172339 - Incorrect domain name under SSL crashes browser [@ js_GetSlotThreadSafe][@ 0x00090005]

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[Nick Lott]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2b) Gecko/20021001
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2b) Gecko/20021001

Visiting a site under SSL using a domain name that is not on the cert (eg an IP
address) crashes mozilla. For example:

https://uk1.games-workshop.com & https://195.33.99.36 both crash the browser 

https://uk.games-workshop.com does not. 

Reproducible: Always

Steps to Reproduce:
1. https://195.33.99.36

Actual Results:  
Crash

Expected Results:  
Show a warning that the domain name was not the same as on the certificate, but
was otherwise valid.

Comment 1

[Nick Lott]

Sorry, Talkback ID 11974351W

Comment 2

[greer]

I believe this goes to DOM events. Correct me if I'm wrong.

Product ID  MozillaTrunk
Build ID 2002100108
Operating System Windows NT 5.0 build 2195
URL visited going to an ssl site
User Comments going to an ssl site with an invalid certificate

Stack Trace
0x00090005
js_GetSlotThreadSafe [c:/builds/seamonkey/mozilla/js/src/jslock.c, line 563]
JS_GetPrivate [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 1928]
nsScriptSecurityManager::GetFunctionObjectPrincipal
[c:/builds/seamonkey/mozilla/caps/src/nsScriptSecurityManager.cpp, line 1786]
nsScriptSecurityManager::GetFramePrincipal
[c:/builds/seamonkey/mozilla/caps/src/nsScriptSecurityManager.cpp, line 1820]
nsScriptSecurityManager::GetPrincipalAndFrame
[c:/builds/seamonkey/mozilla/caps/src/nsScriptSecurityManager.cpp, line 1833]
nsScriptSecurityManager::GetSubjectPrincipal
[c:/builds/seamonkey/mozilla/caps/src/nsScriptSecurityManager.cpp, line 1873]
nsScriptSecurityManager::GetSubjectPrincipal
[c:/builds/seamonkey/mozilla/caps/src/nsScriptSecurityManager.cpp, line 1607]
nsScriptSecurityManager::SubjectPrincipalIsSystem
[c:/builds/seamonkey/mozilla/caps/src/nsScriptSecurityManager.cpp, line 1635]
GlobalWindowImpl::CheckSecurityIsChromeCaller
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 2110]
GlobalWindowImpl::IsCallerChrome
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 2124]
GlobalWindowImpl::Focus
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 2376]
nsWebShellWindow::HandleEvent
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp, line 612]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1067]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1084]
nsWindow::DispatchFocus
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5445]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 4119]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1333]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x39a3 (0x77e139a3)
USER32.DLL + 0x395f (0x77e1395f)
ntdll.dll + 0x2032f (0x77fa032f)
USER32.DLL + 0x569d (0x77e1569d)
PeekKeyAndIMEMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsAppShell.cpp, line 103]
nsAppShell::Run [c:/builds/seamonkey/mozilla/widget/src/windows/nsAppShell.cpp,
line 169]
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 472]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1538]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1886]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1906]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08)

Comment 3

[Kalle Valo]

WFM, Linux cvs trunk.

Comment 4

[Boris Zbarsky [:bzbarsky]]

This would be security manager, actually.  Or JS engine at next shot.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Let's start with PSM.

Comment 6

[John Unruh]

Both the mentioned sites works for me. Reporter, can you try a new nightly
build, installed into a clean directory?

Comment 7

[John Unruh]

Verified WFM.