263394 - RDF/XML live bookmark with bad tags crashes browser with a seg fault.

Status: RESOLVED FIXED

(Firefox :: Bookmarks & History, defect)

Description

[Stephen A]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041003 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20041003 Firefox/0.10.1

Preface: The given URL is subject to change content as it's in testing. I've
pasted the full source text of the RDF in below.

After saving the given URL as a live bookmark, the browser crashes. In the
nightly build I tried restarting the browser which worked fine until I clicked
the bookmark menu.

Reproducible: Always
Steps to Reproduce:
1. In the bookmark menu, add the URL to a live bookmark.
2. Witness crash.
3. Browser seems to restart and run OK until you click the Bookmarks menu. I am
assuming the crash happens at the time when the XML is parsed.

Actual Results:  
browser crashes with seg fault:

./firefox/run-mozilla.sh: line 423:  8360 Segmentation fault      "$prog" ${1+"$
                                @"}

Expected Results:  
expected no crash. I would like to see the browser either reject a bad live
bookmark or just handle it.

The browser problem is readily fixed in the near term by removing the relevant
line from bookmarks.html and restarting the browser.

The bad XML in the bookmark is near the end, the <strong> and </strong> tags
should not be there. Checked this against the WC3 validator, also if I remove
the strong tags and load it locally it works fine.

here's the full text/source of the current contents of that bookmark in case
it's needed:

-----

<?xml version="1.0" encoding="UTF-8"?>

<rdf:RDF
 xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
 xmlns="http://purl.org/rss/1.0/"
 xmlns:dc="http://purl.org/dc/elements/1.1/"
 xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/"
 xmlns:syn="http://purl.org/rss/1.0/modules/syndication/"
>

<channel rdf:about="http://www.chron.com">
<title>HoustonChronicle.com -- Chronicle</title>
<link>http://www.chron.com</link>
<description>HoustonChronicle.com -- Chronicle</description>
<items>
 <rdf:Seq>
  <rdf:li
rdf:resource="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835156" />
  <rdf:li
rdf:resource="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835101" />

  <rdf:li
rdf:resource="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835040" />
  <rdf:li
rdf:resource="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835009" />
  <rdf:li
rdf:resource="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834979" />
  <rdf:li
rdf:resource="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834819" />
  <rdf:li
rdf:resource="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834686" />
  <rdf:li rdf:resource="http://www.chron.com/business" />
  <rdf:li rdf:resource="http://www.chron.com/sports" />
  <rdf:li rdf:resource="http://www.chron.com/classifieds" />
 </rdf:Seq>

</items>
<image
rdf:resource="http://images.chron.com/content/common/masts/hcinsideicon.gif" />
</channel>

<image rdf:about="http://images.chron.com/content/common/masts/hcinsideicon.gif">
<title>HoustonChronicle.com</title>
<url>http://images.chron.com/content/common/masts/hcinsideicon.gif</url>
<link>http://www.chron.com</link>
</image>

<item rdf:about="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835156">
<title>DeLay rebuked again for ethics violations</title>
<link>http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835156</link>

<description>For the second time in less than a week, the House ethics committee
admonished Republican leader Tom DeLay late Wednesday for two more breaches of
House rules.</description>
</item>

<item rdf:about="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835101">
<title>Astros strike first behind gritty Rocket</title>
<link>http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835101</link>
<description>Long accustomed to having doors shut on them by the Atlanta Braves
in the playoffs, the Astros opened their own doors with authority. Roger Clemens
and his teammates refused to be denied Wednesday, when they pummeled the Braves
9-3 in Game 1 of the best-of-five Division Series, validating their claim that
these aren't the same ol' Astros.</description>
</item>

<item rdf:about="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835040">
<title>Texans' hope Vikings backup RB remains obscure</title>
<link>http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835040</link>

</item>

<item rdf:about="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835009">
<title>Low achievement scores shock 2 schools</title>
<link>http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2835009</link>
<description> For Houston's T.H. Rogers Elementary and Katy's Pattison
Elementary, the day Texas releases annual campus ratings has always been a time
for celebrating.</description>
</item>

<item rdf:about="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834979">
<title>Anti-gay marriage laws may harm black unions more</title>
<link>http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834979</link>

<description> The Rev. Carolyn J. Mobley and her partner, Adrain Bowie, say they
consider themselves &quot;thrice blessed&quot; as black, gay women. Not everyone
they encounter shares the sentiment. &quot;Those who don't want to acknowledge
the whole of me, God bless them,&quot; Bowie said Wednesday. &quot;They've
missed out on the blessing of me.&quot;</description>
</item>

<item rdf:about="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834819">
<title>Mayor seeks smoking ban in restaurants, not bars</title>
<link>http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834819</link>

<description> Houston restaurants may soon be smoke-free. Mayor Bill White is
drafting an ordinance that would ban smoking in restaurants, but not in
bars.</description>
</item>

<item rdf:about="http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834686">
<title>County has no flu vaccine for adults</title>
<link>http://www.chron.com/cs/CDA/ssistory.mpl/chronicle/2834686</link>
<description>Thousands of low-income adults won't be getting their annual flu
shot from county health centers or hospitals this year because the Harris County
Hospital District's entire 60,000-dose order has been canceled.</description>
</item>

<item rdf:about="http://www.chron.com/business">
<title><strong>HoustonChronicle.com Business</strong></title>

<link>http://www.chron.com/business</link>
</item>

<item rdf:about="http://www.chron.com/sports">
<title><strong>HoustonChronicle.com Sports</strong></title>
<link>http://www.chron.com/sports</link>
</item>

<item rdf:about="http://www.chron.com/classifieds">
<title><strong>HoustonChronicle.com Classifieds</strong></title>
<link>http://www.chron.com/classifieds</link>
</item>

</rdf:RDF>

Comment 1

[Stephen A]

Just confirmed this with 1.8a5 as well

Comment 2

[Stephen A]

Just attempted to duplicate on windows2k with firefox 0.10.1/1.7.3, no crash but
it got all wiggy on me. Started going slow and not loading pages as would
normally be expected. Also, I closed the browser window, but the task manager
showed firefox.exe process still running several minutes later. Removed the
bookmark from bookmarks.html, restarted firefox, and everything rosy again.

Comment 3

[Phil Ringnalda (:philor)]

-> Firefox

Comment 4

[Phil Ringnalda (:philor)]

Attachment: reporter's testcase

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: 263394-rdfxml-live-bookmark-with-bad-tags-crashes-0.patch

Whoops; we need to make sure that the title/link point to a literal.

Comment 6

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 161812 [details] [diff] [review]
263394-rdfxml-live-bookmark-with-bad-tags-crashes-0.patch

Yeah, that's a good one to fix.

Comment 7

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs, filter on "beltznerLovesGoats" to get rid of this mass change