RFR (S) round 0 for 8135195 VM Options file should not be limited to 1024 bytes

[Dmitry Samersoff]

Dan,

As soon as we have a file intended to be read into memory entirely,
DOS is possible.

One of typical situation - file is placed to some shared location and
server that host it report wrong size due a filesystem error or some
other reason.

So on my opinion it's worth to limit the file size to some large enough
value.

-Dmitry


On 2015-09-29 17:05, Daniel D. Daugherty wrote:
> If you have access to the command line, you have complete control
> over the VM.
> 
> Dan
> 
> On 9/29/15 7:56 AM, Dmitry Samersoff wrote:
>> Ron,
>>
>> We probably need to limit vm option file size to some reasonable value
>> (e.g. 10Mb) otherwise it could be used for DOS attack to VM.
>>
>> -Dmitry
>>
>> On 2015-09-29 15:49, Ron Durbin wrote:
>>> Harold
>>>
>>> Good point and the next round will reflect it.
>>> I was under the false impression that os::stat was not supported.
>>> Thanks for the review.
>>>
>>> Ron
>>>
>>>> -----Original Message-----
>>>> From: harold seigel
>>>> Sent: Thursday, September 24, 2015 9:04 AM
>>>> To: hotspot-runtime-dev at openjdk.java.net
>>>> Subject: Re: RFR (S) round 0 for 8135195 VM Options file should not
>>>> be limited to 1024 bytes
>>>>
>>>> Hi Ron,
>>>>
>>>> Could you call os::stat() to get the option file size and then allocate
>>>> buf to that size?
>>>>
>>>> Thanks, Harold
>>>>
>>>> On 9/24/2015 10:52 AM, Daniel D. Daugherty wrote:
>>>>> On 9/24/15 8:44 AM, Daniel D. Daugherty wrote:
>>>>>> On 9/24/15 8:35 AM, Ron Durbin wrote:
>>>>>>> Here is the round 0 webrev for 8135195
>>>>>>>
>>>>>>> Webrev link:
>>>>>>> http://cr.openjdk.java.net/~rdurbin/Webrevs/JDK-8135195/OCR0_JDK9/webrev/
>>>>>>>
>>>>>>>
>>>>>> The above link did not work. I found the webrev here:
>>>>>>
>>>>>> http://cr.openjdk.java.net/~rdurbin/8135195_OCR0_JDK9_webrev/
>>>>> src/share/vm/runtime/arguments.cpp
>>>>>      No comments. Matches the last internal webrev.
>>>>>
>>>>> Thumbs up.
>>>>>
>>>>> What did you and Dmitry decide to do about the new test coverage?
>>>>> I presume Dmitry will have a separate webrev/review cycle and will
>>>>> use a separate bug ID for his test changes.
>>>>>
>>>>> If both are ready at the same time, we can do a single JPRT job
>>>>> with both changesets...
>>>>>
>>>>> Dan
>>>>>
>>>>>
>>>>>> Dan
>>>>>>
>>>>>>> RFE request:
>>>>>>> https://bugs.openjdk.java.net/browse/JDK-8135195
>>>>>>>
>>>>>>> This RFE removes the limitation on the size of VM Options files.
>>>>>>> That limit is currently 1K bytes.
>>>>>>> Removing that limit will allow options files to be read with no
>>>>>>> practical size limit.
>>>>>>>
>>>>>>> This feature has been tested on:
>>>>>>>       OS:
>>>>>>>         Solaris, MAC, Windows, Linux
>>>>>>>       Tests:
>>>>>>>         Manual unit tests
>>>>>>>         JPRT with -testset hotspot (including the SQE proposed test
>>>>>>> coverage for this feature.)
>>
> 


-- 
Dmitry Samersoff
Oracle Java development team, Saint Petersburg, Russia
* I would love to change the world, but they won't give me the sources.