search

yahel / rangzen

1 stars 0 forks source link

OutOfMemoryError during crypto exchange #14

Open scrivener opened 9 years ago

scrivener commented 9 years ago

Copy-pasta of the logcat messages below.

Happened very early on after re-installing Rangzen on a Nexus 7. Whole app crashed as a result. The allocation (1077870608-byte allocation!) is a 1GB ALLOCATION. I have no idea why the allocation is so big. I guess we trust the remote party's length field and try to allocate that much memory? It's like Heartbleed! I don't think it can read out anything, but it can certainly make us crash.

01-22 14:22:01.140: E/dalvikvm-heap(18470): Out of memory on a 1077870608-byte allocation.
01-22 14:22:01.150: E/AndroidRuntime(18470): FATAL EXCEPTION: Thread-7085
01-22 14:22:01.150: E/AndroidRuntime(18470): Process: org.denovogroup.rangzen, PID: 18470
01-22 14:22:01.150: E/AndroidRuntime(18470): java.lang.OutOfMemoryError
01-22 14:22:01.150: E/AndroidRuntime(18470):    at org.denovogroup.rangzen.Exchange.lengthValueRead(Exchange.java:429)
01-22 14:22:01.150: E/AndroidRuntime(18470):    at org.denovogroup.rangzen.CryptographicExchange.receiveServerMessage(CryptographicExchange.java:233)
01-22 14:22:01.150: E/AndroidRuntime(18470):    at org.denovogroup.rangzen.CryptographicExchange.run(CryptographicExchange.java:99)
01-22 14:22:01.150: E/AndroidRuntime(18470):    at java.lang.Thread.run(Thread.java:841)
scrivener commented 9 years ago

The line that caused the failure (Exchange.java:429) is

    byte[] messageBytes = new byte[length];

This is clearly a receiving bug. But I'm not sure why it thought that a gig length was requested. My phone must've sent something that was interpreted that way, which is a related bug?

scrivener commented 9 years ago

Submitted https://de-novo-rietveld.appspot.com/8200001 which fixes the receiver's side of this. I really don't know why my Nexus 7 received something that thought it was 1G long. Sending bug presumably.

scrivener commented 9 years ago

Issue 8200001 (linked above) closed this issue on the receiver's side. Not sure where it came from on the sender's side. Going to leave this open until the reason for the sending of a 1G length field is discovered.