Problem - Kevin Tafuro

See Also
• Microsoft Security Bulletin MS02-071: http://www.Microsoft.com/technet/
treeview/?url=/technet/security/bulletin/MS02-071.asp
• “Shatter Attacks—How to Break Windows” by Chris Paget: http://security.
tombom.co.uk/shatter.html
13.7 Guarding Against Spawning Too Many
Threads
Problem
You need to prevent too many threads from being spawned, a problem that could
potentially result in a denial of service owing to exhausted system resources.
Solution
A common mistake in writing multithreaded programs is to create a new thread
every time a new task is initiated; this is often overkill. Often, a “pool” of threads can
be used to perform simple tasks. A set number of threads are created when the program
initializes, and these threads exist for the lifetime of the process. Whenever a
task needs to be performed on another thread, the task can be queued. When a
thread is available, it can perform the task, then go back to waiting for another task
to perform.
On Windows 2000 and greater, there is a new API function called
QueueUserWorkItem( ) that essentially implements the same functionality as that presented
in this recipe. Unfortunately, that function does not exist on older versions of
Windows. Our solution has the advantage of being portable to such older systems.
However, if you are writing code that is guaranteed always to be running on a system
that supports the API, you may wish to use it instead. Regardless of whether you
use the API or the code we present in this recipe, the concepts are the same, and the
bulk of our discussion still applies.
Discussion
Suppose that the program using thread spawns is a network server, and it spawns a
new thread for each connection it receives, an attacker can quickly flood the server
with false or incomplete connections. The result is either that the server runs out of
available threads and cannot create any more, or that it cannot create them fast
enough to service the incoming requests. Either way, legitimate connections can no
longer get through, and system resources are exhausted.
718 | Chapter 13: Other Topics
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.