4 ms·

A Closer Look at the Java 2.2250738585072012e-308 Bug

58 points by pietrofmaggi 16y ago

pilif 16y ago
What I think is amazing is the fact that there's a bug from November of 2009 (http://bugs.openjdk.java.net/show_bug.cgi?id=100119 http://bugs.openjdk.java.net/show_bug.cgi?id=100119) that's first reporting the issue. So there was a known denial of service vulnerability in Java for more than a year before people recognized it as that and actually started bothering to fix it.
- lysium 16y ago
  Interestingly, it mentions that a whole range of double strings is affected, not only a single number. I don't know how many floating points can actually be represented in that range, though. Might be only one.
  - pietrofmaggi 16y ago
    More than one, in the post that highlighted the problem (here the HN thread: http://news.ycombinator.com/item?id=2164863 http://news.ycombinator.com/item?id=2164863) these were pointed out: 0.00022250738585072012e-304 (decimal point placement) 00000000002.2250738585072012e-308 (leading zeros) 2.225073858507201200000e-308 (trailing zeros) 2.2250738585072012e-00308 (leading zeros in the exponent) 2.2250738585072012997800001e-308 (superfluous digits beyond digit 17)
- wnoise 16y ago
  Problems with it date back to 2001, actually: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 (Ergh, except fucking Oracle broke that. But http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 also shows the boundary case not quite doing the right thing.)
  - pasbesoin 16y ago
    Your second link is dead now, too. EDIT: Now it's come up, upon retrying after some minutes.
- barrkel 16y ago
  It's much older than that - nearly 10 years: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 Seems down now, so details: Bug ID: 4421494 Votes 1 Synopsis infinite loop while parsing double literal Category java:classes_lang Reported Against 1.3 , 1.4.1 Release Fixed State 5-Cause Known, bug Priority: 4-Low Related Bugs 4396272 , 4749698 , 4887667 , 6876342 Submit Date 04-MAR-2001
adaml_623 16y ago
I thought this was a side effect from a GCC bug when it affected PHP. So does Java use the same algorithm for generating machine code at it's lowest level?
- pietrofmaggi 16y ago
  No, It's a different problem, as stated in the article: "Java’s decimal to floating-point conversion routine is java code, although obviously modeled on David Gay’s C code. Apparently, it was changed just enough to avoid the x87 error — but it introduced a new error."
- JoachimSchipper 16y ago
  Well, a GCC "bug" - IIRC gcc used the i386 floating-point hardware, which is 80 bits wide (whereas PHP was expecting 64-bit doubles). GCC is arguably correct by preferring the wider type - people should just learn that == and floating point don't match.
fedd 16y ago
so when/how would the fix get into some java update?
joubert 16y ago
Good analysis. I sure hope a unit test will be added to the Java code base to cover this boundary case.
stalar 16y ago
Fix is available. See: http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html http://blogs.oracle.com/security/2011/02/security_alert_for_... and http://www.oracle.com/technetwork/java/javase/downloads/index.html#fpupdater http://www.oracle.com/technetwork/java/javase/downloads/inde...

58 points by pietrofmaggi 16y ago

pilif 16y ago

What I think is amazing is the fact that there's a bug from November of 2009 (http://bugs.openjdk.java.net/show_bug.cgi?id=100119 http://bugs.openjdk.java.net/show_bug.cgi?id=100119) that's first reporting the issue. So there was a known denial of service vulnerability in Java for more than a year before people recognized it as that and actually started bothering to fix it.

lysium 16y ago
Interestingly, it mentions that a whole range of double strings is affected, not only a single number. I don't know how many floating points can actually be represented in that range, though. Might be only one.
- pietrofmaggi 16y ago
  More than one, in the post that highlighted the problem (here the HN thread: http://news.ycombinator.com/item?id=2164863 http://news.ycombinator.com/item?id=2164863) these were pointed out: 0.00022250738585072012e-304 (decimal point placement) 00000000002.2250738585072012e-308 (leading zeros) 2.225073858507201200000e-308 (trailing zeros) 2.2250738585072012e-00308 (leading zeros in the exponent) 2.2250738585072012997800001e-308 (superfluous digits beyond digit 17)
wnoise 16y ago
Problems with it date back to 2001, actually: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 (Ergh, except fucking Oracle broke that. But http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 also shows the boundary case not quite doing the right thing.)
- pasbesoin 16y ago
  Your second link is dead now, too. EDIT: Now it's come up, upon retrying after some minutes.
barrkel 16y ago
It's much older than that - nearly 10 years: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 Seems down now, so details: Bug ID: 4421494 Votes 1 Synopsis infinite loop while parsing double literal Category java:classes_lang Reported Against 1.3 , 1.4.1 Release Fixed State 5-Cause Known, bug Priority: 4-Low Related Bugs 4396272 , 4749698 , 4887667 , 6876342 Submit Date 04-MAR-2001

adaml_623 16y ago

I thought this was a side effect from a GCC bug when it affected PHP. So does Java use the same algorithm for generating machine code at it's lowest level?

pietrofmaggi 16y ago
No, It's a different problem, as stated in the article: "Java’s decimal to floating-point conversion routine is java code, although obviously modeled on David Gay’s C code. Apparently, it was changed just enough to avoid the x87 error — but it introduced a new error."
JoachimSchipper 16y ago
Well, a GCC "bug" - IIRC gcc used the i386 floating-point hardware, which is 80 bits wide (whereas PHP was expecting 64-bit doubles). GCC is arguably correct by preferring the wider type - people should just learn that == and floating point don't match.

fedd 16y ago

so when/how would the fix get into some java update?

joubert 16y ago

Good analysis. I sure hope a unit test will be added to the Java code base to cover this boundary case.

stalar 16y ago

Fix is available. See: http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html http://blogs.oracle.com/security/2011/02/security_alert_for_... and http://www.oracle.com/technetwork/java/javase/downloads/index.html#fpupdater http://www.oracle.com/technetwork/java/javase/downloads/inde...