4 ms·

What I think is amazing is the fact that there's a bug from November of 2009 (http://bugs.openjdk.java.net/show_bug.cgi?id=100119 http://bugs.openjdk.java.net/s

by pilif 16y ago

What I think is amazing is the fact that there's a bug from November of 2009 (http://bugs.openjdk.java.net/show_bug.cgi?id=100119 http://bugs.openjdk.java.net/show_bug.cgi?id=100119) that's first reporting the issue. So there was a known denial of service vulnerability in Java for more than a year before people recognized it as that and actually started bothering to fix it.

lysium 16y ago
Interestingly, it mentions that a whole range of double strings is affected, not only a single number. I don't know how many floating points can actually be represented in that range, though. Might be only one.
- pietrofmaggi 16y ago
  More than one, in the post that highlighted the problem (here the HN thread: http://news.ycombinator.com/item?id=2164863 http://news.ycombinator.com/item?id=2164863) these were pointed out: 0.00022250738585072012e-304 (decimal point placement) 00000000002.2250738585072012e-308 (leading zeros) 2.225073858507201200000e-308 (trailing zeros) 2.2250738585072012e-00308 (leading zeros in the exponent) 2.2250738585072012997800001e-308 (superfluous digits beyond digit 17)
wnoise 16y ago
Problems with it date back to 2001, actually: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 (Ergh, except fucking Oracle broke that. But http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 also shows the boundary case not quite doing the right thing.)
- pasbesoin 16y ago
  Your second link is dead now, too. EDIT: Now it's come up, upon retrying after some minutes.
barrkel 16y ago
It's much older than that - nearly 10 years: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 Seems down now, so details: Bug ID: 4421494 Votes 1 Synopsis infinite loop while parsing double literal Category java:classes_lang Reported Against 1.3 , 1.4.1 Release Fixed State 5-Cause Known, bug Priority: 4-Low Related Bugs 4396272 , 4749698 , 4887667 , 6876342 Submit Date 04-MAR-2001

by pilif 16y ago

lysium 16y ago

Interestingly, it mentions that a whole range of double strings is affected, not only a single number. I don't know how many floating points can actually be represented in that range, though. Might be only one.

pietrofmaggi 16y ago
More than one, in the post that highlighted the problem (here the HN thread: http://news.ycombinator.com/item?id=2164863 http://news.ycombinator.com/item?id=2164863) these were pointed out: 0.00022250738585072012e-304 (decimal point placement) 00000000002.2250738585072012e-308 (leading zeros) 2.225073858507201200000e-308 (trailing zeros) 2.2250738585072012e-00308 (leading zeros in the exponent) 2.2250738585072012997800001e-308 (superfluous digits beyond digit 17)

wnoise 16y ago

Problems with it date back to 2001, actually: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 (Ergh, except fucking Oracle broke that. But http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4396272 also shows the boundary case not quite doing the right thing.)

pasbesoin 16y ago
Your second link is dead now, too. EDIT: Now it's come up, upon retrying after some minutes.

barrkel 16y ago

It's much older than that - nearly 10 years: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4421494 Seems down now, so details: Bug ID: 4421494 Votes 1 Synopsis infinite loop while parsing double literal Category java:classes_lang Reported Against 1.3 , 1.4.1 Release Fixed State 5-Cause Known, bug Priority: 4-Low Related Bugs 4396272 , 4749698 , 4887667 , 6876342 Submit Date 04-MAR-2001