Re: [jetty-user] Double.parseDouble JVM bug
Brian Demers <[email protected]>
| Newsgroups | gmane.comp.java.jetty.support |
|---|---|
| Message-ID | <[email protected]> |
Sure, but my question was more specific to jetty, if there was any double parsing before the request is handed off to a handler. On Tue, Feb 8, 2011 at 5:23 PM, John Tamplin <[email protected]> wrote: > On Tue, Feb 8, 2011 at 5:20 PM, Brian Demers <[email protected]> wrote: >> >> Given the popularity of this issue with Tomcat in the past few days, I >> figured I would ask about it here. ( I didn't find anything in the >> archive ) >> >> For anyone not following: you can read up on it here >> >> http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ >> And the bug: http://bugs.openjdk.java.net/show_bug.cgi?id=100119 >> >> But basically Double.parseDouble("2.2250738585072012e-308"); gets in >> an infant loop. >> >> So for tomcat apparently this will hang the JVM: >> curl -H “Accept-Language: en-us;q=2.2250738585072012e-308″ http://url >> >> Are there any versions of Jetty effected this type of problem ? > > It has nothing to do with versions of Jetty, it depends solely on the JVM. > AFAIK, there are currently no released JVMs which do not have this bug. > You can work around it by putting a patched class on your bootstrap > classpath, but otherwise any application which can be made to parse a > user-controlled double can be DoS'd very easily. > -- > John A. Tamplin > Software Engineer (GWT), Google > --------------------------------------------------------------------- To unsubscribe from this list, please visit: http://xircles.codehaus.org/manage_email