Page History

A Java OutofMemoryError occurs if when the program attempts to use more heap space than what is available. Among other causes, this error may result from the following:

• a A memory leak . See MSC06(see MSC04-J. Avoid memory leaks for information on preventing memory leaks.Do not leak memory)
• An an infinite loop
• limited Limited amounts of default heap memory available
• incorrect Incorrect implementation of common data structures (hash tables, vectors, and so on)
• unbound Unbounded deserialization.
• writing Writing a large number of objects to an ObjectOutputStream. For more information, see SER12 (see SER10-J. Avoid memory and resource leaks during serialization.)
• creating Creating a large number of threads.
• uncompressing Uncompressing a file . See IDS22(see IDS04-J. Limit the size of files passed to ZipInputStream for example.Safely extract files from ZipInputStream)

Some of these causes are platform-dependent , and difficult to anticipate. Others are fairly easy to anticipate, such as reading data from a file, are fairly easy to anticipate. As a result, programs shall must not accept untrusted input in a manner that can cause the program to exhaust memory.

Noncompliant Code Example (readLine())

This noncompliant code example reads lines of text from a file , and adds each one to a vector , until a line with the word "quit" is encountered.:

class ShowHeapErrorReadNames {
  private Vector<String> names = new Vector<String>();
  private final InputStreamReader input;
  private final BufferedReader reader;

  public ShowHeapErrorReadNames(String filename) throws IOException {
    this.input = new FileReader(filename);
    this.reader = new BufferedReader(input);
  }

  public void addNames() throws IOException {
    try {
      String newName;
      while (((newName = reader.readLine()) != null) &&
             !(newName.equalsIgnoreCase("quit") == false))) {
        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

  public static void main(String[] args) throws IOException {
    if (args.length != 1) {
      System.out.println("Arguments: [filename]");
      return;
    }
    ShowHeapErrorReadNames demo = new ShowHeapErrorReadNames(args[0]);
    demo.addNames();
  }
}

...

The code places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap space in two ways. First, an attacker can supply arbitrarily many lines in the file, causing the vector to grow until memory is exhausted. Second, an attacker can simply supply an arbitrarily long line, causing the {{readLine()}} method to exhaust memory. According to the Java API \documentation [[API 2006|AA. Bibliography#API 06]\], {{API 2014], the BufferedReader.readLine()}} method documentation

...

\[{{readLine()}}\] Reads a line of text. A line is considered to be terminated by any one of a line feed ('{{\n}}'), a carriage return ('{{\r}}'), or a carriage return followed immediately by a linefeed.

Any code that uses this method is susceptible to abuse a resource exhaustion attack because the user can enter a string of any length.

Compliant Solution (

...

Limited File Size)

This compliant solution imposes limits, both a limit on the length size of each line, and on the total number of items to add to the vector.the file being read. The limit is set with the Files.size() method, which was introduced in Java SE 7. If the file is within the limit, we can assume the standard readLine() method will not exhaust memory, nor will memory be exhausted by the while loop.

class ReadNames {
  // ... Other methods and variables

  public static final int fileSizeLimit = 1000000;

  public ReadNames(String filename

class ShowHeapError {
  // ... other methods

  static public String readLimitedLine(Reader reader, int limit) throws IOException {
    StringBuilderlong sbsize = new StringBuilder()Files.size( Paths.get( filename));
    forif (intsize i> = 0; i < limit; i++) {
      int c = reader.read(fileSizeLimit) {
      throw new IOException("File too large");
    } else if (csize == -10L) {
      throw new return null;
      }IOException("File size cannot be determined, possibly too large");
    }
  if (((char) c this.input == new FileReader(filename);
    this.reader = new BufferedReader(input);
  }
}

Compliant Solution (Limited Length Input)

This compliant solution imposes limits both on the length of each line and on the total number of items to add to the vector. (It does not depend on any Java SE 7 or later features.)

class ReadNames {
  // ... Other methods and variables

  public static String readLimitedLine(Reader reader, int limit) 
                                       throws IOException'\n') || ((char) c == '\r')) {
        break;
      }
      sb.append((char) c);
    }
    return sb.toString();
  }

  static public final int lineLengthLimit = 1024;
  static public final int lineCountLimit = 1000000;

  public void addNames() throws IOException {
    String newName;
    for (int i = 0; i < lineCountLimit; i++) {
      newName = readLimitedLine( reader, lineLengthLimit);
      if (newName == null) {
    StringBuilder sb = new breakStringBuilder();
    for (int }
i = 0; i <  if (newName.equalsIgnoreCase("quit")) {
limit; i++) {
      int c = breakreader.read();
      if }

   (c == -1) {
   names.addElement(newName);
     return System.out.println("adding " + newName((sb.length() > 0) ? sb.toString() : null);
      }
      if input.close();
  }

}

The readLimitedLine() method defined above takes a numeric limit, indicating the total number of characters that may exist on one line. If a line contains more characters, the line is truncated, and they are returned on the next invocation. This prevents an attacker from exhausting memory by supplying input with no line breaks.

Compliant Solution (Java 1.7, limited file size)

This compliant solution impose a limit on the size of the file being read. This is accomplished with the Files.size() method which is new to Java 1.7. If the file is within the limit, we can assume the standard readLine() method will not exhaust memory, nor will memory be exhausted by the while loop.

class ShowHeapError {
  // ...other methods
  static public final int fileSizeLimit(((char) c == '\n') || ((char) c == '\r')) {
        break;
      }
      sb.append((char) c);
    }
    return sb.toString();
  }

  public static final int lineLengthLimit = 1024;
  public static final int lineCountLimit = 1000000;

  public void ShowHeapErroraddNames(String filename) throws IOException {
    try {
 if (Files.size( Paths.get( filename)) > fileSizeLimit)String {newName;
      throw newfor IOException("Fileint too large");i = 0; i < lineCountLimit; i++) {
    }
    this.inputnewName = new FileReader(filenamereadLimitedLine(reader, lineLengthLimit);
      this.reader = newif BufferedReader(input);
  }
}

Noncompliant Code Example

In a server-class machine using a parallel garbage collector, the default initial and maximum heap sizes are as follows for J2SE 6.0 \[[Sun 2006|AA. Bibliography#Sun 06]\]:

• initial heap size: larger of 1/64th of the machine's physical memory on the machine or some reasonable minimum
• maximum heap size: smaller of 1/4th of the physical memory or 1GB

This noncompliant code example requires more memory on the heap than is available by default.

(newName == null || newName.equalsIgnoreCase("quit")) {
          break;
        }
        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

}

The readLimitedLine() method takes a numeric limit, indicating the total number of characters that may exist on one line. If a line contains more characters, the line is truncated, and the characters are returned on the next invocation. This prevents an attacker from exhausting memory by supplying input with no line breaks.

Noncompliant Code Example

In a server-class machine using a parallel garbage collector, the default initial and maximum heap sizes are as follows for Java SE 6 [Sun 2006]:

• Initial heap size: larger of 1/64 of the machine's physical memory or some reasonable minimum.
• Maximum heap size: smaller of 1/4 of the physical memory or 1GB.

This noncompliant code example requires more memory on the heap than is available by default:

/* Assuming the heap size as 512 MB 
 * (calculated as 1/4 of 2GB RAM = 512MB)
 * Considering long values being entered (64 bits each, 
 * the max number of elements would be 512MB/64 bits = 
 * 67108864)
 */
public class ReadNames {
  // Accepts

/** Assuming the heap size as 512 MB (calculated as 1/4th of 2 GB RAM = 512 MB)
 *  Considering long values being entered (64 bits each, the max number of elements
 *  would be 512 MB/64bits = 67108864)
 */
public class ShowHeapError {
  Vector<Long> names = new Vector<Long>(); // Accepts unknown number of records
  long newID = 0L;
  int count = 67108865;
  int i = 0;
  InputStreamReader input = new InputStreamReader(System.in);
  Scanner reader = new Scanner(input);

  public void addNames() {
    do {
      // Adding unknown number of records
 to aVector<Long> list
names = new Vector<Long>(); 
  //long ThenewID user= can0L;
 enter moreint IDscount than the heap can support and thus = 67108865;
  int i = 0;
  InputStreamReader input =  // exhaust the heap. Assume that the record ID is a 64 bit long value
    new InputStreamReader(System.in);
  Scanner reader = new Scanner(input);

  public void addNames() {
    try {
      do {
      System.out.print("Enter recordID (To quit, enter -1): ");
      newID = reader.nextLong();
// Adding unknown number of records to a list
        // 
The user can enter more  names.addElement(newID);
      i++;
IDs than the heap can support and,
     } while (i <// countas ||a newIDresult, != -1);
    // Close "reader" and "input"
  }

  public static void main(String[] args) {exhaust the heap. Assume that the record ID
        // is a 64-bit long value
    ShowHeapError   demo = new ShowHeapError();
    demo.addNames();
  }
}

Compliant Solution

A simple compliant solution is to lower the number of names to read.

  // ...
  int count = 10000000;
  // ...

Compliant Solution

The {{OutOfMemoryError}} can be avoided by ensuring that the absence of infinite loops, memory leaks, and unnecessary object retention. When memory requirements are known ahead of time, the heap size can be tailored to fit the requirements using the following runtime parameters \[[Java 2006|AA. Bibliography#Java 06]\]:

java -Xms<initial heap size> -Xmx<maximum heap size>

For example,

java -Xms128m -Xmx512m ShowHeapError

Here the initial heap size is set to 128 MB and the maximum heap size to 512 MB.

This setting can be changed either using the Java Control Panel or from the command line. It cannot be adjusted through the application itself.

Risk Assessment

Assuming that infinite heap space is available can result in denial of service.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website

Other Languages

This rule appears in the C Secure Coding Standard as MEM11-C. Do not assume infinite heap space.

This rule appears in the C++ Secure Coding Standard as MEM12-CPP. Do not assume infinite heap space.

Related Vulnerabilities

GERONIMO-4224

Related Guidelines

Bibliography

 System.out.print("Enter recordID (To quit, enter -1): ");
        newID = reader.nextLong();

        names.addElement(newID);
        i++;
      } while (i < count || newID != -1);
    } finally {
      input.close();
    }
  }

  public static void main(String[] args) {
    ReadNames demo = new ReadNames();
    demo.addNames();
  }
}

Compliant Solution

A simple compliant solution is to reduce the number of names to read:

  // ...
  int count = 10000000;
  // ...

Compliant Solution

The OutOfMemoryError can be avoided by ensuring the absence of infinite loops, memory leaks, and unnecessary object retention. When memory requirements are known ahead of time, the heap size can be tailored to fit the requirements using the following runtime parameters [Java 2006]:

java -Xms<initial heap size> -Xmx<maximum heap size>

For example,

java -Xms128m -Xmx512m ReadNames

Here the initial heap size is set to 128MB and the maximum heap size to 512MB.

These settings can be changed either using the Java Control Panel or from the command line. They cannot be adjusted through the application itself.

Risk Assessment

Assuming infinite heap space can result in denial of service.

Related Vulnerabilities

The Apache Geronimo bug described by GERONIMO-4224 results in an OutOfMemoryError exception thrown by the WebAccessLogViewer when the access log file size is too large.

Automated Detection

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedMSC08-J. Do not place a semicolon on the same line as an if, for, or while statement      49. Miscellaneous (MSC)      MSC13-J. Do not modify the underlying collection when an iteration is in progress