Роман Химов

Цитата с сайта Михаэля Франца:

Verification also ensures control-flow safety, but this is a comparatively trivial task. Conversely, verifying that the data flow is well-typed is rather complex. The JVM bytecode verifier uses an iterative data-flow analysis algorithm for this task, and unfortunately, this algorithm has an execution complexity that rises quadratically with program length. This gives rise to my prediction that we will soon witness denial-of-service attacks on mobile-code systems that will exploit the algorithmic complexity of the verifier itself: By sending a legal, but difficult-to-verify program to a server virtual machine, one can keep that server occupied for an inordinate amount of time, effectively making it unavailable for useful work. In my experiments, a 4kByte JAR file containing Java code with worst-case verification complexity required more than 15 minutes of verification time on a 2.4 Gigahertz Pentium IV processor.