firefox hangs (crashes?) when parsing bad xml for rss feeds




12 years ago
7 years ago


(Reporter: poplix, Unassigned)


({crash, hang})

Firefox Tracking Flags

(Not tracked)


(Whiteboard: [sg:dos] recursion crash, URL)


(2 attachments)



12 years ago
User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/419 (KHTML, like Gecko) Safari/419.3
Build Identifier: Firefox

This issue may cause a denial of service due to an infinite recursion. The output of the following perl command can be used to trigger the bug:

print "<?xml version=\"1.0\"?><rss version=\"2.0\">" . ("<x>"x100000) . "\n"

Reproducible: Always

Steps to Reproduce:
1.redirect the outp of the following command to an xml file: print "<?xml version=\"1.0\"?><rss version=\"2.0\">" . ("<x>"x100000) . "\n" that file

3.have fun
Actual Results:  
firefox crashed maybe due to an infinite recursion.
I'm testing a Firefox 1.8 branch build ( on Mac. The provided snippet of code just results in an "XML Parsing Error: no element found" error. With a slightly modified testcase (see http://bug376862:bo^ for both files and their sources), I do see a hang while it attempts to parse the large document, but no crash. px, can you still reproduce the crash? If so, can you point to a working testcase?

Comment 2

12 years ago
In Firefox, I see a hang as well (though Safari does crash). 
Ever confirmed: true
Summary: firefox crashes when parsing bad xml for rss feeds → firefox hangs (crashes?) when parsing bad xml for rss feeds

Comment 3

12 years ago
Reporter's script crashes IE7 as well.

IE7 handle's Gavin's script ok. Safari throws its hands up.

Comment 4

12 years ago
i've tested it against firefox and crashed. Probably i've made a mistake cuz i tested it against firefox 3.0a2pre.en and it crashed but today i've tried it against 3.0a4., that handles this script correctly, and after that 3.0a has handled it as well. So, probaly i got confused. sorry. 
firefox will crash with only, make it hang.
Safari issue has already been reported to apple who's currently working on fixing it.
I know this script makes IE7 crash only on winXP, on vista it's handled correctly. can you confirm this?? IE7 issue has not been reported to MS because i'm still investigating it.

I'm not able to reproduce a crash, testing Firefox with on the Mac. Which OSs have you tested this on?

Comment 6

12 years ago
i've tested it on my powerbookG4
  Machine Name:	PowerBook G4 12"
  Machine Model:	PowerBook6,4
  CPU Type:	PowerPC G4  (1.1)
  CPU Speed:	1.33 GHz
  Memory:	512 MB
with macosx 10.4.9

probably you are not able to reproduce it cuz you machine is more powerfoul than mine (and maybe with a different arch) and the stack has a different behaviour. try to use this perl line to increment the number of tags
print "<?xml version=\"1.0\"?><rss version=\"2.0\">" . ("<x>"x900000) . "\n"
with this line i've succesfully crashed a firefox on a 
  Modello computer:	iMac4,1
  Nome processore:	Intel Core Duo
  Velocità processore:	2 GHz
  Numero di processori:	1
  Numero totale di nuclei:	2
  L2 Cache (per processore):	2 MB
  Memoria:	1 GB
  Velocità bus:	667 MHz

with macosx 10.4.8

on my pbookG4 with 900000 tags i made firefox 3.0.a4pre.en crash in about 30seconds

Created attachment 261817 [details]

Ah, ok, I can reproduce the crash with (added to the above URL). Looks like stack overflow.

Comment 8

12 years ago
Created attachment 261819 [details]
stack from too much recursion on arbitrary XML 

This crashed as I pressed the back button while the beach ball was spinning.


12 years ago
Attachment #261819 - Attachment is patch: false

Comment 9

12 years ago
If you are not the right person to assign this to, please help us find someone that is.
Assignee: nobody → jonas
Whiteboard: [sg:low dos]

Comment 10

12 years ago
(In reply to comment #9)
> If you are not the right person to assign this to, please help us find someone
> that is.

No, I'll take this. Sorry for the delay.
Severity: normal → critical
Keywords: crash, hang
Whiteboard: [sg:low dos] → [sg:dos] recursion crash
Gavin: is this still a problem? If not please resolve "worksforme" (I wasn't able to reproduce in a quick check, but didn't dig and you seem to have a bunch of testcases).
Assignee: sayrer →
Group: core-security
Only remaining issue that I see looks like a dupe of bug 485941.
Assignee: → nobody
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 485941
You need to log in before you can comment on or make changes to this bug.