This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Code Correctness: Double-Checked Locking"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
{{Template:Vulnerability}}
+
{{template:CandidateForDeletion}}
{{Template:Fortify}}
+
 
 +
#REDIRECT [[Failure to follow guideline/specification]]
 +
 
  
 
__TOC__
 
__TOC__
Line 65: Line 67:
  
 
* [[1] D. Bacon et al. The "Double-Checked Locking is Broken" Declaration. http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html.
 
* [[1] D. Bacon et al. The "Double-Checked Locking is Broken" Declaration. http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html.
 
[[Category:FIXME|need subcategory
 
In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
 
 
Availability Vulnerability
 
 
Authorization Vulnerability
 
 
Authentication Vulnerability
 
 
Concurrency Vulnerability
 
 
Configuration Vulnerability
 
 
Cryptographic Vulnerability
 
 
Encoding Vulnerability
 
 
Error Handling Vulnerability
 
 
Input Validation Vulnerability
 
 
Logging and Auditing Vulnerability
 
 
Session Management Vulnerability]]
 
 
__NOTOC__
 
 
 
 
[[Category:Synchronization and Timing Vulnerability]]
 
[[Category:Java]]
 
[[Category:Implementation]]
 
[[Category:Code Snippet]]
 
[[Category:OWASP ASDR Project]]
 
[[Category:Vulnerability]]
 

Revision as of 11:13, 11 February 2009

Template:CandidateForDeletion

#REDIRECT Failure to follow guideline/specification


ASDR Table of Contents

Last revision (mm/dd/yy): 02/11/2009


Description

Double-checked locking is an incorrect idiom that does not achieve the intended effect.

Many talented individuals have spent a great deal of time pondering ways to make double-checked locking work in order to improve performance. None have succeeded.

Risk Factors

TBD

Examples

At first blush it may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization.

	if (fitz == null) {
	  synchronized (this) {
		if (fitz == null) {
		  fitz = new Fitzer();
		}
	  }
	}
	return fitz;

The programmer wants to guarantee that only one Fitzer() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called. This idiom is known as double-checked locking.

Unfortunately, it does not work, and multiple Fitzer() objects can be allocated. See The "Double-Checked Locking is Broken" Declaration for more details [1].


Related Attacks


Related Vulnerabilities


Related Controls


Related Technical Impacts


References