Re: [jetty-user] Double.parseDouble JVM bug
Jan Bartel <[email protected]>
| Newsgroups | gmane.comp.java.jetty.support |
|---|---|
| Organization | Webtide |
| Message-ID | <[email protected]> |
Hi John, Any news from the GWT team on updating the embedded version of Jetty and/or hooking into more of the jetty config files from a GWT project? The jetty team is happy to collaborate ... cheers Jan On 09/02/11 13:16, Brian Demers wrote: > Sure, but my question was more specific to jetty, if there was any > double parsing before the request is handed off to a handler. > > > On Tue, Feb 8, 2011 at 5:23 PM, John Tamplin<[email protected]> wrote: >> On Tue, Feb 8, 2011 at 5:20 PM, Brian Demers<[email protected]> wrote: >>> >>> Given the popularity of this issue with Tomcat in the past few days, I >>> figured I would ask about it here. ( I didn't find anything in the >>> archive ) >>> >>> For anyone not following: you can read up on it here >>> >>> http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ >>> And the bug: http://bugs.openjdk.java.net/show_bug.cgi?id=100119 >>> >>> But basically Double.parseDouble("2.2250738585072012e-308"); gets in >>> an infant loop. >>> >>> So for tomcat apparently this will hang the JVM: >>> curl -H “Accept-Language: en-us;q=2.2250738585072012e-308″ http://url >>> >>> Are there any versions of Jetty effected this type of problem ? >> >> It has nothing to do with versions of Jetty, it depends solely on the JVM. >> AFAIK, there are currently no released JVMs which do not have this bug. >> You can work around it by putting a patched class on your bootstrap >> classpath, but otherwise any application which can be made to parse a >> user-controlled double can be DoS'd very easily. >> -- >> John A. Tamplin >> Software Engineer (GWT), Google >> > > --------------------------------------------------------------------- > To unsubscribe from this list, please visit: > > http://xircles.codehaus.org/manage_email > > -- Jan Bartel, Webtide LLC | [email protected] | http://www.webtide.com --------------------------------------------------------------------- To unsubscribe from this list, please visit: http://xircles.codehaus.org/manage_email