[haiku-bugs] Re: [Haiku] #6738: app_server hangs?

  • From: "bonefish" <trac@xxxxxxxxxxxx>
  • Date: Mon, 01 Nov 2010 09:48:10 -0000

#6738: app_server hangs?
---------------------------------+------------------------------
  Reporter:  kirilla             |        Owner:  stippi
      Type:  bug                 |       Status:  assigned
  Priority:  normal              |    Milestone:  R1
 Component:  Servers/app_server  |      Version:  R1/Development
Resolution:                      |     Keywords:
Blocked By:                      |  Has a Patch:  0
  Platform:  All                 |     Blocking:
---------------------------------+------------------------------

Comment (by bonefish):

 What apparently happens:
  1. The client sends a drawing command (drawing a shape) with invalid
 parameters (e.g. NaN coordinates).
  1. The app server doesn't check for invalid values (or misses this case)
 and calls `curve4_div()` with invalid parameters.
  1. `curve4_div::recursive_bezier()` always recurses to the last level,
 causing 2^34^ - 1 calls which should keep the CPU quite busy. I haven't
 checked, but possibly it also tries to add a few billion points to the
 object's point array, which would cause serious memory issues. But even if
 it doesn't, the CPU hogging alone (probably while holding some lock) could
 already make the app server appear to hang.

 So the measures to be taken are:
  - Fix parameter checking in the app server.
  - Possibly add sanity limits to `curve4_div::recursive_bezier()`.
  - Fix the client side (assuming that it is indeed the source of the bad
 values).

-- 
Ticket URL: <http://dev.haiku-os.org/ticket/6738#comment:8>
Haiku <http://dev.haiku-os.org>
Haiku - the operating system.

Other related posts: