337592 - hang on exit with 3rd party pkcs module. leaves profile unlocked such that second firefox process is possible.

Status: RESOLVED WORKSFORME

(Core :: Security, defect)

Description

[Lubos Stanek]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; cs-CZ; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; cs-CZ; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

The application is left in the memory after exit with minimal process time and consumes almost all of the recently used memory size. The profile is unlocked. Another start and exit of the application leaves another instance in the memory.
The card reader was empty in the time of tests.

Module:
SetTokI - Setec's Cryptoki (part of the Setec's Setweb application)
settoki.dll
No Versioninfo.
Creation Date: 24/05/2005  20:48:41 
Last Modif. Date: 13/09/2004  20:43:54 
Last Access Date: 11/05/2006  14:31:32 
FileSize: 319488 bytes

Reproducible: Sometimes

Steps to Reproduce:
1. Load Setec's PKI module.
Actual Results:  
The application instance hangs on exit after the security module initialization.

Expected Results:  
Probably release the module and continue exit?

The described behaviour was detected when using third party PKCS#11 module in all recent builds of Mozilla, Firefox and Thunderbird.
The similar behaviour was observed also in Windows XP Pro on Acer TravelMate 8100 with embedded smart card reader.

Comment 1

[Wayne Mery (:wsmwk)]

Did this work under a previous version of firefox?  

Please set version to 1.5 or trunk if it happens with trunk build (have you tried a trunk? http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/ )

Comment 2

[Lubos Stanek]

(In reply to comment #1)
I think that previous 1.0.x versions did not expose this behaviour.

I cleaned the previous installation, removed profile and installed nightly/latest-trunk firefox-3.0a1.en-US.win32
(Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060511 Minefield/3.0a1).
I opened Tools-Options-Advanced-Security Devices.
I loaded new PKCS#11 module in the Device Manager.
Module was loaded showing a connection to the smartcard reader (in my case SchlumbergerSema Reflex USB v.2.0 - no card).
I closed Firefox, the application stays in memory.
I started another instance, opened simple pages (http://), this instance exits well.
I started another instance, opened https://addons.mozilla.org/..., this instance stays in memory again.
I started another instance, put nonexistent address https://ftp.mozilla.org/, this instance stays in memory again.

Comment 3

[Lubos Stanek]

(In reply to comment #1)
I have verified a similar behaviour on another hardware/system: Acer TravelMate 8100 Notebook with built-in smartcard reader, Windows XP Pro, all recent versions of Firefox, Thunderbird and the trunk build (see comment #2).

I have tested versions 1.55 and 1.70 of the offending software (Setec's SetWeb application). According to the application's User's Guide, this software is compatible with Mozilla 1.4, 1.6 and 1.73, Mozilla Firefox 1.0, Netscape 7.1.

I will also try to inform the application's producer.

I hope this help you a bit.

Comment 4

[Stephanie Daugherty [:sdaugherty]]

As I understand this, it will take special hardware to replicate. The details needed seem to be there, so confirming and triaging to Core/Security where someone hopefully has access to the hardware needed to test this.

Comment 5

[Lubos Stanek]

It depends on the third party PKCS#11 module.
I have checked it with GemPC Twin, GemPC 430, SchlumbergerSema Reflex USB and Acer TravelMate 8100 Notebook's card readers.

I also contacted the manufacturer. They replied immediatelly, that they know about it and that it is the browser's issue.

The same PKCS#11 module works with Firefox 1.0.x series and does not work with 1.5.x - 3.0x series.

I do not have acces to another third party PKCS#11 module to verify it.

Comment 6

[Wayne Mery (:wsmwk)]

lubos, does this reproduce with FF 3.5 beta? http://www.mozilla.com/en-US/firefox/all-beta.html

Comment 7

[Florian Bender]

Is this still an issue?

Comment 8

[Thomas Bertels]

No answer of the bug author or anyone in 9 years and only 2 votes.
I think it's safe to mark as WORKSFORME.

Feel free to add a comment if this is still an issue.
Optionally, a link to the website of the software needed to reproduce would be helpful too.