OutofMemoryError occurs when the program attempts to use more heap space than is available. Among other causes, this error may result from the following:
- A memory leak (see MSC04-J. Do not leak memory)
- An infinite loop
- Limited amounts of default heap memory available
- Incorrect implementation of common data structures (hash tables, vectors, and so on)
- Unbounded deserialization
- Writing a large number of objects to an
ObjectOutputStream(see SER10-J. Avoid memory and resource leaks during serialization)
- Creating a large number of threads.
- Uncompressing a file (see IDS04-J. Safely extract files from ZipInputStream)
Some of these causes are platform-dependent and difficult to anticipate. Others, such as reading data from a file, are fairly easy to anticipate. As a result, programs must not accept untrusted input in a manner that can cause the program to exhaust memory.
Noncompliant Code Example (
This noncompliant code example reads lines of text from a file and adds each one to a vector until a line with the word "quit" is encountered:
The code places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap space in two ways. First, an attacker can supply arbitrarily many lines in the file, causing the vector to grow until memory is exhausted. Second, an attacker can simply supply an arbitrarily long line, causing the
readLine() method to exhaust memory. According to the Java API documentation [API 2014], the
Reads a line of text. A line is considered to be terminated by any one of a line feed ('
\n'), a carriage return ('
\r'), or a carriage return followed immediately by a linefeed.
Any code that uses this method is susceptible to a resource exhaustion attack because the user can enter a string of any length.
Compliant Solution (Limited File Size)
This compliant solution imposes a limit on the size of the file being read. The limit is set with the
Files.size() method, which was introduced in Java SE 7. If the file is within the limit, we can assume the standard
readLine() method will not exhaust memory, nor will memory be exhausted by the
Compliant Solution (Limited Length Input)
This compliant solution imposes limits both on the length of each line and on the total number of items to add to the vector. (It does not depend on any Java SE 7 or later features.)
readLimitedLine() method takes a numeric limit, indicating the total number of characters that may exist on one line. If a line contains more characters, the line is truncated, and the characters are returned on the next invocation. This prevents an attacker from exhausting memory by supplying input with no line breaks.
Noncompliant Code Example
In a server-class machine using a parallel garbage collector, the default initial and maximum heap sizes are as follows for Java SE 6 [Sun 2006]:
- Initial heap size: larger of 1/64 of the machine's physical memory or some reasonable minimum.
- Maximum heap size: smaller of 1/4 of the physical memory or 1GB.
This noncompliant code example requires more memory on the heap than is available by default:
A simple compliant solution is to reduce the number of names to read:
OutOfMemoryError can be avoided by ensuring the absence of infinite loops, memory leaks, and unnecessary object retention. When memory requirements are known ahead of time, the heap size can be tailored to fit the requirements using the following runtime parameters [Java 2006]:
java -Xms<initial heap size> -Xmx<maximum heap size>
java -Xms128m -Xmx512m ReadNames
Here the initial heap size is set to 128MB and the maximum heap size to 512MB.
These settings can be changed either using the Java Control Panel or from the command line. They cannot be adjusted through the application itself.
Assuming infinite heap space can result in denial of service.
The Apache Geronimo bug described by GERONIMO-4224 results in an
OutOfMemoryError exception thrown by the
WebAccessLogViewer when the access log file size is too large.
Resource Exhaustion [XZP]
Java—The Java Application Launcher, Syntax for Increasing the Heap Size
|[Oracle 2015]||Tuning the Java Runtime System|
Garbage Collection Ergonomics, Default Values for the Initial and Maximum Heap Size