1147620 - dragging an image and closing Firefox leaves image stuck to cursor and Firefox hang

Status: NEW

(Core :: DOM: Copy & Paste and Drag & Drop, defect, P5)

Description

[Mario San Juan]

Attachment: Proof.rar

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:36.0) Gecko/20100101 Firefox/36.0
Build ID: 20150319201009

Steps to reproduce:

Steps to reproduce:
1. Extract the file "proof.rar"
2. Open Firefox
3. Open the archive "User After Free.htm"
4: Drag the image in any direction
5. Close the browser and view the cursor


Actual results:

The attached picture still running and the process of firefox too.


Expected results:

Use After Free

Comment 1

[Al Billings [:abillings - ex-MoCo]]

Attachment: zip of poc

Comment 2

[Daniel Veditz [:dveditz]]

I can reproduce (on windows; not on mac) the cursor remaining the dragged image while on the desktop, but my Firefox did stop running.

I don't see where "use after free" comes into this -- I didn't see a crash or any similar evidence.

Comment 3

[Jim Mathies [:jimm]]

Attachment: stack

Here's the firefox.exe stuck stack on Windows. This makes sense really, the poc throws this js dialog up in the middle of a drag operation leaving the browser in a weird state.

Comment 4

[Andrew McCreight [:mccr8]]

Mario San Juan, why do you say this is a use-after-free?  Thanks.

Comment 5

[Mario San Juan]

Dado que la imagen adjunta cursor aparece cuando el navegador se cierra, la firefox.exe proceso se está ejecutando, se puede ver en la barra de tareas de Windows.

Comment 6

[Daniel Veditz [:dveditz]]

I don't see a "use after free" security problem here. The hang and unclean shutdown is a bug but we should be able to address this as a public bug--does not seem to be exploitable.

Comment 7

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, >=5 years untouched DOM/Storage bugs' priority.

If you have reason to believe this is wrong (especially for the severity), please write a comment and ni :jstutte.