Java Hangs When Converting 2.2250738585072012e-308

http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/

by pietrofmaggi • 15 years ago

180 66 15 years ago

exploringbinary.com

latch• 15 years ago

The compiler one is pretty neat. Hung IntelliJ. Didn't hang VS.NET. Had both open, had to try.

leppie2• 15 years ago

Just to confirm .NET/C# handles this and correctly. So does IronScheme.

Torn2• 15 years ago

Why would a Java / JVM issue hang the .NET CLR?

Stasyan• 15 years ago

F# is fine as well

lukesandberg• 15 years ago

This hangs eclipse 3.5.2 when saving the code :)

sjs• 15 years ago

Ugh, not only that but it hosed my workspace :/

Don't try this in a project you're currently working on. Now I have to spend my morning trying to unfuck my project.

abscondment• 15 years ago

The compile-time version will hang a Clojure REPL, too:

user=> (def d 2.2250738585072012e-308)

Jach• 15 years ago

Tried it in Jython too, of course it fails. I'd have been more surprised if it worked, but it's still amusing and had to see it.

paulitex• 15 years ago

makes sense, same thing in scala:

Welcome to Scala version 2.8.1.final (Java HotSpot(TM) 64-Bit Server VM, Java 1.6.0_22). Type in expressions to have them evaluated. Type :help for more information.

scala> 2.2250738585072012e-308

(infinite loop)

rll4• 15 years ago

I have a feeling we will see this come up in more places. When we fixed the code for PHP we saw very similar code in a lot of other projects.

wladimir• 15 years ago

Yes, every project should check its strtod function. If it has a potentially infinite loop, be very worried :)

pilif2• 15 years ago

I remember when everyone was bashing PHP (http://news.ycombinator.com/item?id=2066084) when they were bitten by the same issue. Then there were articles about this being maybe a GCC bug or at least design issue but people were still saying that it's PHP's duty to take care of this.

I was always afraid that this might bite other environments too as the code that caused the issue in PHP was apparently taken from elsewhere (see http://blog.andreas.org/display?id=9 for a detailed analysis of the problem). Now this is turning out to be true.

SingAlong• 15 years ago

Rasmus just tweeted about it:

Java's turn to deal with the x87 register issue. Here's a hint Oracle, "volatile"

http://twitter.com/rasmus/status/32365768603602944

eonwe2• 15 years ago

Rasmussen's hint would work were the number parsing in Oracle's JDK implemented in in C.

Volatile keyword in Java does not guarantee writing to memory and reading it back (http://java.sun.com/docs/books/jls/third_edition/html/classe...), but using strictfp as a modifier to the method should cause the usage of strict IEEE 64-bit floating point.

Uchikoma2• 15 years ago

Yes, astonishing how Oracle (and others) didn't check their code when this surfaced in PHP to determine if they are affected too.

gaius• 15 years ago

Yet not astonishing how the GCC team didn't fix it once, for everyone?

PS I am pretty sure Oracle, at least on Sun, used SPARCworks compiler, not GCC, from linking C++ against their libs.

praptak• 15 years ago

"Konstantin reported this problem to Oracle three weeks ago, but is still waiting for a reply."

This speaks volumes about Oracle as the Java's steward.

mavroprovato• 15 years ago

Sun wasn't much better in this regard

andrew1• 15 years ago

So they're not falling over themselves to fix a bug which no one has noticed for 10+ years, and which hardly anyone is going to hit in actual use. Maybe they're spending their time fixing problems which are actually affecting developers.

mhansen• 15 years ago

Any public-facing Java server affected by this bug that accepts floating point numbers from the user as a string can be hung by this bug.

This is going to be a big problem.

nikster• 15 years ago

I just reported a problem last week and got a response inside 12 hours. I was amazed. Certainly faster than I've ever gotten a response from Sun.

Average over the last 3 issues is about 48 hours - if accepted as a bug. But if you provide source code that demonstrates the problem turnaround is usually very fast, and that seems to be the case here.

r0h4n• 15 years ago

Doesnt hang Ruby 1.9 (MRI) and python 2.7 and python 3.1

speleding• 15 years ago

Ruby 1.8.7 appears to be fine too

rll4• 15 years ago

This particular value is specific to the Java implementation. Ruby has very similar code to PHP though, so a slight variation of the value may trigger it. You also have to be on a platform that actually has an x87, of course.

cygwin98• 15 years ago

Ruby 1.9.2 handled it well here

Uchikoma2• 15 years ago

I assume this hits Clojure, JRuby, etc. harder because it affects all values which are converted to Strings, but only affects Java when one explicitly converts to Double?

So when a (Java) website expects an Int as input, it's not affected, but Clojure,JRuby etc would be?

Am I right, what am I missing?

(see the comment with

user=> (def d 2.2250738585072012e-308)

)

mjw• 15 years ago

Ouch.

This affects JRuby, and potentially anyone with a JSON-based API running on the JVM with a JSON parser using the java stdlib to parse JSON floats:

    jruby-1.5.2 > JSON.parse('{"float": 2.2250738585072012e-308}')  
    ^C^C^C^C^C^C
    ^C^C^C

(not the most recent JRuby I know, but seems this is a JVM problem...)

ibejoeb• 15 years ago

FWIW the Oracle/BEA jrockit compiler does not hang. It does hang on execution, however.

   Java(TM) SE Runtime Environment (build 1.6.0_20-b02)
   Oracle JRockit(R) (build R28.0.1-21-133393-1.6.0_20-20100512-2126-linux-ia32, compiled mode)

VMG4• 15 years ago

Link to actual code: http://google.com/codesearch/p?hl=en#lM3pwaU8RUc/src/share/c...

VMG4• 15 years ago

What about android?

dfox• 15 years ago

Android is not i386 based and this is x87 FPU and gcc specific bug in commonly used atod() implementation, so I assume that this does not happen on Android.

VMG4• 15 years ago

The bug is in the JDK code running on a JVM (I posted a link to the source). Also runhang.java hangs on my 64bit java vm.

wildmXranat• 15 years ago

In that case, this still applies: http://zenebo.com/cmc/1/

snewman3• 15 years ago

If I'm not mistaken, this is bad: it enables a trivial DOS attack against any web service that accepts floating-point input. (For instance, one of the commenters on the OP noted that Google Spreadsheets backends are vulnerable.) This includes, as a special case, any service that accepts JSON input.

I expect a lot of teams will have to rush out a patch. I feel for them...

Incidentally, I haven't seen a simple workaround posted anywhere. Has anyone seen a regexp or code snippet that can identify strings which would trigger this bug?

djacobs2• 15 years ago

Maybe I'm dense, but why does this affect apps that use JSON?

snewman3• 15 years ago

Because JSON can include floating-point numbers. If you pass { foo: 2.2250738585072012e-308 } to any JSON service, I'd expect it to invoke Double.parseDouble(...) as part of its input processing, and trip over the bug. This would probably occur before any type checking of the input, and thus would probably work even for a service which does not expect floating-point inputs.

joeyh• 15 years ago

So, in summary, we've made counting on computers so complex that we're still failing to get it right. Similarly to how we've made the alphabet (unicode) on computers so complex that most programs are still trying to get that right.

russell• 15 years ago

This seems to be a not rare occurrence around the phase boundaries of functions. I had a similar problem with the atan2 function in the PL/I - Fortran library on the CDC 6600. One of my testers was stepping across the boundary between valid and invalid arguments and there was a single binary value that blew up. I was the compiler lead so it got fixed. Any of you remember the 486 floating point problem?

tytso• 15 years ago

Obvious question --- are there any java web services running at Oracle that take a string input from a form or a URL, and tries to convert said stirng to a floating point variable?

jd0g• 15 years ago

I cannot recreate this using Spring TC (http://www.springsource.com/products/tcserver) server.

Java Hangs When Converting 2.2250738585072012e-308

Related Stories