MOO-cows Mailing List Archive
[Prev][Next][Index][Thread]

re: DB crasher

The appending of strings causing a server panic, having just tried to
duplicate this on my machine using a $prog on a 1.8.p4 the DB increased 
from 2meg to 35 meg in no time. 
It then drowned in lag due to accessing the swap and not even the 
$cu:suspend_if_needed(0) could prevent it from timing it out saving my 
system from a complete system resource exhuastion which I presumed would 
have panicked the server or maybe even crashed the whole machine. 
What this shows did is that the panic reported was more likaly to have 
been caused by exhaustion of resources rather than a server error itself.
This would seem like a fairly effective way for a malicious programmer to
either crash a system or to at the very least cause massive lag by
forcing the DB to expand into swap.
If placed into a forked eval, it could be almost undectable as they would
not even be on line when the fork bomb strikes (unless you monitor evals, 
inwhich self deleting verbs could be used).

Would Pavel concider adding a $server_options property to control the max
addition length of strings and presumably lists too. This would allow a 
suitably long value to be selected while preventing the forked bombs 
striking, while this might not have been a common method of melicious 
attack in the past that might have been because it was not as commonly known 
as it is now.

FD.
Follow-Ups:
Home | Subject Index | Thread Index