[
https://issues.apache.org/jira/browse/MATH-1691?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18119909#comment-18119909
]
Gilles Sadowski commented on MATH-1691:
---------------------------------------
Branch fixes
[misc-hardening__MATH-1691|https://github.com/apache/commons-math/tree/misc-hardening__MATH-1691]
the following findings:
* Large or infinite loop (because of non finite input)
* NaN propagation
* Inconsistent synchronization
In classes
*
[FieldDenseMatrix|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/field/linalg/FieldDenseMatrix.html]
*
[KalmanFilter|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/filter/KalmanFilter.html]
*
[AbstractIntegerDistribution|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/distribution/AbstractIntegerDistribution.html]
*
[AbstractRealDistribution|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/distribution/AbstractRealDistribution.html]
*
[PolynomialsUtils|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/analysis/polynomials/PolynomialsUtils.html]
*
[AbstractIntegrator|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/ode/AbstractIntegrator.html]
some suggested hardening fixes were not implemented as they would probably
induce a performance hit in normal usage while only guarding against wrong
input likely to cause other issues in the caller's application.
In classes
*
[OrderedCrossover|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/genetics/OrderedCrossover.html]
*
[CycleCrossover|https://commons.apache.org/proper/commons-math/javadocs/api-4.0-beta1/org/apache/commons/math4/legacy/genetics/CycleCrossover.html]
reported issues were not fixed because package {{genetics}} should probably be
deprecated (cf. old discussions on JIRA and on the "dev" ML).
> Miscellaneous hardening fixes
> -----------------------------
>
> Key: MATH-1691
> URL: https://issues.apache.org/jira/browse/MATH-1691
> Project: Commons Math
> Issue Type: Improvement
> Affects Versions: 4.0-beta1
> Reporter: Gilles Sadowski
> Assignee: Gilles Sadowski
> Priority: Minor
> Labels: debug, hardening
> Fix For: 4.0-beta2
>
>
> A security scan performed last August detected a series of ways by which
> application developers can call functionality in a non-sensible way, mostly
> entailing to "infinite" loop or RAM exhaustion.
> None of the reported issues is an actual "vulnerability".
> This report is meant as discussion meeting point for how to enhance
> robustness if necessary, and the consequent "hardening" measures.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
