2018434 - stack overflow in CSSUnparsedValue

Status: RESOLVED DUPLICATE of bug 1973126

(Core :: CSS Parsing and Computation, defect)

Description

[ret2happy]

Attachment: poc.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15

Steps to reproduce:

Run the poc.html on the firefox to reproduce the ASAN crash

Actual results:

Crash with stack-overflow, see asan.txt for detail

Expected results:

NO ASAN CRASH

Comment 1

[ret2happy]

Attachment: asan.txt

Comment 2

[Emilio Cobos Álvarez [:emilio]]

A stack overflow is a content process DOS but not sure I'd qualify as a security bug. In general we don't protect about stack overflows on css parsing just like we don't protect against an OOM if you send us a really massive stylesheet.

ASAN builds also take a lot more stack space.

Let me know if I'm missing something tho. Also I'm confused, there's no CSSUnparsedValue anywhere in the ASAN report? That's a TypedOM thing.

Comment 3

[Andrew McCreight [:mccr8]]

Yes, a stack overflow is different from an out of bounds access to the stack.

Comment 4

[ret2happy]

Yeah I agree stack-overflow isn't a security issue. Free free to close it. Many thanks!