Re: [jetty-user] Double.parseDouble JVM bug
Brian Demers <[email protected]>
| Newsgroups | gmane.comp.java.jetty.support |
|---|---|
| Message-ID | <[email protected]> |
Great! Thanks Michael On Tue, Feb 8, 2011 at 9:35 PM, Michael Gorovoy <[email protected]> wrote: > Brian, > Jetty does not attempt to parse the header values, and treats them as > regular string values. As a result, it appears that this specific JVM bug > should not affect Jetty. > -Michael > On Tue, Feb 8, 2011 at 9:16 PM, Brian Demers <[email protected]> wrote: >> >> Sure, but my question was more specific to jetty, if there was any >> double parsing before the request is handed off to a handler. >> >> >> On Tue, Feb 8, 2011 at 5:23 PM, John Tamplin <[email protected]> wrote: >> > On Tue, Feb 8, 2011 at 5:20 PM, Brian Demers <[email protected]> >> > wrote: >> >> >> >> Given the popularity of this issue with Tomcat in the past few days, I >> >> figured I would ask about it here. ( I didn't find anything in the >> >> archive ) >> >> >> >> For anyone not following: you can read up on it here >> >> >> >> >> >> http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ >> >> And the bug: http://bugs.openjdk.java.net/show_bug.cgi?id=100119 >> >> >> >> But basically Double.parseDouble("2.2250738585072012e-308"); gets in >> >> an infant loop. >> >> >> >> So for tomcat apparently this will hang the JVM: >> >> curl -H “Accept-Language: en-us;q=2.2250738585072012e-308″ http://url >> >> >> >> Are there any versions of Jetty effected this type of problem ? >> > >> > It has nothing to do with versions of Jetty, it depends solely on the >> > JVM. >> > AFAIK, there are currently no released JVMs which do not have this bug. >> > You can work around it by putting a patched class on your bootstrap >> > classpath, but otherwise any application which can be made to parse a >> > user-controlled double can be DoS'd very easily. >> > -- >> > John A. Tamplin >> > Software Engineer (GWT), Google >> > >> >> --------------------------------------------------------------------- >> To unsubscribe from this list, please visit: >> >> http://xircles.codehaus.org/manage_email >> >> > > --------------------------------------------------------------------- To unsubscribe from this list, please visit: http://xircles.codehaus.org/manage_email