Java Floating Point Bug Can Lock Up Servers

An anonymous reader writes "Here we go again: Just like the recently-reported PHP Floating Point Bug causes servers to go into infinite loops when parsing certain double-precision floating-point numbers, Sun/Oracle's JVM does it, too. It gets better: you can lock up a thread on most servers just by sending a particular header value. Sun/Oracle has known about the bug for something like 10 years, but it's still not fixed. Java Servlet containers are patching to avoid the problem, but application code will still be vulnerable to user input."

Re:Unless...

[gstrickler]

Aren't Adobe products were simply a collection of bugs, artfully put together to form a useful, but slow and insecure program.

Java, don't need it, don't want it!

[Anonymous Coward]

I now uninstall Java from any systems I work on as a security precaution. The auto-update is a nice 'feature', but in most client's systems I work on, none of them have any compelling reason for an installation of Java.

Over two years and no fix for Java [h-online.com]

"Sami Koivu has released details of a security vulnerability in Java which he reported to Sun in 2008. A quick test using the current version 1.6.0_23 reveals that it remains unpatched "

It is not the JVM ....

[Chrisq]

The article makes it clear that the problem is in FloatingDecimal.java [docjar.com]. It is converting decimal strings to floating point numbers - fp arithmetic is fine!

Re:About face!

[petermgreen]

Yeah bugs that pop up every so often to end users (and are common enough or reported by trusted enough users that they can't just by dismissed as coming from liers/trolls) but only pop up sporadically and/or only pop up on certain systems are a big problem for developers. With no reliable way to reproduce a bug it is almost impossible to fix it.

Even more irritating are the bugs that dissapear as soon as you try to use a debugger.

The firefox memory and CPU usage issues are good examples of this. Way too many users reported them to dismiss them as a lie or fluke but there was no set of steps to reproduce. Every so often one cause was found and squashed but they kept coming up for years and may still be doing so (I still see firefox crash for no apparent reason and it wouldn't surprise me if the cause is running out of address space).