3 ms·
Well , Java itself is implemented in some lower level language so the JVM can potentially have heap/stack overflows of it's own. Java does make it harder for t
by jiggy2011 14y ago
Well , Java itself is implemented in some lower level language so the JVM can potentially have heap/stack overflows of it's own.
Java does make it harder for the end user programmer to add these sorts of vulns to their own code though.
- pjmlp 14y agoNot really, unless you are speaking about Oracle's JVM.
- jiggy2011 14y agohow so?
- pjmlp 14y agoThere are many implementations of the Java programming language. Interpreters, JIT VMs and native code compilers. Most developers are only familiar with the official VM you can download from Oracle, which uses a JIT for code execution. This one is a mix of C, C++ and Java code. However alone from Oracle (previously Sun) there is a VM implemented in Java (Maxime), a VM only with C bindings for hardware access with everything else done Java (Squawk), the C++ code for Hotspot might be replaced with Java (maybe around Java 9 timeframe, project Graal) and the embedded edition of Java also supports native compilation. The Jikes RVM, like Maxime, is a meta-circular VM fully implemented in Java. Additionally there are native compilers like JET Excelsior. Despite what people think Java != VM. It is only a question of bootstrapping.
- jiggy2011 14y agoSure, but my point is that any bugs in the low level code (which must be present somewhere until we have CPUs that can natively understand bytecode) can bubble up the stack.
- pjmlp 14y agoSure, but that is assuming you produce bytecode at all. But you're right a program is only safe if the full stack is safe.