1105796 - Billion laughs in SVG displaying (possible OOM?)

Status: RESOLVED DUPLICATE of bug 455100

(Core :: SVG, defect)

Description

[Manish Goregaokar [:manishearth]]

Attachment: SVG file that can crash firefox (don't open in firefox)

http://en.wikipedia.org/wiki/Billion_laughs

SVGs are parsed as XMLs, which are susceptible to vulnerabilities related to entities. Nesting of these entities can cause a denial of service type attack.


Firefox, when opening an SVG with nested entities, locks up completely. There is no way to recover, aside from exiting (it also takes up a humongous amount of memory -- the file I've attached took up 4 gig before I killed it -- which means that this ought to cause an OOM on slower computers -- perhaps can be escalated to a buffer overflow or something)

Chrome shows a nice "error on line 16 at column 26: Detected an entity reference loop" error when it gets such a file, and pretty much immediately. Perhaps we should use the same heuristics to detect it? 

[Note: this applies to opening the SVG file as well as fetching it via XHR]

Comment 1

[Manish Goregaokar [:manishearth]]

Attachment: Plaintext version

Comment 2

[Benjamin Smedberg]

DOS/OOM loop, not exploitable so doesn't need to remain private.

Comment 3

[Manish Goregaokar [:manishearth]]

Surprisingly enough, the same OOM doesn't occur for XML feeds being viewed in firefox -- they show an error similar to Chrome.

Comment 4

[Robert Longson [:longsonr]]

Is this the same as bug 455100