332602 - crashes found by hamachi fuzzer at metasploit

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Tracking, defect)

Description

[Bernd]

The folks there released a fuzzer which they claim crashes 1.0.7 and other browsers. I think we need to watch them as they will not file bugs. The current version (0.4) is difficult to run as it is single javascript thread which will cause the long script protection to kick in

Comment 1

[Bernd]

Attachment: hamachi with setTimeout

Comment 2

[Bernd]

I modified the testcase v0.4 so that it does use TimeOut and shows somehting in the console its intended for use with debug builds. It seems to hang somehow in the Applet testcase. After it hangs the browser goes into semi zombie state.

> WARNING: requested removal of nonexistent window
> GetPrimaryFrameFor() called while nsFrameManager is being destroyed!

Comment 3

[Martijn Wargers (dead)]

Bernd, other people also noticed about this fuzzer, see bug 332606.

Comment 4

[Daniel Veditz [:dveditz]]

The testcase is public and blogged about in various places, what does a private bug buy us vs. the obvious duping?

I guess we could talk about specific results in private, but we could do that in any linked bugs. A public bug would give us a spot to hang any publicly found crashes (like the Zalewski bug).

We've got an improved script here we may or may not want to share, then again if anyone tries to run the stock script it does fix a rather obvious annoyance. The next obvious step is to augment the tool by adding Mozilla-specific terms to the arrays.

So we can
 1) dupe 332606 here and make this public
 2) use 332606 to link crashes with stock hamachi and any future revisions,
    and morph this one into a parallel bug for "private improved hamachi"

Comment 5

[Bernd]

*** Bug 332606 has been marked as a duplicate of this bug. ***

Comment 6

[Bernd]

->public

Comment 7

[Bernd]

seems they learned the setTimeout trick allready http://metasploit.com/users/hdm/tools/see-ess-ess-die/cssdie.html

Comment 8

[Jesse Ruderman]

But he's using setInterval where he means setTimeout, which tends to cause problems (e.g. bug 261633).

Comment 9

[BMO Automation]

Marking all tracking bugs which haven't been updated since 2014 as INCOMPLETE.
If this bug is still relevant, please reopen it and move it into a bugzilla component related to the work
being tracked. The Core: Tracking component will no longer be used.