143912 - [FIX]"moz-bitmap:" URL crashes browser M1RC2 [@ inBitmapChannel::AsyncOpen()]

Status: RESOLVED FIXED

(Other Applications :: DOM Inspector, defect)

Description

[Peter Bowen]

If you just type "moz-bitmap:" in the URL bar and hit enter, the browser will
crash.  This has been tested on 0.9.9, 1.0rc1, and 1.0rc2.

Comment 1

[Peter Bowen]

Upgrading this to critical, as it turns out that a link in a page with
"moz-bitmap:" as the href will crash the browser.  As a side note, don't click
the URL for the bug, unless you want the browser to crash :/

Comment 2

[Becker-Freyseng, Christoph]

I just want to confirm this bug. It's the same with my Mozilla 1.0 RC2.
I guess this could be a real problem, because malicios people could just make a
site with an additional frame that makes a refresh to moz-bitmap: and the
browser will crash.

Comment 3

[Jacob Wexler]

Confirming for Win NT 4 SP6a.

Comment 4

[Becker-Freyseng, Christoph]

Made a testcase on http://www.beyond-thoughts.com/crashzilla/

DO NOT go there unless you want mozilla crash.

Comment 5

[Becker-Freyseng, Christoph]

Hey that's worse !! It must have something to do with the general URL loading
library.

I made a second test at http://www.beyond-thoughts.com/crashzilla/test2

There's an image tag like:  img src="moz-bitmap:" alt="crashZilla2"

and that's enogh to crash Mozilla.

Comment 6

[Christian :Biesinger (don't email me, ping me on IRC)]

os->all per comment 3

talkback id: TB6201362Y

Comment 7

[Doron Rosenberg (IBM)]

Stack Signature  inBitmapChannel::AsyncOpen() 966b4636
Email Address
Product ID MozillaTrunk
Build ID 2002051208
Trigger Time 2002-05-12 10:20:04
Platform LinuxIntel
Operating System Linux 2.4.17
Module libinspector.so
URL visited moz-bitmap:
User Comments tried to load above url, mozilla bug 143912
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Source File Name
Trigger Line No.
Stack Trace
inBitmapChannel::AsyncOpen()
nsDocumentOpenInfo::Open()
nsURILoader::OpenURIVia()
nsURILoader::OpenURI()
nsDocShell::DoChannelLoad()
nsDocShell::DoURILoad()
nsDocShell::InternalLoad()
nsDocShell::LoadURI()
nsDocShell::LoadURI()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_Interpret()
js_Invoke()
fun_apply()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
nsJSEventListener::HandleEvent()
nsXBLPrototypeHandler::ExecuteHandler()
nsXBLKeyHandler::KeyPress()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsHTMLInputElement::HandleDOMEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsViewManager::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::OnKey()
handle_key_press_event()
dispatch_superwin_event()
handle_gdk_event()
libgdk-1.2.so.0 + 0x17f2f (0x4036df2f)
libglib-1.2.so.0 + 0x11390 (0x403a1390)
libglib-1.2.so.0 + 0x1196f (0x403a196f)
libglib-1.2.so.0 + 0x11b2b (0x403a1b2b)
libgtk-1.2.so.0 + 0x98743 (0x402b1743)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1c5b0 (0x404f55b0) 

Comment 8

[Mason]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0rc2) Gecko/2002051006

Confirming for Windows 98.

TB6205811E (as original TB was for Linux, is a Windows TB useful?)

Comment 9

[Lorenzo Colitti]

Confirming, I'm seeing this too (RC2, WinME). Oh dear.

Comment 10

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Welcome to the RC3 hotlist.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch v1.0

Nice to have a stack trace.  :)

Comment 12

[Boris Zbarsky [:bzbarsky]]

This will crash XP if Inspector is installed if "moz-bitmap:" is followed by any
string (empty string included) that does not have a corresponding bitmap in the
depot...

Comment 13

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch v1.1

Slightly more error-checking would be nice....

Comment 14

[timeless]

.

Comment 15

[Becker-Freyseng, Christoph]

Could I get a compiled version of Mozilla with this bug patched and hopefully fixed?

Comment 16

[Jan Carpenter]

Marking M1RC2 as I'm seeing it show up in there.

     Count   Offset    Real Signature
[ 2   inBitmapChannel::AsyncOpen 9ea19c1f -  ]
[ 1   inBitmapChannel::AsyncOpen e9e2bb0b -  ]
[ 1   inBitmapChannel::AsyncOpen c9751647 -  ]
[ 1   inBitmapChannel::AsyncOpen 8f74f457 -  ]
[ 1   inBitmapChannel::AsyncOpen 6fbe5833 -  ]
[ 1   inBitmapChannel::AsyncOpen 477b203c -  ]
[ 1   inBitmapChannel::AsyncOpen 2b862d75 -  ]
[ 1   inBitmapChannel::AsyncOpen 2943a699 -  ]
[ 1   inBitmapChannel::AsyncOpen 10bac6fb -  ]
 
     Crash date range: 2002-05-11 to 2002-05-12
     Min/Max Seconds since last crash: 100 - 42942
     Min/Max Runtime: 3806 - 61273
     Keyword List :  
     Count   Platform List 
     6   Windows 98 4.10 build 67766222
     3   Windows 98 4.90 build 73010104
     1   Windows 98 4.10 build 67766446
 
     Count   Build Id List 
     10   2002051008
 
     No of Unique Users         5
 
 Stack trace(Frame) 
 
 
     (6205811)	Comments: See bug #143912
     (6200978)	URL: www.beyond-thoughts.com/crashzilla/test2
     (6200801)	URL: www.beyond-thoughts.com/crashzilla/
     (6200748)	URL: www.beyond-thoughts.com/crashzilla/
     (6200639)	URL: www.beyond-thoughts.com/crashzilla/
     (6200639)	Comments: Basically loading "moz-bitmap:"
     (6200401)	URL: www.fahrschule-otto-alt.de
     (6200401)	Comments: I was inspecting a homepage with the DOM-Inspector (Sidebar) and I
tried to klick on capture when I selected a image.

Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/extensions/inspector/base/src/inBitmapChannel.cpp
line : 155
 

Comment 17

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch v 1.1 -- fix string leak too....

Comment 18

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 83456 [details] [diff] [review]
Patch v 1.1 -- fix string leak too....

timeless sez r=timeless on IRC

Comment 19

[Joe Hewitt (gone)]

Comment on attachment 83456 [details] [diff] [review]
Patch v 1.1 -- fix string leak too....

sr=hewitt

Comment 20

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 83456 [details] [diff] [review]
Patch v 1.1 -- fix string leak too....

sr=shaver.

Comment 21

[Boris Zbarsky [:bzbarsky]]

Fixed on trunk, asking drivers for approval.

Comment 22

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 83456 [details] [diff] [review]
Patch v 1.1 -- fix string leak too....

a=[e-mail]; please check into branch ASAP (and into trunk if not there
yet)

Comment 23

[Boris Zbarsky [:bzbarsky]]

Fixed on branch too.