1548382 - MOZ_CRASH(IPC message size is too large) causing firefox.exe crash instantly when pasting large amount of input in text field

Status: NEW

(Core :: DOM: Content Processes, defect, P2)

Description

[karann salunke]

Vulnerbility: buffer overflow

Firefox version: 66.0.3 (64 bit)

Description and Impact: so i was testing for my webapp buffer overflow and from that i found this bug.in this vulnerbility if you inject a long letter or word in any website you are using on firefox or directly into firefox url field it causes firefox to crash instantly. i have tried it with chromium to verify if this is a valid issue or not and after testing the same thing on chromium and other browsers it is clear that firefox is vulnerable to this attack. so now while typing this report i tried to copy firefox version and tried to paste it in here it got crashed instantly. lol
an attacker can send a forged url link just to crash firefox in one second. so this is pretty critical for userfox users if they use it for office work and for creating projects.

How to reproduce: 1>copy the long letters from my poc .txt file

2>and now paste it into any website search bar or any input field and also with in firefox blank url.

3>thats it you dont even have to hit enter firefox will crash instantly or stop responding right away.

POC: attaching a demo video (including chromium crash verification) and the .txt buffer overflow file.

so i can only upload one file so i am uploading demo poc video here.

Comment 1

[karann salunke]

Attachment: bufferoverflow.zip

this one is the .txt file inside .zip file.

Comment 2

[karann salunke]

Attachment: 2019-05-02 02-16-32-1.m4v

this is demo poc video...i had to compress it ..so follow these steps for more details.

Comment 3

[:Gijs (away/busy until Mar 10)]

If you go to about:crashes in Firefox, can you copy some links to the most recent crashes generated using this PoC that the crash reporter has sent us, and paste them as a comment here? Thanks.

Comment 4

[karann salunke]

https://crash-stats.mozilla.org/report/index/34e1ce43-fc3e-401c-b278-0d84d0190502#allthreads

heres the link for the letest crash caused by poc.

Comment 5

[karann salunke]

you can type this long msg in any input field ..like even in firefox search or options search menu and will crash instantly.

Comment 6

[:Gijs (away/busy until Mar 10)]

This is a safe crash ("MOZ_CRASH(IPC message size is too large)"), not a "buffer overflow".

Comment 7

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Simplified STR: navigate to data:text/html,<textarea>, run something like perl -e 'print "A"x(128*1048576)' | pbcopy for Mac or … | xclip -i on X11, paste into the text area.

That crashes serializing the reply to PContent::GetClipboard, which is using the nsString variant of IPCDataTransferData but in theory could be changed to use the Shmem variant for long strings (or just refuse to paste them). The message size limit is 256MiB, which is 128M code units of UTF-16.

Additionally, with a 64MiB string, pasting succeeds but selecting the text with Select All crashes trying to send PBrowser::NotifyIMESelection (bp-207b9cf2-2cf3-4797-8920-00fb50190502); that may need to be broken out into a separate bug.

Comment 8

[karann salunke]

okay so what now..am i getting bounty or not? :-)

Comment 9

[karann salunke]

sir when you put that text thats when it gets crashed...same thing i have tried with chromium and microsoft edge and they dont get crashed plus when you put that text input field you get a error it dont crash and also you can use other tabs for browsing which dont happen in firefox case.
safe crash dont make browser unusable untill restart.

Comment 10

[karann salunke]

(In reply to Jed Davis [:jld] ⟨⏰|UTC-6⟩ ⟦he/him⟧ from comment #7)

Simplified STR: navigate to data:text/html,<textarea>, run something like perl -e 'print "A"x(128*1048576)' | pbcopy for Mac or … | xclip -i on X11, paste into the text area.

That crashes serializing the reply to PContent::GetClipboard, which is using the nsString variant of IPCDataTransferData but in theory could be changed to use the Shmem variant for long strings (or just refuse to paste them). The message size limit is 256MiB, which is 128M code units of UTF-16.

Additionally, with a 64MiB string, pasting succeeds but selecting the text with Select All crashes trying to send PBrowser::NotifyIMESelection (bp-207b9cf2-2cf3-4797-8920-00fb50190502); that may need to be broken out into a separate bug.

any update on this sir?

Comment 11

[karann salunke]

(In reply to :Gijs (he/him) from comment #6)

This is a safe crash ("MOZ_CRASH(IPC message size is too large)"), not a "buffer overflow".

this issue still exist on letest firefox version 66.0.4

Comment 12

[Daniel Veditz [:dveditz]]

(In reply to karann salunke from comment #8)

okay so what now..am i getting bounty or not? :-)

It does not appear that you've submitted this for bounty consideration. Did you manually enter the whiteboard data yourself, copying other bugs? Yes those things are added by our submission form, but those are for statistics purposes and aren't actually part of the notification to the bounty committee. Please follow the instructions at https://www.mozilla.org/en-US/security/client-bug-bounty/ (since the bug is already submitted you can't use the form so you'll have to use the mail option).

Given the current state of the bug this appears to be a "Denial of Service" vulnerability so it's unlikely to be eligible for a bounty. See our FAQ: https://www.mozilla.org/en-US/security/bug-bounty/faq/#eligible-bugs

Comment 13

[karann salunke]

(In reply to Daniel Veditz [:dveditz] from comment #12)

(In reply to karann salunke from comment #8)

okay so what now..am i getting bounty or not? :-)

It does not appear that you've submitted this for bounty consideration. Did you manually enter the whiteboard data yourself, copying other bugs? Yes those things are added by our submission form, but those are for statistics purposes and aren't actually part of the notification to the bounty committee. Please follow the instructions at https://www.mozilla.org/en-US/security/client-bug-bounty/ (since the bug is already submitted you can't use the form so you'll have to use the mail option).

Given the current state of the bug this appears to be a "Denial of Service" vulnerability so it's unlikely to be eligible for a bounty. See our FAQ: https://www.mozilla.org/en-US/security/bug-bounty/faq/#eligible-bugs

but this is not a case of dos attack sir...its buffer overflow...i have submitted many reports like this on bugcrowd and got bounties from websites which i tried with similar attacks.

Comment 14

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

It's not a buffer overrun, it's an assertion failure; we're intentionally and safely terminating the program. Here's the code.

Comment 15

[karann salunke]

okay thank you for your time.

Comment 16

[Al Billings [:abillings - ex-MoCo]]

Minusing for bounty as this is not a severe issue and does not qualify.

Comment 17

[karann salunke]

Attachment: TESXS (2).SVG

test

Comment 18

[karann salunke]

Attachment: x12 (1).svg

agdeha

Comment 19

[karann salunke]

Attachment: 1 (1).svg

THIS IS STORED XSS TEST

Comment 20

[:Gijs (away/busy until Mar 10)]

(In reply to karann salunke from comment #19)

Created attachment 9262055 [details]
1 (1).svg

THIS IS STORED XSS TEST

Please do not use bugzilla.m.o for testing, use https://bugzilla.allizom.org instead. You can login with a github login.