1100059 - Too many nested tags cause Firefox to crash

Status: RESOLVED DUPLICATE of bug 485941

(Core :: XML, defect)

Description

[ghuysmans99]

Attachment: Shortest XML crashing the parser

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Build ID: 20141106120505

Steps to reproduce:

Open the enclosed file. Tested with Firefox (32-bit on Windows 8.1 x64)


Actual results:

Firefox crashes.


Expected results:

Maybe Firefox should have displayed an error message about a maximum depth...

Comment 1

[ghuysmans99]

I don't know whether this bug could be exploited, so I marked it as critical (sorry for the inconvenience if it can't).

Comment 2

[Boris Zbarsky [:bzbarsky]]

The HTML parser caps the depth.

Pretty sure we have existing bugs for this for the XML parser, and pretty sure this just leads to a stack overflow recursing down the tree, which is not exploitable...

Comment 3

[ghuysmans99]

Attachment: Bisection for creating the shortest sample

Maybe this could be useful for testing different builds

Comment 4

[Daniel Veditz [:dveditz]]

The first attachment doesn't have enough levels to crash me (I guess I have more memory than you do) but yes, this will eventually crash us.

Comment 5

[pawel]

Maybe is duplicate but still works and crash Firefox 36.More then 4 years.