Does Java have buffer overflows and memory leaks?

[Val Pecaoco]

Hi Ranchers,
Since Java is written in C++ (more details on this link), does it mean that Java may have buffer overflows and memory leaks? (Which may explain a Volano security advisory report that some Java VM implementations are vulnerable to a denial-of-service attack.)
Any opinions/statements of facts about this?
Ex Animo Java!
-- Val
[ August 28, 2002: Message edited by: Val Pecaoco ]

[Michael Ernest]

Memory leaks are not a property of any one language -- not even C++.
It is certainly possible to create memory leaks in a running Java program, but it has nothing to do with native code libraries. It has everything to do with careless programming.

[Val Pecaoco]

Originally posted by Michael Ernest:
It is certainly possible to create memory leaks in a running Java program, but it has nothing to do with native code libraries. It has everything to do with careless programming.

So, it's like, a carelessly-programmed Java virtual machine in C++, for example, may be a potential source of memory leaks?

[sridhar satuloori]

Originally posted by Michael Ernest:
Memory leaks are not a property of any one language -- not even C++.
It is certainly possible to create memory leaks in a running Java program, but it has nothing to do with native code libraries. It has everything to do with careless programming.

Michael,
My understanding is that Java never creates a memory leak how bad your program could be. If at all if there are any memory leaks they are because oof the faulty implementation of JVM.
It is certainly possible to create memory leaks in a running Java program
I am just curious here. can you write a single example which creates a memory leak on any JVM.
--sridhar

[David Weitzman]

Basically the thing to keep in mind is that Sun's implementatation of Java is really good. There are a few bugs in the standard libraries, but I can count on the fingers of one hand the number of times that Sun's virtual machine has unexpectedly halted running a pure Java application -- and I've been using java since 1.1. Just go to securityfocus.net and look for security bugs in Sun's virtual machine.
In response to sridhar:
You can maintain references to unused objects and clog the memory -- read: you can create memory leaks.
Here's an example of a memory leak that's in Effective Java by Joshua Bloch -- an array based stack. I know it's a good example because I saw with my own eyes a grad student instructor make this exact same stack leak mistake this summer.

public class MyStack {
  // I won't bother with resizing for this example
  private Object[] data;
  private int top;
 
  public MyStack(int capacity) {
    data = new Object[capacity];
    top = 0;
  }
 
  public void push(Object o) {
    data[top++] = o;
  }
 
  public Object pop() {
    return data[top--];
  }
}

Do you see the memory leak?
It's in the pop() method. Once I put something into the stack, it won't be garbage collected until the entire stack is. I don't delete the reference from the array -- I just change a pointer.
Here's the fix:

  public Object pop() {
    Object value = data[top];
    data[top] = null;
    top--;
    return value;
  }

It's just important to remember that when an object isn't going to be used ever again, any references to it should either go out of scope at the end of the current code block or be specifically set to null.
[ August 29, 2002: Message edited by: David Weitzman ]

[Michael Ernest]

Originally posted by Val Pecaoco:

So, it's like, a carelessly-programmed Java virtual machine in C++, for example, may be a potential source of memory leaks?

Like, that's totally not my point, but you're not wrong either?

[sridhar satuloori]

thanks, Michel and David,
Now i accept that u can create a memory leaks in java. I was under impression that Java doesnt allow you to create "memory leak".
--sridhar

[Thomas Paul]

Those of us who are C++ programmers can tell you that the example is not a true memory leak in the classic term. Back in the old days we used to write programs that would never free memeory even after they terminated. You'd have to reboot your windows PC to get your memory back. Now that was a memory leak!!!

[David Weitzman]

Isn't C++ memory reclaimed when the program exits?

[Thomas Paul]

Originally posted by David Weitzman:
Isn't C++ memory reclaimed when the program exits?

Not in the old days when we ran on Win 3.1! We had one program that would run for about 2 hours and then lock up a Win 3.1 PC. The only fix was Ctrl-Alt-Delete!

[Ron Newman]

But when a C or C++ program exits, doesn't its entire address space go away because the process exits?

[Thomas Paul]

You obviously never worked with 16 bit versions of Windows!

[Ron Newman]

Nope -- my C and C++ work was all on various flavors of Unix.