Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IDIV DoS (INT_MIN / -1)

kqueue.org

Post reply on HN
Print view View original

1–10 of 24 posts

Re: IDIV DoS (INT_MIN / -1)

#3

Post by ctz »

0x0 wrote: post #2

Reminds me about that fairly recent strtod() infinite loop that caused DoS in several languages. http://www.exploringbinary.com/why-volatile-fixes-the-2-2250...

Did it affect any languages other than PHP? The linked article suggests that it was PHP only (and this agrees with zend_strtod being the problem function and not any C library implementation of strtod(3)).

Re: IDIV DoS (INT_MIN / -1)

#4

Post by endianswap »

ctz wrote: post #3
0x0 wrote: post #2

Reminds me about that fairly recent strtod() infinite loop that caused DoS in several languages. http://www.exploringbinary.com/why-volatile-fixes-the-2-2250...

Did it affect any languages other than PHP? The linked article suggests that it was PHP only (and this agrees with zend_strtod being the problem function and not any C library implementation of strtod(3)).

I believe Java did as well.

Re: IDIV DoS (INT_MIN / -1)

#5

Post by jdlshore »

ctz wrote: post #3
0x0 wrote: post #2

Reminds me about that fairly recent strtod() infinite loop that caused DoS in several languages. http://www.exploringbinary.com/why-volatile-fixes-the-2-2250...

Did it affect any languages other than PHP? The linked article suggests that it was PHP only (and this agrees with zend_strtod being the problem function and not any C library implementation of strtod(3)).

It affected Java too. I don't remember if it affected all versions of Java or not, but I reproduced (and fixed) it in my Let's Play TDD screencast series. Here's the episode: http://www.jamesshore.com/Blog/Lets-Play/Episode-89.html The "double of death" part starts at 3:33.

Re: IDIV DoS (INT_MIN / -1)

#6

Post by makomk »

If anyone here has used Second Life's scripting language LSL, they had to work around this issue. Apparently they now calculate x / -1 as -x instead, which gets a counter-intuitive result when x=INT_MIN but doesn't crash. I believe once upon a time this was documented and everything.

Re: IDIV DoS (INT_MIN / -1)

#8

Post by 0x0 »

ctz wrote: post #3
0x0 wrote: post #2

Reminds me about that fairly recent strtod() infinite loop that caused DoS in several languages. http://www.exploringbinary.com/why-volatile-fixes-the-2-2250...

Did it affect any languages other than PHP? The linked article suggests that it was PHP only (and this agrees with zend_strtod being the problem function and not any C library implementation of strtod(3)).

It affected a whole bunch of languages, libraries and compilers, apparently because the strtod() implementation in question has been a popular copy&paste piece.

This guy here over at http://blog.andreas.org/display?id=9 mentions at least: "Android libc, gcc libio, gcc java runtime, newlib libc, GNU Mono, Apple's libc, mozilla"

It was particularly nasty because it could easily be exploited simply by putting that specific decimal number into a web form or whatever, and for each request a thread on the backend server would lock a CPU to 100% usage until sysadmins discover and kill those threads, worst case.

Re: IDIV DoS (INT_MIN / -1)

#10

Post by kevinnk »

huhsamovar wrote: post #9

I just tried the C version and it compiles and exits gracefully with gcc 4.2.1.

The example the article gives isn't a general C problem, it's a common bug in some (mostly older) C/C++ compilers. As you point out GCC does not have this bug.
Post reply on HN