title: XSD(maxOccurs=(specify large value))- java.lang.OutOfMemoryError: Java heap space
body: <p>when we deploy the application on tomcat server I have been facing java.lang.OutOfMemoryError issue because <b> we specify large values for "maxOccurs" attribute(i.e. maxOccurs="999999")in the schema definition</b>. Please find below sample snippet and the exception stack trace. Could someone please suggest optimized solution to avoid this scenario.</p>
  
  <p>Initially we kept maxoccurs value to "unbound". But when we scan code base with HP Fortify Static Code Analyzer we found there is Critical issue(for more info on the issue please visit:<a href="http://www.hpenterprisesecurity.com/vulncat/en/vulncat/index.html" rel="nofollow">Fortify Link</a>, on the left panel we have XML-->Environment--> <b>Weak XML Schema: Unbounded Occurrences</b>). So HP Foritfy tool<b> recommends limit maxoccurs to a reasonable number.</b> we have to fix this issue to get sign off from business.</p>
  
  <pre><code>Java version: JDK 1.6.0_30
  Tomcat Version: 6.0                
  </code></pre>
  
  <p><b>Note: please don’t suggest to increase heap size. The current scenario I am facing is in development tomcat application server, where as in production tomcat application server I don’t see this issue(may be production server has more space)</b></p>
  
  <pre><code>  Schema1.xsd  
  
        &lt;xs:sequence&gt;
             &lt;xs:element name=" User " type=" UserType " maxOccurs="999999"/&gt;
                            &lt;!-- maxOccurs we specifying large number--&gt;
        &lt;/xs:sequence&gt;
  </code></pre>
  
  <p>Exception Stack Trace:</p>
  
  <pre><code>Caused by: java.lang.OutOfMemoryError: Java heap space
       at org.apache.xerces.impl.dtd.models.CMStateSet.&lt;init&gt;(Unknown Source)
       at org.apache.xerces.impl.xs.models.XSDFACM.buildDFA(Unknown Source)
       at org.apache.xerces.impl.xs.models.XSDFACM.&lt;init&gt;(Unknown Source)
       at org.apache.xerces.impl.xs.models.CMBuilder.createDFACM(Unknown Source)
       at org.apache.xerces.impl.xs.models.CMBuilder.getContentModel(Unknown Source)
       at org.apache.xerces.impl.xs.XSComplexTypeDecl.getContentModel(Unknown Source)
       at org.apache.xerces.impl.xs.XSConstraints.fullSchemaChecking(Unknown Source)
       at org.apache.xerces.impl.xs.XMLSchemaLoader.loadGrammar(Unknown Source)
       at org.apache.xerces.impl.xs.XMLSchemaLoader.loadGrammar(Unknown Source)
       at org.apache.xerces.jaxp.validation.XMLSchemaFactory.newSchema(Unknown Source)
       at javax.xml.validation.SchemaFactory.newSchema(SchemaFactory.java:594)
       at com.prac.app.common.xmlsupport.SchemaLoaderImpl.init(SchemaLoaderImpl.java:92)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:597)
  </code></pre>