166835 - 10.2: InitWithNativePath crashes when given a path with an extremely long component

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Conrad Carlen (not reading bugmail)]

Bug 160006 and bug 159987 are both manifestations of this problem - combining
into this bug.

Comment 1

[Conrad Carlen (not reading bugmail)]

*** Bug 160006 has been marked as a duplicate of this bug. ***

Comment 2

[Conrad Carlen (not reading bugmail)]

*** Bug 159987 has been marked as a duplicate of this bug. ***

Comment 3

[Conrad Carlen (not reading bugmail)]

Other test case: http://hopey.mcom.com/tests/security/buffer-overflow/a-value.html

For both, the file must be saved locally to see the crash.
This is happening only on 10.2 with the nsLocalFile impl used by Chimera.
The crash happens because ::CFURLGetFSRef crashes when fed such a path - new bug
in 10.2.

Comment 4

[sairuh (rarely reading bugmail)]

Attachment: test file with file:/// protocol

thanks to sfraser for the testcase.

Comment 5

[sairuh (rarely reading bugmail)]

all you need to do to crash is click the link to attachment 97983 [details] --you don't
even have to download it locally. the change here is that "file:///" was
prepended to the src value.

going to come up with more tests to narrow this down...

Comment 6

[Conrad Carlen (not reading bugmail)]

Attachment: immediately rejects paths with are too long

Comment 7

[sairuh (rarely reading bugmail)]

more tests...

a. Where the IMG src value is in the format
file:///<400_alphanumeric_char>/blah.txt:
http://hopey.mcom.com/tests/security/buffer-overflow/img-fileProtocol1.html

b. Where the IMG src value is in the format
file:///foopy/<396_alphanumeric_char>.txt:
http://hopey.mcom.com/tests/security/buffer-overflow/img-fileProtocol2.html

c. Where the IMG src value is in the format
"file:///<400_alphanumeric_char>/<396_alphanumeric_char>.txt:
http://hopey.mcom.com/tests/security/buffer-overflow/img-fileProtocol3.html

Comment 8

[sairuh (rarely reading bugmail)]

none of the three tests in comment 9 crashed chimera (2002.09.05.05) on 10.2.

Comment 9

[Simon Fraser [no longer active]]

Comment on attachment 97994 [details] [diff] [review]
immediately rejects paths with are too long

r=sfraser

Comment 10

[sairuh (rarely reading bugmail)]

tested IE: none of the tests (comment 9 or the attachment) caused a crash.

tested OmniWeb: like chimera, the tests in comment 9 are fine, but the test
attachment resulted in a crash.

Comment 11

[sairuh (rarely reading bugmail)]

Attachment: test with 2048 char path

clicking on this will cause chimera to crash.

Comment 12

[sairuh (rarely reading bugmail)]

Attachment: 2048 char path, where the 1024th char is /

similar to attachment 98007 [details], except that the 1024th character has been replaced
with / (forward slash). clicking this also crashes chimera.

Comment 13

[sairuh (rarely reading bugmail)]

side note: when the path was 1024-1030 char long, i did get a crash.

Comment 14

[sairuh (rarely reading bugmail)]

arrgh, typo. s/did/did NOT. 1024-1030 char path would not result in a crash.

Comment 15

[Conrad Carlen (not reading bugmail)]

Fixed - works against the latest two test cases (whew - which were being posted
as I was checking in fix)