Java Floating Point Bug Can Lock Up Servers

Re:About face! by gstrickler · 2011-02-08 15:11 · Score: 1

It's amazing how fast public disclosure can get bugs fixed.

--
make imaginary.friends COUNT=100 VISIBLE=false

Bullshit! by Anonymous Coward · 2011-02-08 15:15 · Score: 4, Funny

Java is a secure virtual machine environment. Programs never crash and low level errors like pointer or memory problems are impossible. There is no way this floating point thing is real.

Java is the future and you are retarded. Java is the fastest programming language ever invented, that's why it's the primary language we learn and teach in school.

I have been a HTML programmer for many years, I know what I'm talking about.

Re:Bullshit! by Citizen+of+Earth · 2011-02-08 15:36 · Score: 1, Funny

Java is the fastest programming language ever invented
That's why it's used to implement all video codecs!
Re:Bullshit! by Anonymous Coward · 2011-02-08 15:36 · Score: 2, Informative

Actually, this is not a security bug allowing someone to break into the server or run their own code. The only possible exploit is using up CPU time. If a server is setup properly, it will not lockup the machine, but it still allows an easy vector DoS against the application and/or application server.
Re:Bullshit! by Anonymous Coward · 2011-02-08 16:26 · Score: 2, Funny

>>> is no way this floating point thing is real.
Are you insinuating an int thing is real, if floating point thing is not real?
Re:Bullshit! by the+Atomic+Rabbit · 2011-02-08 16:32 · Score: 4, Funny

There is no way this floating point thing is real.
It has to be real. Java lacks built-in support for complex numbers.
Re:Bullshit! by CharredMetal · 2011-02-08 17:00 · Score: 1

DOS is classified as a security issue.
Re:Bullshit! by prionic6 · 2011-02-08 19:57 · Score: 2

Not only is it real, it is rational!
Re:Bullshit! by maxwell+demon · 2011-02-08 20:32 · Score: 1, Funny

Java is the fastest programming language ever invented
That's why it's used to implement all video codecs!
No, video codecs are implemented in Flash because Java always makes those ugly coffee blotches on the videos.

--
The Tao of math: The numbers you can count are not the real numbers.
Re:Bullshit! by dkf · 2011-02-08 22:47 · Score: 1

DOS is classified as a security issue.
Depends on the deployment configuration. It's often quite easy to mitigate DoS attacks that only hit a single layer of the overall architecture (e.g., by replicating servers and adding a watchdog that restarts things if they go unresponsive for too long). The tricky ones are those that involve many levels, especially if they just look like lots of normal traffic.

--
"Little does he know, but there is no 'I' in 'Idiot'!"
Re:Bullshit! by AmiMoJo · 2011-02-08 22:59 · Score: 1

It is still quite critical for anyone who develops internet accessible apps using Java. One person can DoS your entire system with some bad data.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Bullshit! by arth1 · 2011-02-09 01:10 · Score: 1

It doesn't matter much if the box is running or not; if the application server that is the reason for the box isn't, the server is considered down.
That it's so incredibly easy to exploit is another issue.
Allegedly, the following works against most web servers that accept different languages:

curl -H 'Accept-Language: en-us;q=2.2250738585072012e-308' $URL

Then there are form fields which accept doubles. Including a lot of payment forms.
Re:Bullshit! by snookiex · 2011-02-09 01:21 · Score: 1

HTML programmer
That's the actual joke

--
Open Source Network Inventory for the masses! Kuwaiba
Re:Bullshit! by bluefoxlucid · 2011-02-09 03:46 · Score: 1

I take Computer Science III, I know what I'm talking about.
Fixed that for you Mike.

--
Support my political activism on Patreon.
Re:Bullshit! by rreyelts · 2011-02-09 04:42 · Score: 1

I realize your post was intended to be +100 Funny, but for the record, it's fairly hard to invent a language which is both Turing-complete and provides for provability of termination. (A non-converging loop is the source of this float parsing bug). In computer science we tend to call that the halting problem. Also, FWIW, these class of problems don't generally lead to exploits outside of denial-of-service attacks.
Re:Bullshit! by omfgnosis · 2011-02-09 05:27 · Score: 1

So is Windows, but they keep selling it anyway.
Re:Bullshit! by lgw · 2011-02-09 07:01 · Score: 1

No real-world computing environment is Turing complete (because memory is finite), and provability of termination is in theory possible for all common languages in real-world computing environments (because memory is finite). And in the real world, getting an inifinite-loop bug out of floating-point routine just isn't that hard.
Denial of service attacks are real attacks, BTW. If some random script kiddy can just turn your business off, chanse are you care. This one is probably easy to mitigate, but as a class of attacks, DoS attacks matter.

--
Socialism: a lie told by totalitarians and believed by fools.
Re:Bullshit! by lgw · 2011-02-09 07:04 · Score: 2

Also, making italics work on the internet just isn't that hard. Maybe Slashdot needs to hire some of those aforementioned script kiddies, or some chimpanzees, or something like that to improve the "Slashdot 3.0" experience - they could hardly do worse.

--
Socialism: a lie told by totalitarians and believed by fools.
Re:Bullshit! by rreyelts · 2011-02-09 07:36 · Score: 1

If we're talking about the real world, where are my termination inspections in my IDE? Nobody said denial of service attacks aren't real, but there are different paths for dealing with them. I say this being just a little familiar with preventing arbitrary code from running wild on machines.
Re:Bullshit! by lgw · 2011-02-09 08:02 · Score: 1

My termination inspections are the guy sitting next to me, and vice versa. This is just the kind of problem that code review is good at finding - at leats, given experience reviewers. I don't know what those shops where everyone is under 25 do.

--
Socialism: a lie told by totalitarians and believed by fools.

Unless... by MrEricSir · 2011-02-08 15:23 · Score: 2

...it's a critical bug in an Adobe product. Then it's going to linger for months, if not years.

--
There's no -1 for "I don't get it."

Re:Unless... by gstrickler · 2011-02-08 15:47 · Score: 3, Insightful

Aren't Adobe products were simply a collection of bugs, artfully put together to form a useful, but slow and insecure program.

--
make imaginary.friends COUNT=100 VISIBLE=false
Re:Unless... by haruchai · 2011-02-08 16:29 · Score: 1

damn, i ran out of mod points yesterday. +3 Insightful to you, +5 Funny

--
Pain is merely failure leaving the body
Re:Unless... by omfgnosis · 2011-02-09 05:16 · Score: 1

Why would Adobe *fix* bugs? They're hard at work on a new version, with entirely new bugs. And you can pay $500+ for the privilege of being in their testing department, knowing crash reports get sent straight to /dev/null.
Re:Unless... by gstrickler · 2011-02-09 07:38 · Score: 1

Someone wasted a mod point to mod down my compliment? Try reading the moderator guidelines.

--
make imaginary.friends COUNT=100 VISIBLE=false

Re:So much for Open Source by Beelzebud · 2011-02-08 15:35 · Score: 1

Yes because this will surely bring down the world of Open Source for good!

Re:About face! by sixfive0two · 2011-02-08 15:39 · Score: 3, Informative

Actually, it's already fixed: Oracle has released a fix for this issue through Security Alert CVE-2010-4476. For more information see: http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html

An infinite Java loop? Sounds interesting... by ibsteve2u · 2011-02-08 15:39 · Score: 1

But I think I'll stick to running Folding@Home on all cores to burn in thermal paste. Seems more productive, you know?

--
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"

Don't you see? It's a feature! by todd.gardner · 2011-02-08 15:45 · Score: 1

Write once, exploit anywhere!

Re:About face! by gstrickler · 2011-02-08 15:48 · Score: 1

Unstable overrides cheap every time. I'll take stable and fast for $200, Alex.

--
make imaginary.friends COUNT=100 VISIBLE=false

Re:About face! by gstrickler · 2011-02-08 15:50 · Score: 1

Like I said, it's amazing how fast public disclosure can get bugs fixed. Even ones that have been known for 10 years.

--
make imaginary.friends COUNT=100 VISIBLE=false

Re:And how soon was the PHP bug fixed again ? by Anonymous Coward · 2011-02-08 15:51 · Score: 1

The PHP bug was reported on Dec. 30 and fixed I think on Jan. 3, which is 5 days. I'm pretty sure it doesn't take a time machine to make a one-line fix that quickly!

dom

Java, don't need it, don't want it! by Anonymous Coward · 2011-02-08 15:57 · Score: 2, Insightful

I now uninstall Java from any systems I work on as a security precaution. The auto-update is a nice 'feature', but in most client's systems I work on, none of them have any compelling reason for an installation of Java.

Over two years and no fix for Java

"Sami Koivu has released details of a security vulnerability in Java which he reported to Sun in 2008. A quick test using the current version 1.6.0_23 reveals that it remains unpatched "

Re:Java, don't need it, don't want it! by Lennie · 2011-02-09 04:26 · Score: 1

Java is among the many plugins I disable in Firefox. One of the first things I do. Firefox updates are frequent enough to be secure but the plugins is where the problems are.

--
New things are always on the horizon

Shocked! Shocked! by curmudgeon99 · 2011-02-08 15:58 · Score: 4, Funny

As a more than decade-long Java programmer, I must say that I am shocked! Shocked! that Sun would do something like that.
Why, I'd go so far as to predict that a company that behaved that way would find itself out of business.

Hey, wait a second...

So what if they've known about it for 10 years? by Tony+Isaac · 2011-02-08 15:59 · Score: 2, Interesting

Does Java software crash all the time because of this bug? No, of course not, that's one reason Java software is useful at all.

Like with any software, it is essential to prioritize bug fixes. You deal with the bugs that bite you, and save the rest for later.

This is a valid principle for anything made by people, not just software. Somebody might find out, for example, that if you subject a window to a specific frequency of sound, the window will shatter. So what! Don't do that! But...if burglars start going around with a device that emits this frequency, then it's time to come up with an antidote.

Java (like Mac OS) has enjoyed a relatively free ride, when it comes to malicious hackers. It's not that Java is somehow superior, it's just not been an attractive enough target. The fact that it is now being attacked is, in a way, a sign of its success.

Re:So what if they've known about it for 10 years? by scdeimos · 2011-02-08 16:36 · Score: 2

Somebody might find out, for example, that if you subject a window to a specific frequency of sound, the window will shatter. So what! Don't do that! But...if burglars start going around with a device that emits this frequency, then it's time to come up with an antidote.
Except that the resonant frequency of the windows in your example is dependant upon their volume and mounting frames - thus making it different from window to window. Being able to crash all sorts of Java programs by throwing a certain number at them is a little more repeatable.
Re:So what if they've known about it for 10 years? by ADRA · 2011-02-08 17:05 · Score: 2

Repeatable yes, but that also requires programs to have well known and easily deliverable raw floating point number insertion points. Some will have tons and others won't have any. It seems analogous to the window flaw after all.

--
Bye!
Re:So what if they've known about it for 10 years? by Anonymous Coward · 2011-02-08 17:21 · Score: 1

What the fuck are you talking about, Java powers the majority of major internet sites. It has done so for a long, long time.
Re:So what if they've known about it for 10 years? by Anonymous Coward · 2011-02-08 17:22 · Score: 1

you're joking, right? Fixing a infinite loop caused by normalization of certain values should have the highest priority, that's a broken math library in the planet's platform for doing enterprise math. The ten year old bug report not only gave the range of numbers but the follow up to it even included the fix. Too bad slashdot's lameness filter doesn't allow reproducing it here
Re:So what if they've known about it for 10 years? by tomhudson · 2011-02-08 17:38 · Score: 1

Actually, as one of the comments on the site pointed out:

I think this bug is less critical than PHPâ(TM)s bug, because Java Servlets are not used as much as PHP

"Java sucks less because people use it less". Sounds reasonable.
Re:So what if they've known about it for 10 years? by RocketRabbit · 2011-02-08 17:55 · Score: 1

Actually it's PHP that powers most internet sites, but thanks for playing.
Re:So what if they've known about it for 10 years? by prionic6 · 2011-02-08 20:09 · Score: 1

Not to be picky, but he was talking about the majority of _all_ major sites, not the top ten. Still probably not true, but it should be a significant percentage.
Also, while not primarily powered by it, Google and Facebook (and probably others on the list, don't know) use Java in some of their backend systems. According to a quick internet search.
Re:So what if they've known about it for 10 years? by kaffiene · 2011-02-08 21:32 · Score: 1

Are you shocked that people who have an axe to grind about Java are using this to criticise the language? Has slashdot *ever* given Java a fair go? I think not.
Re:So what if they've known about it for 10 years? by kaffiene · 2011-02-08 21:41 · Score: 1

Yeah, sure, all those banks, Google, Twitter... PHP through and through.
PHP powers a *lot* of small hack websites. If running forums is your idea of the important parts of the web, then sure, yeah PHP powers a tonne of that. Java powers things that are actually used on an industrial scale, require reliability and security.
Re:So what if they've known about it for 10 years? by kaffiene · 2011-02-08 21:42 · Score: 1

It's also not true - all JSP sites render as Servlets, as I think most Java web technologies do.
Re:So what if they've known about it for 10 years? by MemoryDragon · 2011-02-08 23:01 · Score: 1

No it does not crash all the time, but given that i am a server framework programmer this issue is severe enough. It is not funny if a well placed http get parameter can shoot down your entire server. It of course depends on the backend code really trying to convert the number into float params. So far Tomcat has fixed this relatively quickly other frameworks as well ( you still can shoot down the server on framework level)
But the final fix has to come from Oracle.
Re:So what if they've known about it for 10 years? by snookiex · 2011-02-09 01:30 · Score: 1

Priority is often calculated from two variables: impact and likelihood. I guess they weren't so wrong about the latter. In any case they screwed it badly.

--
Open Source Network Inventory for the masses! Kuwaiba
Re:So what if they've known about it for 10 years? by tomhudson · 2011-02-09 01:54 · Score: 1

Which doesn't change the fact that PHP is more widely used on the web than Java. Pretty much every web hosting project offers a basic LAMP or WAMP stack. Java? Not so much.
The same goes for available software. Compare the number of open-source web frameworks and content management systems available for the two languages. Java is barely a blip. PHP is everywhere, and python and ruby are follow-ups.
Re:So what if they've known about it for 10 years? by Compaqt · 2011-02-09 02:08 · Score: 2

Well, Facebook and Yahoo. Those are pretty big.
Yes, they're running other stuff, too, but PHP as well in a big way.
Not saying that Java's not important, but PHP is probably going to become more prevalent in large websites simply because garage tinkerers often start in PHP, the site becomes big, and they're still on PHP.
I'm also not saying anybody should run banking on PHP (please don't do that), but for serving up webpages? Yeah.

--
I'm not a lawyer, but I play one on the Internet. Blog
Re:So what if they've known about it for 10 years? by s122604 · 2011-02-09 02:38 · Score: 1

Oh, who are you, coming in here with facts and reason, you're disturbing a good anti-java derp carnival
Re:So what if they've known about it for 10 years? by s122604 · 2011-02-09 02:40 · Score: 1

Right

because its impossible to do anything this dangerous or insecure in C++
Re:So what if they've known about it for 10 years? by dougmc · 2011-02-09 03:49 · Score: 1

Actually it's PHP that powers most internet sites, but thanks for playing.
It's not clear who the bigger player is -- php or java -- but both are huge.
And he didn't say "most internet sites" -- he said "majority of major internet sites" -- a subjective measure which makes such a claim difficult to prove or disprove.
Re:So what if they've known about it for 10 years? by tomhudson · 2011-02-09 04:10 · Score: 1

Pretty much. How often is wikipedia the first or second result - and it runs on php.
http://www.facebook.com/login.php, yahoo (and Steve Ballmer said that if they had bought Yahoo, Microsoft would have been the biggest user of php on the net), http://photobucket.com/index.php, digg, etc. Even the white house's site http://whitehouse.gov/ runs php.
Not too many large sites use Java. Mostly corporate e-payment systems.
Re:So what if they've known about it for 10 years? by Lisandro · 2011-02-09 04:21 · Score: 1

you're joking, right? Fixing a infinite loop caused by normalization of certain values should have the highest priority, that's a broken math library in the planet's platform for doing enterprise math. The ten year old bug report not only gave the range of numbers but the follow up to it even included the fix. Too bad slashdot's lameness filter doesn't allow reproducing it here
Ditto. The fact that Oracle shelved this bug for *A DECADE* is incredible, specially considering the exposure Java has as a platform and that the original poster actually bothered to include a one-line patch solving the issue entirely.
Re:So what if they've known about it for 10 years? by Lennie · 2011-02-09 04:27 · Score: 1

So which large sites use Java to power their site ?

--
New things are always on the horizon
Re:So what if they've known about it for 10 years? by lgw · 2011-02-09 07:13 · Score: 2

The problem that any Real Programmer has with Java is not how the language works - there's always a place for a language with the sharp corners rounded off. The problem is Java is the new COBOL - the language in which all the most boring programming jobs in the world get done by business school graduates. You can do cool things in any language, but if you're doing the least cool things, chances are you're doing them in Java. Any criticism of details of the language are sort of an afterthought - they're how we pick on Java, not why we pick on Java.

--
Socialism: a lie told by totalitarians and believed by fools.
Re:So what if they've known about it for 10 years? by Desler · 2011-02-09 07:34 · Score: 1

because its impossible to do anything this dangerous or insecure in C++
The point of this irrelevant statement is what? Do C++ programmers en masse claim that you can't do dangerous things in C++? On the other hand, Java weenies continually beat drum about how Java is safer, etc yet there have been how many high profile exploits against the JVM just in the last few months?
Re:So what if they've known about it for 10 years? by afabbro · 2011-02-09 08:35 · Score: 1

Which doesn't change the fact that PHP is more widely used on the web than Java.
That may be true but you sure didn't prove it here.

Pretty much every web hosting project offers a basic LAMP or WAMP stack. Java? Not so much.
I agree, especially Google's App Engine which...oh wait.
Anyway, your point is that for cheap web hosting PHP is more common and that PHP rules the least common denominator of web sites. Tell us something we didn't know.

The same goes for available software. Compare the number of open-source web frameworks and content management systems available for the two languages. Java is barely a blip. PHP is everywhere, and python and ruby are follow-ups.
Great! But the relevance is, s you like to say, "not so much" to your argument.
If you measure by number of .php pages out there, yes, there's more PHP on the net than Java. If you measure by bajillions of web pages served, it's probably the inverse. If you measure by number of financial transactions (banks, etc.) where web users hit Java vs. PHP, it's a divide by zero error.

--
Advice: on VPS providers
Re:So what if they've known about it for 10 years? by icebraining · 2011-02-09 09:32 · Score: 1

Well, there's Wikipedia, Facebook (converted to C++ with HipHop, but still) and Flickr.

--
Dilbert RSS feed
Re:So what if they've known about it for 10 years? by tomhudson · 2011-02-09 11:24 · Score: 1

Facebook is now the #1 site in terms of pages served (beating out google) and they use PHP, not Java.
They probably serve more pages than all the java servlets combined.
Re:So what if they've known about it for 10 years? by dougmc · 2011-02-09 16:55 · Score: 1

So which large sites use Java to power their site ?
Ebay
Amazon uses it, among other things
google uses it, among other things (you name it, they probably use it somewhere)
Lots of corporate sites, intranet and extranet, use java. Java is extremely strong there. Some of these sites are small, some are huge.
Ultimately, most sites hide what language they're written in -- you have to go looking for it. To be more precise, they don't intentionally hide it, it's just that their sites tend to not make it obvious. (php is often more obvious than many others, however.)
php is used for more smaller sites it seems -- if you install your own blogging or forum package, odds are good it's php. java seems more popular with larger commercial sites. Certainly, these aren't hard and fast rules -- Facebook uses php very heavily (but it has some java in there too) and more than a few personal sites use java.
Which is used for more "major internet sites"? Got me -- but first you'd have to define that term. I would fully expect that php is used in far more sites total than java, however.
Re:So what if they've known about it for 10 years? by dougmc · 2011-02-09 17:01 · Score: 1

Yeah, sure, all those banks, Google, Twitter... PHP through and through.
Google uses everything.
Twitter started with ruby on rails, then moved to Ruby on Rails to deliver most user-facing web pages, and some of the back-end Ruby services with applications running on the JVM and written in Scala.
Re:So what if they've known about it for 10 years? by Lennie · 2011-02-10 06:52 · Score: 1

"major sites" ? well, let's see Alexa top 1000 or something like that.
Ebay uses it at the frontend, I didn't know that. But Google and Amazon don't. Amazon and Facebook use it for certain parts.

--
New things are always on the horizon

Re:An infinite Java loop? Sounds interesting... by PopeRatzo · 2011-02-08 16:05 · Score: 2

But I think I'll stick to running Folding@Home on all cores to burn in thermal paste.

Let me clue you in to a little secret: That's not really thermal paste...

--
You are welcome on my lawn.

Re:About face! by MightyMartian · 2011-02-08 16:27 · Score: 1

Or get your ass sued for daring to reveal long-standing bugs that the assholes that maintain it have consistently refused to fix.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.

Hex. by zooblethorpe · 2011-02-08 16:28 · Score: 1

The supercomputer Hex. Only at the Unseen University. "Anthill Inside"!

--
"What in the name of Fats Waller is that?"
"A four-foot prune."

Re:About face! by scdeimos · 2011-02-08 16:30 · Score: 1

Bug ID 4399272 trumps the one mentioned in the article and was logged 08-Dec-2000. As with 4421492 it's no longer available on the Sun site, but it's still in Google's cache.

Encountered this a couple years ago by prehistoricman5 · 2011-02-08 16:31 · Score: 2, Interesting

I was working on a gas/billiard ball simulation a couple years ago and kept on running into a bug where the simulation would lock up in an infinite loop, and iirc, that magic number kept popping up. All along I thought it was some sort of bug in my code (it was a horrible hack job; it's almost unmaintainable).

--
Fuck Beta

Do NOT try this by c0lo · 2011-02-08 16:32 · Score: 3, Funny

Try this:

curl http://slashdot.org/

DO... NOT... TRY... THIS...

curl -H "Accept-Language: en-us;q=2.2250738585072012e-308" http://slashdot.org/

Don't say I haven't warned you!!!!!

--
Questions raise, answers kill. Raise questions to stay alive.

Re:Do NOT try this by dougmc · 2011-02-09 01:11 · Score: 1

Isn't slashcode written in perl rather than java?
Oh ... I see what you did there!
Re:Do NOT try this by snookiex · 2011-02-09 01:37 · Score: 1

+1 Funny. But apparently you can install it

--
Open Source Network Inventory for the masses! Kuwaiba
Re:Do NOT try this by Lennie · 2011-02-09 04:39 · Score: 1

Actually, it looks like they use Varnish as a kind of loadbalancer.

--
New things are always on the horizon

Re:An infinite Java loop? Sounds interesting... by ibsteve2u · 2011-02-08 16:47 · Score: 1

Well, if it's not thermal gel, thermal compound, thermal paste, heat paste, heat sink paste, heat transfer compound, or heat sink compound, then I don't know what it is. Although if you spend enough time messing with it, I do know it makes a wonderful contraceptive - as G/Fs get tired of being ignored and move on.

--
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"

Fixed available by Wookie+Monster · 2011-02-08 17:21 · Score: 5, Informative

Oracle has posted a fix for the bug, in the form of a patch. Official releases will be available next week. http://www.oracle.com/technetwork/java/javase/fpupdater-tool-readme-305936.html http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html

Re:Fixed available by Carewolf · 2011-02-08 21:01 · Score: 1

A fix in form of a patch has been posted on the 10 year bug report of the same bug. Didn't seem to like that helped a fix find its way into Java.

Fails to Work on Android by virtigex · 2011-02-08 18:53 · Score: 1

The code works fine on Android. Guess that they are not running a true JVM.

Re:Fails to Work on Android by MemoryDragon · 2011-02-08 23:07 · Score: 1

Guess they simply used the Harmony Code for this stuff and Harmony does not have the bug in.
Re:Fails to Work on Android by TheThiefMaster · 2011-02-08 23:33 · Score: 1

If it's the same problem PHP had, then it requires an x86 FPU.
Re:Fails to Work on Android by cnettel · 2011-02-09 00:57 · Score: 1

The bug is in Java code, not underlying JVM code. Java goes to great lengths to maintain IEEE compliance, which means that it truncates to 64-bit precision everywhere.
Re:Fails to Work on Android by atomice · 2011-02-09 01:50 · Score: 2

Guess they simply used the Harmony Code for this stuff and Harmony does not have the bug in.
It was fixed in Harmony a year and a half ago:
https://issues.apache.org/jira/browse/HARMONY-329
Re:Fails to Work on Android by Lisandro · 2011-02-09 03:00 · Score: 1

If it's the same problem PHP had, then it requires an x86 FPU.
It is not. Both bugs are similar in the sense that they're triggered by some border cases of floating-point values, but are otherwise completely unrelated.
Re:Fails to Work on Android by rekrowyalp · 2011-02-09 04:28 · Score: 1

The code works fine on Android. Guess that they are not running a true JVM.
LOL, you should let Google's lawyers know, they could use this as a defence against Oracle
Re:Fails to Work on Android by lskovlund · 2011-02-09 07:47 · Score: 1

IEEE compliance doesn't mean what you think it means. Not sure whether Java has changed in this regard since 1998, but it definitely was wrong then

Re:An infinite Java loop? Sounds interesting... by antifoidulus · 2011-02-08 18:55 · Score: 1

it's made of people?!

--
Monstar L

Re:Cool! by Anonymous Coward · 2011-02-08 20:07 · Score: 2, Funny

Thats the combination to my luggage!

Re:And how soon was the PHP bug fixed again ? by Eunuchswear · 2011-02-08 20:33 · Score: 1

The PHP bug was reported on Dec. 30 and fixed I think on Jan. 3, which is 5 days.

Yow! 5 days.

I wonder what happened between Dec 30 and Jan 3? Anything that might of distracted the developers?

--
Watch this Heartland Institute video

It is not the JVM .... by Chrisq · 2011-02-08 20:52 · Score: 5, Insightful

The article makes it clear that the problem is in FloatingDecimal.java. It is converting decimal strings to floating point numbers - fp arithmetic is fine!

Re:It is not the JVM .... by Chrisq · 2011-02-09 01:28 · Score: 1

No. Unconstrained user input will be. If you're not already checking the user input before passing it along, you're a fucking idiot and this bug is the LEAST of your worries.
There are a few niche cases, like calculators and spreadsheets, where the constrained input could validly include the input. The assertion in comments to the article that quality values in HTTP headers cause this problem do not come into this category, as the standard says that only three digits after the decimal should be sent.
Re:It is not the JVM .... by CynicTheHedgehog · 2011-02-09 02:03 · Score: 3, Informative

I haven't used floats or doubles in a long time. From a business perspective (think monetary values) it almost always makes more sense to use BigDecimal and apply rounding rules, particularly if those values are stored in a database where scale and precision are known or required. I would imagine the same would be true for scientific values, GIS coordinates, etc. (anything with a known precision). The only use for float/double that comes to mind is something where absolute precision isn't critical and speed is important, such as graphics/physics calculations for games, in which case you generally wouldn't be parsing user-entered values anyway.
Also, the default/packaged JSF numeric input converters produce either Long or BigDecimal values (per spec) depending on whether a decimal is present, so this should only affect a very small subset of use cases that are easily patched or avoided (old JSP/servlet code, Struts, etc.)
Re:It is not the JVM .... by meloneg · 2011-02-09 02:36 · Score: 1

Also, the default/packaged JSF numeric input converters produce either Long or BigDecimal values (per spec) depending on whether a decimal is present, so this should only affect a very small subset of use cases that are easily patched or avoided (old JSP/servlet code, Struts, etc.)
Do you really think that "old JSP/servlet code" is rare? Systems that pre-date JSF popularity are the norm.
Re:It is not the JVM .... by CynicTheHedgehog · 2011-02-09 03:17 · Score: 1

Well, technically all JSF apps are also servlet-based, and I was initially concerned that everything was affected based on comment #53 in the source article, but I tried the header on my local applications with no ill effects (my application does use resource bundles and would by necessity look at the locale headers). I also looked at jmx-console and web-console to make sure they were okay--these are by and large basic servlet/JSP apps. (JBoss 5.1, Java 1.6.0_22 64 bit.)
The JVM itself is definitely affected, as the following code results in infinite loops/freezes:
package foo;

public class Foo {
public static void main(String... args) {
Double.parseDouble("2.2250738585072012e-308");
}
}
So either you have to write code to explicitly parse headers as floats/doubles, or there's some bug in some legacy framework(s).
Either way, JSF has been around since 2004, and recent demand for AJAX, SOAP, social network integration, and other modern features would seem to drive newer technologies. So there are probably a significant number of applications affected, but they are probably still in the minority.
Re:It is not the JVM .... by lamber45 · 2011-02-09 03:18 · Score: 1

And how is an application supposed to check user input? The normal way to check a user-provided floating-point value for validity is to call Double.parseDouble() and catch the NumberFormatException that's thrown if it can't be parsed, then apply any relevant range checks using mathematical operations. The documentation for that method doesn't say anything about entering an infinite loop; it can either return a double, or throw an exception.
An alternative would be to use regular expressions. There might be some apps that are using "double" for large integers, or fixed-point quantities; but the regular expression for a general floating-point number is already pretty hairy. Can you give a regular expression that filters out the strings, and only the strings, that lead to this bug?
Re:It is not the JVM .... by Chrisq · 2011-02-09 03:26 · Score: 1

There are many areas where the overheads of arbitrary-precision arithmetic are not acceptable. There are also areas where arbitrary-precision arithmetic is not good enough, and systems that formally deal with irrational numbers like or 3 or rationals like 1/3 with recurring binary and decimal representations. Mathematical formulas to ensure that roundoff errors are well conditioned and don't accumulate are well understood by people who have complex computational needs.
Your assertion that you can "just use big decimal" is like someone who put a shed together telling an architect that you can ensure that a structure is strong enough by bunging in a few extra nails.
Re:It is not the JVM .... by CynicTheHedgehog · 2011-02-09 04:45 · Score: 1

I said BigDecimal is appropriate for most business use cases, especially when dealing with money, as you can control the precision and rounding behavior. The problem with floating point formulas is that they don't always round in the way you want or need them to. If you've ever applied percentage discounts and then added up the results you will see that iusing float or double often causes you to be off by one or two cents. Here is a good post on the problem with relevant examples.
Stated another way, if you are collecting a floating point value as input, chances are it has to deal with GIS coordinates, monetary values, grade point average, or perhaps some scientific value with known precision, in which case BigDecimal would be more appropriate and therefore immune to this particular problem.
Re:It is not the JVM .... by CynicTheHedgehog · 2011-02-09 04:51 · Score: 1

The last part of the above post is actually incorrect. (javax.faces.convert.NumberConverter) uses DecimalFormat, which by default produces either a Long or a Double depending on whether the value fits into a Long. You can call DecimalFormat.setParseBigDecimal to make it use BigDecimal, though. Also, DecimalFormat does some digit manipulation via DigitList before calling Double.parseDouble. So Double.parseDouble("2.2250738585072012e-308") is affected, but new DecimalFormat.parse("2.2250738585072012e-308") is not. The resulting Double value for the latter is actually 2.2250738585072014.

Re:About face! by DrXym · 2011-02-08 21:51 · Score: 1

Actually it's more amazing how a well described, reproducible error which illustrates a security flaw gives rise to a fix. Sounds like the previous bugs were too vague to isolate the issue. Bug databases always end up with bugs like that. Go look how many bugs Firefox has open on it for example.

Re:Cool! by MemoryDragon · 2011-02-08 23:09 · Score: 1

Wont help :-) it only triggers if the text field parses for a floating LONG number!
Most textfields either go for Int or Float as their targets.

Re:About face! by petermgreen · 2011-02-09 01:23 · Score: 3, Insightful

Yeah bugs that pop up every so often to end users (and are common enough or reported by trusted enough users that they can't just by dismissed as coming from liers/trolls) but only pop up sporadically and/or only pop up on certain systems are a big problem for developers. With no reliable way to reproduce a bug it is almost impossible to fix it.

Even more irritating are the bugs that dissapear as soon as you try to use a debugger.

The firefox memory and CPU usage issues are good examples of this. Way too many users reported them to dismiss them as a lie or fluke but there was no set of steps to reproduce. Every so often one cause was found and squashed but they kept coming up for years and may still be doing so (I still see firefox crash for no apparent reason and it wouldn't surprise me if the cause is running out of address space).

--
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register

Re:About face! by petermgreen · 2011-02-09 01:32 · Score: 1

That bug from 2000 reports an issue in the parsing code but doesn't appear to be a DOS like the one under discussion here.

--
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register

Re:And how soon was the PHP bug fixed again ? by UnknowingFool · 2011-02-09 01:40 · Score: 1

Five days to look into a low level problem and verify it. It is my understanding that low-level issues like this could have a large impact. So more than one person would probably be involved in discussions of the problem and the fix. Then testing. All during the holiday season. All of it done by volunteers. I'd say that was good service.

--
Well, there's spam egg sausage and spam, that's not got much spam in it.

Re:And how soon was the PHP bug fixed again ? by Anarke_Incarnate · 2011-02-09 03:24 · Score: 1

Yes. The thing that distracted them is the lack of "Have." Luckily, they substituted "Of." :P

Re:Cool! by CynicTheHedgehog · 2011-02-09 04:38 · Score: 1

NumberConverter (which uses DecimalFormat.parse) will produce either a Long or a Double (if the value will not fit into a Long). (I was mistaken in an earlier post where I stated that it produces a BigDecimal. You can specify BigDecimal parsing using DecimalFormat.setParseBigDecimal, but this is not the default.) I looked at the source code for DigitFormat on grepcode and it looks like Sun's DecimalFormat implementation parses all the digits in the input string as a DigitList object, which then reconstructs the string before calling Double.parseDouble. The result is that "2.2250738585072012e-308" becomes "2.2250738585072014" before being passed into Double.parseDouble. So if you're using DecimalFormat or, for example, (which is backed by javax.faces.convert.NumberConverter, which uses DecimalFormat) then you should be safe.

Re:About face! by lgw · 2011-02-09 06:50 · Score: 2

Even more irritating are the bugs that dissapear as soon as you try to use a debugger.

We call those Heisenbugs, as obsering them changes the result.

--
Socialism: a lie told by totalitarians and believed by fools.

Re:About face! by gstrickler · 2011-02-09 07:25 · Score: 1

Those are a whole lot of fun in real-time, event driven systems. Slow things down by tracing the code and the problem doesn't occur anymore.

--
make imaginary.friends COUNT=100 VISIBLE=false

Re:An infinite Java loop? Sounds interesting... by gstrickler · 2011-02-09 07:35 · Score: 1

How slow is an infinite loop in Java? Now much memory does it take to execute?

--
make imaginary.friends COUNT=100 VISIBLE=false

Slashdot Mirror

Java Floating Point Bug Can Lock Up Servers

106 of 157 comments (clear)