<<  >> (p.20)
    Author Topic: Nxt source code flaw reports  (Read 113427 times)
    ricot
    Newbie
    *
    Offline Offline

    Activity: 56
    Merit: 0


    View Profile
    January 05, 2014, 10:49:12 AM
     #381

    Obviously: Before typing this post, I tried the latter method on my local 0.5.0 client and it didn't work. So I guess this has been fixed by now.

    Published version is also immune to this attack coz out-of-memory is caught by try-catch.

    Huh OutOfMemoryError isn't a catchable exception because the memory of the VM has been compromised!
    (Hence the name Error, not Exception Wink)

    Also see the following little test code to verify:
    Code:
    public class Test {
      public static void main(String[] args) {
        try{
          long[] l = new long[Integer.parseInt(args[0])];
        }catch(Exception e){
          System.out.println("foo");
        }
        System.out.println("bar");
      }
    }

    If started with INT_MAX as a parameter, it shows a java heap space JVM exception and neither "foo" nor "bar".

    U r right. Good catch.

    If you guys think, that a catch(Exception e) safes you from those kind of things... I'm speechless.

    Fixed.

    Btw: I just realized my mistake from yesterday and I'm now able to crash the Thread that gets created for my request with an OutOfMemory error. Since jetty starts a new Thread for every request, it doesn't take down the machine, but remotely killing Threads is at least quite funny. Wink Btw: Yes, that also works in 0.5.0
Page 19
Viewing Page: 20