199042 - If href (in my test 5000 chars at least) is too long browser crashes.

Status: RESOLVED DUPLICATE of bug 121885

(SeaMonkey :: General, defect)

Description

[dtb]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312

In the page at http://kizoku.ath.cx/Staff/Projects/DONOTENTER/index.php there
exist a link that is too long. Normaly it should display a server error that say
"URI too long" but instead of that Mozilla crashes along with X. I suspect a
memory leak. I also do this test with older versions. It seams that 1.0.1 and
0.9 are not affected by this. But 1.3, 1.3a and the latest version of pheonix
have the same results.

I don't have the time to see if this problem is security related but if it is
indeed a memory leak then i am sure a mallicious user can insert a shellcode
somewere in the middle of the link in order to make it execute code in the
visitors machine.
But to be sure i check the security box, this is just to be sure.


Reproducible: Always

Steps to Reproduce:
1. Visit http://kizoku.ath.cx/Staff/Projects/DONOTENTER/
2. click on the "test" link
3. Pray not to crash your X :-)

Actual Results:  
Browser and X windows dies.

Expected Results:  
Mozilla should have followed the link and display an error from the server
stated that this URI is too long.

Comment 1

[Heikki Toivonen (remove -bugzilla when emailing directly)]

I get "This page has been temporarily blocked" on the URL, could you please
enable it again? Please retest with 1.4b as well and let us know if this still
happens.

I don't see this on Win2k, build 20030424. I also do not see this on Linux build
from last week or so with XFT enabled.

Comment 2

[dtb]

i fixed the url permitions. You can check it now.

Comment 3

[Heikki Toivonen (remove -bugzilla when emailing directly)]

I still get the message. Maybe the webserver needs to be restarted.

Comment 4

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Reporter, could you please attach the testcase as I still seem to be unable to
access your test document?

Comment 5

[dtb]

This is the php code i used.

for ($i=0;$i<5000;$i++) $ARRAY.="/xe/xe/xe";

printf("<a href=http://kizoku.ath.cx/Staff/Projects/DONOTENTER/index.php?/%s/>te
st</a>",$ARRAY);

Comment 6

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Attachment: testcase

I still don't see a crash, although my XFT build displays garbled URLbar after
I clicked the link.

Comment 7

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Simon, can you test this?

Comment 8

[Simon Montagu :smontagu]

No crash here (Linux build from CVS this morning). I get a 414 Request URI Too
Large error page.

Comment 9

[Simon Montagu :smontagu]

I think this is a dupe of bug 121885

Comment 10

[georgi - hopefully not receiving bugspam]

I don't crash.
Reporter: This almost sure is a bug in XFree86.
Check
http://groups.google.com/groups?selm=E15j3ky-0001jE-00%40auric.debian.org&oe=UTF-8&output=gplain
* patch #000_post-410: more fixes from xf-4_1-branch:
     + SECURITY: fix glyph clipping for large origin (Keith Packard).
       Reported to be remotly exploitable through konqueror or netscape

Reporter: does konqueror display the long URL ?

Comment 11

[Asa Dotzler [:asa]]

*** This bug has been marked as a duplicate of 121885 ***

Comment 12

[Daniel Veditz [:dveditz]]

Duplicate of public bug, clearing security flag.