Re: [jetty-user] Double.parseDouble JVM bug

Brian,

Jetty does not attempt to parse the header values, and treats them as
regular string values. As a result, it appears that this specific JVM bug
should not affect Jetty.

-Michael

On Tue, Feb 8, 2011 at 9:16 PM, Brian Demers <[email protected]> wrote:

> Sure, but my question was more specific to jetty, if there was any
> double parsing before the request is handed off to a handler.
>
>
> On Tue, Feb 8, 2011 at 5:23 PM, John Tamplin <[email protected]> wrote:
> > On Tue, Feb 8, 2011 at 5:20 PM, Brian Demers <[email protected]>
> wrote:
> >>
> >> Given the popularity of this issue with Tomcat in the past few days, I
> >> figured I would ask about it here. ( I didn't find anything in the
> >> archive )
> >>
> >> For anyone not following: you can read up on it here
> >>
> >>
> http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/
> >> And the bug: http://bugs.openjdk.java.net/show_bug.cgi?id=100119
> >>
> >> But basically Double.parseDouble("2.2250738585072012e-308"); gets in
> >> an infant loop.
> >>
> >> So for tomcat apparently this will hang the JVM:
> >> curl -H “Accept-Language: en-us;q=2.2250738585072012e-308″ http://url
> >>
> >> Are there any versions of Jetty effected this type of problem ?
> >
> > It has nothing to do with versions of Jetty, it depends solely on the
> JVM.
> >  AFAIK, there are currently no released JVMs which do not have this bug.
> >  You can work around it by putting a patched class on your bootstrap
> > classpath, but otherwise any application which can be made to parse a
> > user-controlled double can be DoS'd very easily.
> > --
> > John A. Tamplin
> > Software Engineer (GWT), Google
> >
>
> ---------------------------------------------------------------------
> To unsubscribe from this list, please visit:
>
>    http://xircles.codehaus.org/manage_email
>
>
>