Weirdest way to produce a stack overflow [closed]

Question

As a programmer you certainly know the error of a stack overflow due to an obvious recursion. But there are certainly many weird and unusual ways to get your favourite language to spit that error out.

Objectives:

1. Must cause a stack overflow which is clearly visible on the error output.
2. Not allowed to use an obvious recursion.

Examples of invalid programs:

// Invalid, direct obvious recursion.
methodA(){ methodA(); }

// Invalid, indirect, but obvious recursion.
methodA(){ methodB(); }
methodB(){ methodA(); }

The most creative ways are the best as this a popularity-contest. I.e, avoid boring obvious answers like this:

throw new StackOverflowError(); // Valid, but very boring and downvote-deserving.

Even though I accepted an answer now, adding more answers is still okay :)

Answer 1

Java

Recursive reflection:

import java.lang.reflect.Method;

public class StackOverflow {
    public static void main(String[] _) throws Exception {
        Method m = Method.class.getMethod("invoke", Object.class, Object[].class);
        Object[] args = { m, null };
        args[1] = args;
        m.invoke(m, args);
    }
}

I'd like to think that this code doesn't obviously cause a stack overflow, and I'd hope the 1.8MiB of stacktrace it generates counts as 'clearly visible'.

Idea shamelessly lifted from http://bugs.java.com/bugdatabase/view_bug.do?bug_id=4185411.

Answer 2

C Buffer Overflow

#include <stdio.h>
#include <math.h>

int main()
{
   char buff[20];
   sprintf(buff, "Value of Pi = %f", M_PI);
   return(0);
}

Answer 3

PHP

<?php
header("Location: {$_SERVER['PHP_SELF']}");

Navigating to this page produces this result:

Answer 4

Apache mod_rewrite done wrong

RewriteEngine On
RewriteRule ^(.+)$ /$1.php [L]

The rule, which is supposed to map URLs such as /about-us to /about-us.php, ends up producing this error in Apache logs (the L flag does not help):

Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.

Answer 5

Although it's not a real stack overflow but effects are pretty much the same.

int main()
{
    asm("movl $0, %esp");
}

C++ (since there is no return from main) and i386-like cpus.

ESP is the stack pointer in i386 processor, by doing that, we're pointing the stack out of the memory reserved for it, something similar happens when recursion is involved - just without actually writing to it.

Notice that SIGSEGV is generated not when ESP is changed but when the the program uses the stack, so if we modify the code like this

#include <iostream>

void foo()
{
    std::cout << "hello";
}

int main()
{
    asm("movl $0, %esp");
    foo();
}

we will get the crash at:

Program received signal SIGSEGV, Segmentation fault.
main () at stack.cpp:11
11        foo();

The interesting thing about SO is that you cannot catch SIGSEGV signal by using signal() function since there no stack to call it, but you can provide alternate stack (eg heap allocated) to the sigaction function.

Answer 6

Java

More API vodoo. This time, the stack trace doesn't hint where the overflow line is actually.

class SO extends JFrame
{
    public static void main(String[]a)
    {
        new SO().setVisible(true);

    }
    public SO()
    {
        setSize(100,100);
        DefaultListModel m = new DefaultListModel();
        JList l = new JList(m);
        m.addElement(m);
        add(l);
    }
}

That derp happened to me once while programming some GUI stuff and I didn't knew where it was from

Answer 7

Haskell

A joke I thought of a couple of years back:

import Control.Monad.Fix

main = print(fix error)

gives

"*** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: *** Exception: ... etc.

I'm not getting a stack overflow error, but maybe that is because the Glasgow Haskell Compiler uses lazy evaluation.

The function fix :: (a -> a) -> a gives the first fix point of the function error - fix applies a function to itself. In that sense it is plain and simple recursion. The function error :: [Char] -> a requires a string argument and returns something of any type. That is why it can serve as the argument to another error function.

Answer 8

Python and the Y combinator

before someone else does it:

(lambda f: (lambda x: x(x))(lambda y: f(lambda : y(y)())))(lambda f: f)()

Please, if you don't know much about lambda calculus, don't downvote this solution because you believe that the recursive call is obvious; it isn't obvious at all. More precisely, lambda x: x(x) or lambda : y(y) or lambda f: f ARE NOT recursive calls but mere functions applying to functions.

Answer 9

C with GCC extensions

int main() {
  goto *(void*)main;
  return 0;
}

This will compile without errors and without using any compiler flags when using GCC. GCC allows "computed gotos", where you can jump directly to a pointer. It doesn't look like the goto would cause a stack overflow, but GCC puts a preamble in the main() function that pushes one register to the stack, as can be seen in the produced assembler:

main:
  pushq %rbp
  movq  %rsp, %rbp
  movl  $main, %eax
  jmp   *%rax

Answer 10

AppleSoft BASIC

0 GOSUB 0

Not so weird but worth mentioning...

Answer 11

Python:

Using anonymous recursion. I'm not sure if this is too straight-forward or not, but there are no declared functions, so it seems potentially interesting.

(lambda f:f(f))(lambda f:f(f))

Answer 12

Go

I challenge anybody to see the bug, who doesn't already know where it is. I added a few (truthful) comments to explain the code to non-Goers.

Try to find it yourself, if you're so inclined, before reading the comment section below (where somebody will surely spoil it.)

Here is a link to the playground: http://play.golang.org/p/UwunxiXKP7

package main

import "fmt"

// Aim: to define an integer type that by default is printed in hex notation (0xab..)
type hexInt int

// Implementation of the Stringer interface, used by Println for conversion to string.
func (h hexInt) String() string {
    // "%#x" is the alternate form of "%x", which uses lowercase a-f and adds 0x in front.
    return fmt.Sprintf("%#x", h)
}

func main() {
    // Create a variable of type hexInt with the value 42 and print it.
    var h hexInt = 42
    fmt.Println(h)
}

Answer 13

Ruby

class Fixnum
  def +(arg)
    self-arg
  end
  def -(arg)
    self+arg
  end
end

reopens the Fixnum class, defines addition as substraction and substraction as addition, then simply do:

3+2

and voila :)

Answer 14

Flash AS3

public class Work extends Sprite
{
    public function Work()
    {
        doIt();
    }

    private function doIt():void
    {
        noYouDoIt();
    }

    private function noYouDoIt():void
    {
        arguments.callee();
    }
}

Answer 15

Netware:

echo hello > file
cat file >> file

I discovered this (but did not use it) many decades ago. I mentioned it to someone, who did it on a Netware share. The share had no limits, and was also used for scratch space by the netware server itself.

The server filled with this one file end-to-end-to-end, crashed (due to running out of diskspace), and couldn't be brought back up until the file was removed. The file, of course, couldn't be removed until the server was running.

Answer 16

Javascript

Tested in Chrome:

var a = Array(10000000);
(function(){}).apply(this, a);

Answer 17

C

void main()
{
    while(1)
        *(char*)alloca(1000)=0;
}

Funnily, without =0 it will rotate indefinitely because it'll just subtract stack pointer without causing any stack accesses.

Answer 18

C#

  public static int i
  {
      set { i = value; }
  }
  static void Main(string[] args)
  {
      i = 0;
  }

Answer 19

Common problem in a Rails model

after_save :bump_version

# a lot of code....

private

def bump_version
  create_new_version_record
  update_attribute(:version, version+1)
end

Answer 20

Haskell

import Control.DeepSeq
makeFunc n = \input -> (newfunc input) `deepseq`
    unlines [ "Function number "++(show n)++"was called with "++input
            , "Now calling the next function."
            , newfunc input]
            where
                newfunc=makeFunc (n+1)

main=putStrLn ((  makeFunc (0::Double)  ) "Input")

In this, each function creates a new one, and calls it. Note that this is no recursion, in that no function call itself.

Answer 21

excel vba

Private Sub Worksheet_Change(ByVal Target As Range)
[a1] = 1
End Sub

place code into any worksheet

stack will overflow (in vba, displayed as an out of memory error) as each change to the worksheet triggers another change.

Answer 22

Well just since I'm bored.

int main()
{
   char *ptr;
   ptr = &ptr - sizeof(ptr);
   while(1)
      *--ptr = 0;
}

Invokes undefined behavior that trips the guard page the same way a stack overflow does.

Answer 23

Vim

:se maxf<tab>=0<CR>
:help<CR>

Produces E132: Function call depth is higher than 'maxfuncdepth', vim's equivalent of a stack overflow. (Several times, actually)

Answer 24

ANS Forth:

0 >in 2dup ! !

which leads to:

$ gforth
Gforth 0.7.0, Copyright (C) 1995-2008 Free Software Foundation, Inc.
Gforth comes with ABSOLUTELY NO WARRANTY; for details type `license'
Type `bye' to exit
0 >in 2dup ! !                                          
:1: Stack overflow
0 >in 2dup >>>!<<< !
Backtrace:
$B71DF6EC r> 
$B71D34A4 perform 
$B71DD654 (search-wordlist) 
$3 
$0 
$B71DD734 (vocfind) 
$B71D34A4 perform 
$B71D351C (search-wordlist) 
$B71D3FF4 find-name 

In fact, the 2nd ! is never executed.

>in is an integer variable that contains the current position within the input line, the program attempts to write zero to >in two times, but after the first write (!) the input pointer is reset to the start of input line, and the 2nd pair of values is left on the stack...

Answer 25

Another one!

Ruby

class Foo
  def method_missing *args, &block
    foo
  end
end

Foo.new.stack_overflow!
SystemStackError: stack level too deep
        from /home/bbozo/.rvm/rubies/ruby-1.9.3-p286/lib/ruby/1.9.1/irb/workspace.rb:80
Maybe IRB bug!

Answer 26

PHP

$a = array('call_user_func_array', &$a);
$a[0]($a[0], $a);

Process exited with code 139.

Compatible from 4.3 to 5.6

Answer 27

Python

>>> class C:
...     def __setattr__(self, k, v):
...             self.k = v
...
>>> C().x = 10
...
  File "<stdin>", line 3, in __setattr__
RuntimeError: maximum recursion depth exceeded while calling a Python object

__getattribute__ will also do this in a similar way.

Answer 28

C: "Hello World" format

#include <stdio.h>
int main(){
    (*printf+285)("Hello World\n");
}

This is actually a recursive call that fails when the stack get too big, but it is definitely not an obvious one.

Answer 29

Haskell

I'm surprised nobody posted this already... Maybe it's too obvious?

data Foo = Bar

instance Eq Foo where

main = print (Bar == Bar)

Naturally, Bar == Bar should evaluate to True. So this program should just print "True" and then exit. However, that's not what the empty instance Eq Foo declaration does. ;-)

Answer 30

C#

This will stack overflow the CLR I think, and report that type could not be loaded.

public struct Titan 
{
    public Pluto Data { get; set; }
}

public struct Pluto 
{
    public Titan Data { get; set; }
}

class Program
{
    static void Main(string[] args)
    {
        //System.TypeLoadException was unhandled
        //Message="Could not load type 'ConsoleApplication1.Titan' from assembly 'ConsoleApplication1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'."
        //Source="ConsoleApplication1"
        //TypeName="ConsoleApplication1.Titan"
        //StackTrace:
        //     at ConsoleApplication1.Program.Main(String[] args)
        //     at System.AppDomain._nExecuteAssembly(Assembly assembly, String[] args)
        //     at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
        //     at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
        //     at System.Threading.ThreadHelper.ThreadStart()
        Titan t;
    }
}