Creating Dangling Pointers in Java

Overview

Since Java uses a Garbage Collector it is not possoble to create a dangling reference in pure Java See here for more details However using the Java Library it is possible to create a dangling pointer if you go out of your way to create one. You still cannot create one by accident AFAIK.

Creating a dangling pointer deliberately

A DirectByteBuffer has the address to a direct area of memory. In C terminology this could be called a pointer. This area of memory is not managed by the GC and must be explicity freed. The DirectByteBuffer manages the creation and cleanup for you so that when the DirectByteBuffer's Cleaner/Deallocator is GC'ed, the memory is freed. This means that indirectly the area of memory is freed when it is no longer used, however it is not directly managed meaning you can pervert this process and create a dangling references like so

ByteBuffer bb1 = ByteBuffer.allocateDirect(4096);
ByteBuffer bb2 = ByteBuffer.allocateDirect(4096);
useReflectionsToCopyTheAddressFieldFrom(bb1, /* to */ bb2);
// now both byte buffers use the same address.
bb1.put(0, 5);
assert bb2.get(0) == 5;
// clean up bb1
bb1= null;
System.gc(); // etc.
// bb1 is gone and so is its memory, but bb2 lives on.

bb2.get(0); // can return 5 or kill the JVM.

Comments

  1. Min9 March 2011 at 15:44

    I don't think the JVM allows mapped byte buffers to ever be garbage collected for security reasons. And GC only frees Java objects (heap memory), not things like this that live off the heap.

    ReplyDelete
  2. Unknown10 March 2011 at 09:11

    Articles are created to express different body of knowledge. That is why I admire writers who are passionate of doing such incredible job. By the way, I like you post for it is specifically talk about current issues and technicalities in life. I look forward for your subsequent post.I look forward for your next article.Thanks Marks Liferay Blog

    ReplyDelete
  3. Peter Lawrey10 March 2011 at 15:33

    @Min, these direct byte buffers are freed when the GC removes the Cleaner associated with it.

    When a mapped ByteBuffer is cleaned up the area is un mapped using FileChannelImpl.Unmapper.

    The fact the GC doesn't clean up the direct memory area is part of my point. It only causes the memory to be freed when it Cleaner collected, however you cna retain a reference to a "freed" area of memory if you mess with its internals.

    ReplyDelete

Post a Comment

Popular posts from this blog

Java is Very Fast, If You Don’t Create Many Objects

Image
  You still have to watch how many objects you create. This article looks at a benchmark passing events over TCP/IP at 4 billion events per minute using the net.openhft.chronicle.wire.channel package in Chronicle Wire and why we still avoid object allocations..  One of the key optimisations is creating almost no garbage. Allocation is a very cheap operation and collection of very short-lived objects is also very cheap. Does this really make a difference? What difference does one small object per event (44 bytes) make to the performance in a throughput test where GC pauses are amortised? While allocation is as efficient as possible, it doesn’t avoid the memory pressure on the L1/L2 caches of your CPUs and when many cores are busy, they are contending for memory in the shared L3 cache.  Results Benchmark on a Ryzen 5950X with Ubuntu 22.10. JVM Vendor, Version No objects Throughput, Average Latency* One object per event Throughput, Average Latency* Azul Zulu 1.8.0_322 60.6 ...
Read more

System wide unique nanosecond timestamps

A Unique Identifier can be very useful for tracing. Those ids are even more useful when they contain a high-resolution timestamp.  Not only do they record the time of an event, but if unique can help trace events as they pass through the system. Such unique timestamps however can be expensive depending on how they are implemented.   This post explores a lightweight means of producing a unique, monotonically increasing system-wide nano-second resolution timestamp available in our open-source library. Uses for Unique Identifiers Unique identifiers can be useful to associate with a piece of information so that information can be referred to later unambiguously. This could be an event, a request, an order id, or a customer id. They can naturally be used as a primary key in a database or key/value store to retrieve that information later. One of the challenges of generating these identifiers is avoiding creating duplicates while not having an increasing cost.  You could ...
Read more

What does Chronicle Software do?

Image
Overview Chronicle Software is about simplifying fast data.  It is a suite of libraries to make it easier to write, monitor and tune data processing systems where performance and scalability are concerned. But its free, how do you make money, through support? We offer premium support . However, we often hear from users for the first time about a year after they have it in production.  Most users find they can support the software themselves.  It is only after a year or so, they have questions or concerns about where to take the product next.  In many cases, it is to a problem we have already solved and they just need to upgrade their software or use a new module we have added. As we don't know who is using most of our software, we can't advise them on how best to use our software and what updates or enhancements they would benefit from. We need users to contact us and ask questions.  We have a free forum , and we respond to 50% of questions in 2 hours...
Read more