168960 - viewing files terminated with "&#" and no end of line character causes severe memory leak

Status: RESOLVED WORKSFORME

(Core :: DOM: HTML Parser, defect, P3)

Description

[gwn]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.0) Gecko/20020529

When an HTML or text file is loaded that has the two characters "&#" at its end
and the last line is not terminated with a newline character, Mozilla eats all
available memory (causing the Linux kernel to kill all user processes).

Reproduction:
Open a file that contains only the two characters "&#" (hexadecimal 26 23) and
no end of line. Observe memory consumption.

Actual Result:
Memory is consumed at a rate of ca. 50 MB per second with the obvious
consequences.

I first discovered the bug on the URL
http://216.239.37.100/search?q=cache:kSd8B2wq_h0C:www.math.utah.edu:8080/pub/tex/bib/scicomputprogram.html+%22An+exercise+in+the+transformational+derivation%22&hl=en&ie=UTF-8
from where I traced it down to the 2-byte file described above.

Comment 1

[harishd]

I was not able to reproduce the memory consumption with just the two characters
( &# ), however, I did notice it ( mem. consumption ) when I requested the URL.

Comment 2

[harishd]

Stepped into the debugger and noticed a problem in the parser. Thanks,
[e-mail], for catching this.

Comment 3

[harishd]

Attachment: Testcase [ indicated by the reporter ]

Comment 4

[harishd]

Attachment: patch v1.0

This patch fixes an infinite loop that occurs when an entity like syntax
appears at the end of an html file. When such a syntax appears, in the final
buffer, then instead of trying to consuming it as an entity, and failing
repeatedly, it should be consumed as text.

Comment 5

[Torben]

Bug 163988 (crash with HREF="&#...) might be related.

Comment 6

[Mats Palmgren (inactive)]

WFM, 2003-06-25-05 trunk Linux.  I believe this was fixed by bug 188278.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Marking WFM based on past comments and my own inability to reproduce this.