Re: A bug I won't forget
by kevingadd on Monday May 28, 2012 @11:53AM
(#4033868)
So, wait. When you allocate a new array in the JVM, it's filled with random data instead of zeroes? That seems like a fundamental security model error. Or are these 'buffers' special native IO primitives that break all the Java security rules and guidelines? I haven't used Java in a while...
[ Parent
| on HN ]
Re: A bug I won't forget
by paulasmuth on Monday May 28, 2012 @11:57AM
(#4033884)
Heh no, this was the actual bug (that it was reading "random" data from memory on the first iteration). I just hadn't noticed the issue until this "random memory" contained fragments of invalid json.
Could you elaborate on this? If the random data isn't caused by the JVM not filling a buffer with zeros (which I'm sure it does) how is the data actually leaking? Do you share byte[] arrays between threads or recycle them once a thread dies?
Were you or the network library reusing buffer objects (to avoid reallocating them), so the random data was leftover from an early socket read? I'm surprised the JVM would allocate a new buffer object with non-zero data.
Yeah, he was almost certainly reusing his byte[]s. My takeaway is that if you program a high-level language as if it's C, expect C-like bugs.
Likely reusing his directly allocated ByteBuffer and not checking the number of bytes that he filled it with.
From what I remember, directly allocated ByteBuffers are not guaranteed to be zeroed.
Re: A bug I won't forget
by cynicalkane on Monday May 28, 2012 @05:07PM
(#4034928)
JVM objects are always zero-allocated, but Java libraries typically don't make any guarantees about memory that sits outside the JVM heap, which is probably where the socket was reading from.
By default, the JVM initialises arrays as appropriate for their type. Presumably this was an array of String, so the initialisation values are nulls, not zeros. Arrays of boolean are initialised to false, etc.
We don't know anything about it, because the blog post is slightly meager..
That said, this reads more like a byte[] array or similar to me, since you are reading data from the net/a stream. Somewhere there will be a process to interpret these bytes as a string in a specific encoding, but the error 'sounds' like being related to the raw buffer of power of 2 size bytes.