155598 - icon mime type mismatch in <link rel="shortcut icon" ...> causes Mozilla to crash [@ read_chunk ?]

Status: RESOLVED WORKSFORME

(Core :: Graphics: ImageLib, defect)

Description

[Peter V. Saveliev]

MNG in the <link rel="shortcut icon"...> tag:   
   
- crashes Mozilla on Linux systems   
- crashes it on win9x systems   
- almost hangs w2k systems  
 
An example can be found at http://peet.spb.ru/bug.html

Comment 1

[Olivier Cahagne]

Peter, can you post TAlkback ID for this crash mozilla/bin/components/talkback.exe ?

Comment 2

[Olivier Cahagne]

wfm using build 2002070204 on Win2k (trunk).
Please mention build ID, do you crash with latest nightly build ?

Comment 3

[Peter V. Saveliev]

Mozilla builds that have been tested:  
  
win9x & w2k: build 2002052905  
Linux: build 2002032215, build 2002061013  

Comment 4

[timeless]

Attachment: the mng from the site

the site was serving it as text/plain, you can't do that..

Comment 5

[timeless]

Attachment: loading this should crash your mozilla

Comment 6

[timeless]

Attachment: loading this should crash your mozilla

Comment 7

[timeless]

i was told that talkback didn't get a useful stack, sorry.
TB7969695G TB7969692Y TB7969686E TB7969683X TB7969461Y TB7969414X TB7969405Q 
TB7969400W TB7968904Y

Comment 8

[Kai Lahmann (is there, where MNG is)]

original URL does'n work any more (did first time). loading only the
MNG-Atachment crashes only sometime (else whole GUI would wait ~5 sec)..
testcases load with no favicon shown.

linux, 2002070204

Comment 9

[Peter V. Saveliev]

 Ok, I'm very sorry. Now:   
   
8<------------------------------------------------------------------------   
[peet@peet peet]$ wget --spider -Y off http://peet.spb.ru/anim.mng    
--00:37:05--  http://peet.spb.ru/anim.mng    
           => `anim.mng'    
Resolving peet.spb.ru... done.    
Connecting to peet.spb.ru[195.19.253.86]:80... connected.    
HTTP request sent, awaiting response... 200 OK    
Length: 2,704 [video/x-mng]    
200 OK    
8<------------------------------------------------------------------------   
And all works perfectly. But:   
   
in any way, when there was text/plain instead of video/x-mng, Mozilla have   
been crashed. I think, that's like DoS...  
 

Comment 10

[Boris Zbarsky [:bzbarsky]]

every single one of those stacks just says:

MSVCRT.DLL + 0x1041 (0x78001041) 

Comment 11

[Olivier Cahagne]

I don't crash anymore, however, loading latest testcase increased virtual memory
usage by Mozilla to 600MB, this is using build 2002072208 on Win2k (trunk).

Comment 12

[Olivier Cahagne]

Attachment: Stack trace from build 20021123 (CVS) on Linux loading testcase from comment #6

Comment 13

[Ali Ebrahim]

*** Bug 231958 has been marked as a duplicate of this bug. ***

Comment 14

[Ronald Tilby]

URL and Testcases WFM using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060529 Minefield/3.0a1 ID:2006052910

Comment 15

[Jesse Ruderman]

WFM.  MNG support was removed years ago.  I'm sure we would have heard from others if a mime type mismatch was all it took to crash Firefox, since a huge percentage of favicons have the wrong mime type.