Re: [jetty-user] Double.parseDouble JVM bug

On Tue, Feb 8, 2011 at 5:20 PM, Brian Demers <[email protected]> wrote:

> Given the popularity of this issue with Tomcat in the past few days, I
> figured I would ask about it here. ( I didn't find anything in the
> archive )
>
> For anyone not following: you can read up on it here
>
> http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/
> And the bug: http://bugs.openjdk.java.net/show_bug.cgi?id=100119
>
> But basically Double.parseDouble("2.2250738585072012e-308"); gets in
> an infant loop.
>
> So for tomcat apparently this will hang the JVM:
> curl -H “Accept-Language: en-us;q=2.2250738585072012e-308″ http://url
>
> Are there any versions of Jetty effected this type of problem ?
>

It has nothing to do with versions of Jetty, it depends solely on the JVM.
 AFAIK, there are currently no released JVMs which do not have this bug.
 You can work around it by putting a patched class on your bootstrap
classpath, but otherwise any application which can be made to parse a
user-controlled double can be DoS'd very easily.

-- 
John A. Tamplin
Software Engineer (GWT), Google