/javase/6/docs/api/java/lang/Object.html]
\[[Bloch 01|AA. Java References#Bloch 01]\] Item 50: Never invoke wait outside a loop
\[[Lea 00|AA. Java References#Lea 00]\] 3.2.2 Monitor Mechanics, 1.3.2 Liveness
\[[Goetz 06|AA. Java References#Goetz 06]\] Section 14.2, Using Condition Queues |
THI02-J. Do not invoke Thread.run() 11. Locking (LCK) THI04-J. Notify all waiting threads instead of a single thread