151904 - Malformed (long) URL crashes browser

Status: VERIFIED DUPLICATE of bug 137322

(Core :: Networking, defect)

Description

[Jim Race]

Seen in 6.2.3 and 1.0 win2k. Looks to be specific to win32 platforms?

To reproduce:

1) Open the attached file (mal_url_crash.html)
2) Click on the link

results: Browser crashes. Talkbalk runs if enabled.

Comment 1

[Jim Race]

Attachment: Test crash file

Comment 2

[Junk_HbJ]

Also crashes for me with 2002061308/Win98SE.
Talkback-ID is TB7350670G

Comment 3

[Matthias Versen [:Matti]]

memset() line 108
PR_ConvertIPv4AddrToIPv6(unsigned int 0, PRIPv6Addr * 0x00000000) line 1529 + 13 
bytes
nsDNSLookup::HostnameIsIPAddress() line 693 + 22 bytes
nsDNSLookup::InitiateLookup() line 709 + 8 bytes
nsDNSLookup::EnqueueRequest(nsDNSRequest * 0x041cedb8) line 784 + 8 bytes
nsDNSService::Lookup(nsDNSService * const 0x01071238, const char * 0x03f26f48, 
nsIDNSListener * 0x03e5121c, nsISupports * 0x00000000, nsIRequest * * 
0x03e51234) line 1476 + 12 bytes
nsSocketTransport::doResolveHost() line 734 + 78 bytes
nsSocketTransport::Process(short 0) line 517 + 8 bytes
nsSocketTransportService::ProcessWorkQ() line 306 + 10 bytes
nsSocketTransportService::Run(nsSocketTransportService * const 0x010bdf3c) line 
552 + 11 bytes
nsThread::Main(void * 0x010bd3a0) line 120 + 26 bytes
_PR_NativeRunThread(void * 0x010c6f60) line 433 + 13 bytes
_threadstartex(void * 0x01015c38) line 212 + 13 bytes
KERNEL32! 77e86523()

-> Networking

Comment 4

[Jim Race]

Whoops. My bad. Marking my own bug as dupe...

*** This bug has been marked as a duplicate of 137322 ***

Comment 5

[benc]

VERIFIED:
Same problem. Thanks for the testcase.

Comment 6

[benc]

VERIFIED.