Simple caret (^) at end of Windows batch file consumes all memory

49
votes

This simple batch file in relatively short order consumes all available memory on Windows 7 (x64). What's going on? and what precautions can be taken to ward against it?

any-invalid-command-you-like-here ^

Apparently necessary preconditions to exhibit the effect:

  • the caret ^ is the very last thing in the file, and the script is not terminated with a newline
  • the caret is preceded by at least 2 spaces or characters, e.g. if the dots in the following represent spaces the memory leak will not be triggered .^, while this one will ..^ (just slowly)

In this Process Explorer screen shot, the script had been running about 30 seconds, consumed 2.9GB, and was still climbing at a steady rate:

2.9GB memory consumed and still climbing

If you're going to experiment with this, make sure you can get at the Close Window [X] control or have a Task Manager or Process Explorer fired up and ready as Ctrl-C, Ctrl-Break, Alt-F4 have no effect.

It appears multiple carets will cause the memory usage to ramp up much more quickly. The first time I encountered this there wasn't enough memory available in 1 or 2 minutes to do simple things like Alt-Tab and even the 3 finger salute Ctrl-Alt-Del was ineffective. I had to hard power off the machine.

1
windowssecuritybatch-filecmd
It's not a bug, it's a feature. - BDM
No, i got two error messages (XP): the following string is too long & syntax error (translated). After that the script terminated. - Endoro
I added tag:security because this could be used maliciously without much fuss to bring a machine to it's knees. Not sure if that is inappropriate use of that tag; remove if so. - matt wilkie
I can envision thousands of people on the planet running this on a coworkers machine when they left it unlocked... just open a cmd window, execute, minimize the window and walk away.. - NotMe
Fixed in Windows 10. - user202729

1 Answers

43
votes

Thoughts

The cause of this (from my understanding) is due to the cmd interpreter looking for a character to escape since the ^ is the batch escape character. Instead of properly identifying the end of file eof in this scenario, cmd just keeps looping and initializing something while looking for the character to escape.

Reproduced on Windows 8 Pro (64) with cc^^^ (Multiple carets used to speed up the leak).

Trials

cc^ infinite loop and leaks very slowly.

cc^^ crashes with normal invalid command error.

cc^^^ infinite loop and leaks faster.

cc ^ infinite loop and leaks very slowly.

cc ^^ crashes with normal invalid command error.

cc ^^^ infinite loop and leaks faster.

cc"^ crashes with normal invalid command error.

cc"^^ crashes with normal invalid command error.

cc"^^^ crashes with normal invalid command error.

Notes

  • Only infinite loop and leaks when carets ^ are used literally (outside of quotations). When quotation added the script crashes with standard invalid command error.
  • Only infinite loop and leaks when batch file is encoded as UTF-8 or ASCII. When UTF-16, the script crashes with standard invalid command error.
  • Must be an odd number of carets as to not escape the last caret.

Precautions

  • Make sure no batch scripts end with a caret ^ (0x5E) or at least an odd number of carets.
  • Or encode them in UTF-16.