12 ms·
Java Hangs When Converting 2.2250738585072012e-308
- wildmXranat 16y agoIn that case, this still applies: http://zenebo.com/cmc/1/ http://zenebo.com/cmc/1/
- latch 16y agoThe compiler one is pretty neat. Hung IntelliJ. Didn't hang VS.NET. Had both open, had to try.
- leppie 16y agoJust to confirm .NET/C# handles this and correctly. So does IronScheme.
- Torn 16y agoWhy would a Java / JVM issue hang the .NET CLR?
- dagw 16y agoBecause by all accounts this isn't a Java/JVM issue. It's a flaw in a commonly used algorithm for handling floating point numbers. Given that php and possibly gcc use variations on the same algorithm, and have the same flaw, it's not unreasonable to think that other languages/compilers/runtimes would also be affected.
- Torn 16y agoThanks for the clarification.
- DrJokepu 16y agoI guess because only a couple of weeks ago a similar issue has surfaced in PHP so it is not entirely unreasonable to check whether other runtimes have similar problems?
- giu 16y agoAs the article "The PHP strtod() denial of service bug" (http://blog.andreas.org/display?id=9 http://blog.andreas.org/display?id=9 ; linked by pilif in another comment) states, it looks like the code for the conversion is used in a few prominent libraries (e.g. Apple's libc, Android libc, GCC libio etc.). Therefore, it could've been quite possible that the mentioned code has been adopted by Microsoft, too; leppie just confirmed that everything works fine over there.
- leppie 16y agoYou obviously did not read the Moonlight vs IcedTea issue in Chrome article yesterday ;)
- Stasyan 16y agoF# is fine as well
- lukesandberg 16y agoThis hangs eclipse 3.5.2 when saving the code :)
- sjs 16y agoUgh, not only that but it hosed my workspace :/ Don't try this in a project you're currently working on. Now I have to spend my morning trying to unfuck my project.
- abscondment 16y agoThe compile-time version will hang a Clojure REPL, too: user=> (def d 2.2250738585072012e-308)
- Jach 16y agoTried it in Jython too, of course it fails. I'd have been more surprised if it worked, but it's still amusing and had to see it.
- paulitex 16y agomakes sense, same thing in scala: Welcome to Scala version 2.8.1.final (Java HotSpot(TM) 64-Bit Server VM, Java 1.6.0_22). Type in expressions to have them evaluated. Type :help for more information. scala> 2.2250738585072012e-308 (infinite loop)
- rll 16y agoI have a feeling we will see this come up in more places. When we fixed the code for PHP we saw very similar code in a lot of other projects.
- wladimir 16y agoYes, every project should check its strtod function. If it has a potentially infinite loop, be very worried :)
- pilif 16y agoI remember when everyone was bashing PHP (http://news.ycombinator.com/item?id=2066084 http://news.ycombinator.com/item?id=2066084) when they were bitten by the same issue. Then there were articles about this being maybe a GCC bug or at least design issue but people were still saying that it's PHP's duty to take care of this. I was always afraid that this might bite other environments too as the code that caused the issue in PHP was apparently taken from elsewhere (see http://blog.andreas.org/display?id=9 http://blog.andreas.org/display?id=9 for a detailed analysis of the problem). Now this is turning out to be true.
- SingAlong 16y agoRasmus just tweeted about it: Java's turn to deal with the x87 register issue. Here's a hint Oracle, "volatile" http://twitter.com/rasmus/status/32365768603602944 http://twitter.com/rasmus/status/32365768603602944
- eonwe 16y agoRasmussen's hint would work were the number parsing in Oracle's JDK implemented in in C. Volatile keyword in Java does not guarantee writing to memory and reading it back (http://java.sun.com/docs/books/jls/third_edition/html/classes.html#36930 http://java.sun.com/docs/books/jls/third_edition/html/classe...), but using strictfp as a modifier to the method should cause the usage of strict IEEE 64-bit floating point.
- rll 16y agoWell, the underlying JVM is written in C (C++ actually) along with a bunch of assembly. I figured this needs to be fixed at the JVM level and as such the fix might very well be a single "volatile" addition like it was for PHP.
- eonwe 16y agoYeah, the JVM is written in C++ but the problem is in Oracle's JDK written in Java. More specifically, line 1596 in FloatingDecimal.java (http://www.docjar.com/html/api/sun/misc/FloatingDecimal.java.html#1591 http://www.docjar.com/html/api/sun/misc/FloatingDecimal.java...) is the only place in the correctionLoop that can cause infinite looping. I do not purport to understand what the ulp-function does but clearly it does produce the denormal number we would want. The interesting value here (dValue) is double but the method is without strictfp-qualifier and thus allowed to use not-quite IEEE-754 doubles. Were the problem at JVM level, I would think that many numeric libraries written in Java would not work either and the problem would've been spotted earlier. Edit: Thought Markdown syntax for links was in use here.
- praptak 16y ago"Konstantin reported this problem to Oracle three weeks ago, but is still waiting for a reply." This speaks volumes about Oracle as the Java's steward.
- mavroprovato 16y agoSun wasn't much better in this regard
- andrew1 16y agoSo they're not falling over themselves to fix a bug which no one has noticed for 10+ years, and which hardly anyone is going to hit in actual use. Maybe they're spending their time fixing problems which are actually affecting developers.
- mhansen 16y agoAny public-facing Java server affected by this bug that accepts floating point numbers from the user as a string can be hung by this bug. This is going to be a big problem.
- stevie_wilks 16y agoExcellent point. I'm going to have some tests to run when I get in to work this morning.
- VMG 16y agoI tried to dig up a list of websites with a java-backend but my google-fu is not strong enough. I don't think that there are actually many big sites running on java.
- al05 16y agoThere are tons of sites running on java. Possibly more than php.
- 16y ago
- deleted 16y ago[deleted]
- r0h4n 16y agoDoesnt hang Ruby 1.9 (MRI) and python 2.7 and python 3.1
- speleding 16y agoRuby 1.8.7 appears to be fine too
- rll 16y agoThis particular value is specific to the Java implementation. Ruby has very similar code to PHP though, so a slight variation of the value may trigger it. You also have to be on a platform that actually has an x87, of course.
- cygwin98 16y agoRuby 1.9.2 handled it well here
- deleted 16y ago[deleted]
- Uchikoma 16y agoI assume this hits Clojure, JRuby, etc. harder because it affects all values which are converted to Strings, but only affects Java when one explicitly converts to Double? So when a (Java) website expects an Int as input, it's not affected, but Clojure,JRuby etc would be? Am I right, what am I missing? (see the comment with user=> (def d 2.2250738585072012e-308) )
- deleted 16y ago[deleted]
- mjw 16y agoOuch. This affects JRuby, and potentially anyone with a JSON-based API running on the JVM with a JSON parser using the java stdlib to parse JSON floats: jruby-1.5.2 > JSON.parse('{"float": 2.2250738585072012e-308}') ^C^C^C^C^C^C ^C^C^C (not the most recent JRuby I know, but seems this is a JVM problem...)
- ibejoeb 16y agoFWIW the Oracle/BEA jrockit compiler does not hang. It does hang on execution, however. Java(TM) SE Runtime Environment (build 1.6.0_20-b02) Oracle JRockit(R) (build R28.0.1-21-133393-1.6.0_20-20100512-2126-linux-ia32, compiled mode)
- VMG 16y agoLink to actual code: http://google.com/codesearch/p?hl=en#lM3pwaU8RUc/src/share/classes/sun/misc/FloatingDecimal.java&q=parseDouble&l=1476 http://google.com/codesearch/p?hl=en#lM3pwaU8RUc/src/share/c...
- VMG 16y agoWhat about android?
- dfox 16y agoAndroid is not i386 based and this is x87 FPU and gcc specific bug in commonly used atod() implementation, so I assume that this does not happen on Android.
- VMG 16y agoThe bug is in the JDK code running on a JVM (I posted a link to the source). Also runhang.java hangs on my 64bit java vm.
- snewman 16y agoIf I'm not mistaken, this is bad: it enables a trivial DOS attack against any web service that accepts floating-point input. (For instance, one of the commenters on the OP noted that Google Spreadsheets backends are vulnerable.) This includes, as a special case, any service that accepts JSON input. I expect a lot of teams will have to rush out a patch. I feel for them... Incidentally, I haven't seen a simple workaround posted anywhere. Has anyone seen a regexp or code snippet that can identify strings which would trigger this bug?
- djacobs 16y agoMaybe I'm dense, but why does this affect apps that use JSON?
- snewman 16y agoBecause JSON can include floating-point numbers. If you pass { foo: 2.2250738585072012e-308 } to any JSON service, I'd expect it to invoke Double.parseDouble(...) as part of its input processing, and trip over the bug. This would probably occur before any type checking of the input, and thus would probably work even for a service which does not expect floating-point inputs.
- djacobs 16y agoSo the exact same bug affects Javascript?
- eru 16y agoJSON just makes it quite easy to parse in a floating point number. But that doesn't have anything to do with Javascript per-se.
- woogley 16y agoThis is not correct. Think about a service which used PHP's json_decode function. PHP has fixed this bug, so there would be no issue. The problem has nothing to do with JSON. It only affects JSON parsers that run on a JVM.
- joeyh 16y agoSo, in summary, we've made counting on computers so complex that we're still failing to get it right. Similarly to how we've made the alphabet (unicode) on computers so complex that most programs are still trying to get that right.
- russell 16y agoThis seems to be a not rare occurrence around the phase boundaries of functions. I had a similar problem with the atan2 function in the PL/I - Fortran library on the CDC 6600. One of my testers was stepping across the boundary between valid and invalid arguments and there was a single binary value that blew up. I was the compiler lead so it got fixed. Any of you remember the 486 floating point problem?
- tytso 16y agoObvious question --- are there any java web services running at Oracle that take a string input from a form or a URL, and tries to convert said stirng to a floating point variable?
- jd0g 16y agoI cannot recreate this using Spring TC (http://www.springsource.com/products/tcserver http://www.springsource.com/products/tcserver) server.