User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/419 (KHTML, like Gecko) Safari/419.3 Build Identifier: Firefox 220.127.116.11 This issue may cause a denial of service due to an infinite recursion. The output of the following perl command can be used to trigger the bug: print "<?xml version=\"1.0\"?><rss version=\"2.0\">" . ("<x>"x100000) . "\n" Reproducible: Always Steps to Reproduce: 1.redirect the outp of the following command to an xml file: print "<?xml version=\"1.0\"?><rss version=\"2.0\">" . ("<x>"x100000) . "\n" 2.open that file 3.have fun Actual Results: firefox crashed maybe due to an infinite recursion.
I'm testing a Firefox 1.8 branch build (18.104.22.168pre) on Mac. The provided snippet of code just results in an "XML Parsing Error: no element found" error. With a slightly modified testcase (see http://bug376862:firstname.lastname@example.org/bug/376862/ for both files and their sources), I do see a hang while it attempts to parse the large document, but no crash. px, can you still reproduce the crash? If so, can you point to a working testcase?
In Firefox, I see a hang as well (though Safari does crash).
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: firefox crashes when parsing bad xml for rss feeds → firefox hangs (crashes?) when parsing bad xml for rss feeds
Reporter's script crashes IE7 as well. IE7 handle's Gavin's script ok. Safari throws its hands up.
i've tested it against firefox 22.214.171.124 and crashed. Probably i've made a mistake cuz i tested it against firefox 3.0a2pre.en and it crashed but today i've tried it against 3.0a4., that handles this script correctly, and after that 3.0a has handled it as well. So, probaly i got confused. sorry. firefox 126.96.36.199 will crash with feed-reporter.pl only, feed.pl make it hang. Safari issue has already been reported to apple who's currently working on fixing it. I know this script makes IE7 crash only on winXP, on vista it's handled correctly. can you confirm this?? IE7 issue has not been reported to MS because i'm still investigating it. -poplix
I'm not able to reproduce a crash, testing Firefox 188.8.131.52 with feed-reporter.pl on the Mac. Which OSs have you tested this on?
i've tested it on my powerbookG4 Machine Name: PowerBook G4 12" Machine Model: PowerBook6,4 CPU Type: PowerPC G4 (1.1) CPU Speed: 1.33 GHz Memory: 512 MB with macosx 10.4.9 probably you are not able to reproduce it cuz you machine is more powerfoul than mine (and maybe with a different arch) and the stack has a different behaviour. try to use this perl line to increment the number of tags print "<?xml version=\"1.0\"?><rss version=\"2.0\">" . ("<x>"x900000) . "\n" with this line i've succesfully crashed a firefox 184.108.40.206 on a Modello computer: iMac4,1 Nome processore: Intel Core Duo Velocità processore: 2 GHz Numero di processori: 1 Numero totale di nuclei: 2 L2 Cache (per processore): 2 MB Memoria: 1 GB Velocità bus: 667 MHz with macosx 10.4.8 on my pbookG4 with 900000 tags i made firefox 3.0.a4pre.en crash in about 30seconds cheers
Created attachment 261817 [details] stack Ah, ok, I can reproduce the crash with feed-reporter-900000.pl (added to the above URL). Looks like stack overflow.
Created attachment 261819 [details] stack from too much recursion on arbitrary XML This crashed as I pressed the back button while the beach ball was spinning.
If you are not the right person to assign this to, please help us find someone that is.
Assignee: nobody → jonas
Whiteboard: [sg:low dos]
(In reply to comment #9) > If you are not the right person to assign this to, please help us find someone > that is. > No, I'll take this. Sorry for the delay.
Assignee: jonas → sayrer
Gavin: is this still a problem? If not please resolve "worksforme" (I wasn't able to reproduce in a quick check, but didn't dig and you seem to have a bunch of testcases).
Assignee: sayrer → gavin.sharp
Only remaining issue that I see looks like a dupe of bug 485941.
Assignee: gavin.sharp → nobody
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 485941
You need to log in before you can comment on or make changes to this bug.