Page History

A Java OutofMemoryError occurs when the program attempts to use more heap space than is available. Among other causes, this error may result from the following:

• a A memory leak (see rule MSC04-J. Do not leak memory).
• an An infinite loop.
• limited Limited amounts of default heap memory available .
• incorrect Incorrect implementation of common data structures (hash tables, vectors, and so on).
• unbounded Unbounded deserialization.
• writing Writing a large number of objects to an ObjectOutputStream (see rule SER10-J. Avoid memory and resource leaks during serialization).
• creating Creating a large number of threads.
• uncompressing Uncompressing a file (see rule IDS04-J. Safely extract files from ZipInputStream).

Some of these causes are platform-dependent and difficult to anticipate. Others are fairly easy to anticipate, such as reading data from a file, are fairly easy to anticipate. As a result, programs must not accept untrusted input in a manner that can cause the program to exhaust memory.

...

This noncompliant code example reads lines of text from a file and adds each one to a vector until a line with the word "quit" is encountered.:

class ReadNames {
  private Vector<String> names = new Vector<String>();
  private final InputStreamReader input;
  private final BufferedReader reader;

  public ReadNames(String filename) throws IOException {
    this.input = new FileReader(filename);
    this.reader = new BufferedReader(input);
  }

  public void addNames() throws IOException {
    try {
      String newName;
      while (((newName = reader.readLine()) != null) &&
             !(newName.equalsIgnoreCase("quit"))) {
        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

  public static void main(String[] args) throws IOException {
    if (args.length != 1) {
      System.out.println("Arguments: [filename]");
      return;
    }
    ReadNames demo = new ReadNames(args[0]);
    demo.addNames();
  }
}

The code places no upper bounds on the memory space required to execute the program. Consequently, the program can easily exhaust the available heap space in two ways. First, an attacker can supply arbitrarily many lines in the file, causing the vector to grow until memory is exhausted. Second, an attacker can simply supply an arbitrarily long line, causing the readLine() method to exhaust memory. According to the Java API documentation [API 20062014], the BufferedReader.readLine() method

Reads a line of text. A line is considered to be terminated by any one of a line feed ('\n'), a carriage return ('\r'), or a carriage return followed immediately by a linefeed.

Any code that uses this method is susceptible to a resource exhaustion attack because the user can enter a string of any length.

Compliant Solution (

...

Limited File Size)

This compliant solution imposes a limit on the size of the file being read. This The limit is accomplished set with the Files.size() method, which is new to was introduced in Java SE 7. If the file is within the limit, we can assume the standard readLine() method will not exhaust memory, nor will memory be exhausted by the while loop.

class ReadNames {
  // ...other Other methods and variables

  public static final int fileSizeLimit = 1000000;

  public ReadNames(String filename) throws IOException {
    long size = Files.size( Paths.get( filename));
    if (size > fileSizeLimit) {
      throw new IOException("File too large");
    } else if (size == 0L) {
      throw new IOException("File size cannot be determined, possibly too large");
    }
    this.input = new FileReader(filename);
    this.reader = new BufferedReader(input);
  }
}

...

This compliant solution imposes limits both on the length of each line and on the total number of items to add to the vector. (It does not depend on any Java SE 7 or later features.)

class ReadNames {
  // ...other Other methods and variables

  public static String readLimitedLine(Reader reader, int limit) 
                                       throws IOException {
    StringBuilder sb = new StringBuilder();
    for (int i = 0; i < limit; i++) {
      int c = reader.read();
      if (c == -1) {
        return ((sb.length() > 0) ? sb.toString() : null);
      }
      if (((char) c == '\n') || ((char) c == '\r')) {
        break;
      }
      sb.append((char) c);
    }
    return sb.toString();
  }

  public static final int lineLengthLimit = 1024;
  public static final int lineCountLimit = 1000000;

  public void addNames() throws IOException {
    try {
      String newName;
      for (int i = 0; i < lineCountLimit; i++) {
        newName = readLimitedLine(reader, lineLengthLimit);
        if (newName == null || newName.equalsIgnoreCase("quit")) {
          break;
        }
        names.addElement(newName);
        System.out.println("adding " + newName);
      }
    } finally {
      input.close();
    }
  }

}

...

In a server-class machine using a parallel garbage collector, the default initial and maximum heap sizes are as follows for Java SE 6 [Sun 2006]:

• initial Initial heap size: larger of 1/64 of the machine's physical memory or some reasonable minimum.
• maximum Maximum heap size: smaller of 1/4 of the physical memory or 1GB.

This noncompliant code example requires more memory on the heap than is available by default.:

/** Assuming the heap size as 512 MB 
 *   (calculated as 1/4th4 of 2 GB2GB RAM = 512 MB512MB)
 *  Considering long values being entered (64 bits each, 
 *  the max number of elements would be 512 MB/64bits512MB/64 bits = 
 *  67108864)
 */
public class ReadNames {
  // Accepts unknown number of records
  Vector<Long> names = new Vector<Long>(); 
  long newID = 0L;
  int count = 67108865;
  int i = 0;
  InputStreamReader input = new InputStreamReader(System.in);
  Scanner reader = new Scanner(input);

  public void addNames() {
    try {
      do {
        // Adding unknown number of records to a list
        // The user can enter more IDs than the heap can support and,
        // as a result, exhaust the heap. Assume that the record ID
        // is a 64 -bit long value
        System.out.print("Enter recordID (To quit, enter -1): ");
        newID = reader.nextLong();

        names.addElement(newID);
        i++;
      } while (i < count || newID != -1);
    } finally {
      input.close();
    }
  }

  public static void main(String[] args) {
    ReadNames demo = new ReadNames();
    demo.addNames();
  }
}

...

A simple compliant solution is to reduce the number of names to read.:

  // ...
  int count = 10000000;
  // ...

...

Here the initial heap size is set to 128 MB 128MB and the maximum heap size to 512MB.

...

Assuming infinite heap space can result in DoS denial of service.

Related Vulnerabilities

...

Bibliography

...