379150 - Javascript can put the entire system into swap

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Mikhail Simvulidy]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.1.2) Gecko/20061023 SUSE Firefox/2.0.0.2
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.1.2) Gecko/20061023 SUSE Firefox/2.0.0.2

By issuing "s='_';while(1)s+=s" site owner (or anyone in case of XSS on that site) can make a DoS attack by putting entire system into swap.

Reproducible: Always

Steps to Reproduce:
1. Enable swap in your operating system.
2. Make a HTML with Javascript code <script type="text/javascript">s='_';while(1)s+=s"</script>.
3. Open this page in Firefox.
Actual Results:  
System hangs up.

Expected Results:  
Script would terminate when it got too much memory.

Comment 1

[Mikhail Simvulidy]

It would be even better if Firefox would ask user (should it continue or terminate a script) when page uses 10 MB of memory (then 20 MB, 30 MB, ...).

Comment 2

[[:Aleksej]]

Confirmed on
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a5pre) Gecko/20070515 Minefield/3.0a5pre
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a5pre) Gecko/20070515 SeaMonkey/1.5a

mcsmurf had his trunk build terminate the script automatically with "Out of memory" in Error console. Probably it poses some limit on the scripts, but it depends on the RAM amount.

Comment 3

[[:Aleksej]]

*RAM _and_ swap (I have 1.5Gb swap partition and 1Gb of RAM, so it's not easy to stop the program if I let it fill all the RAM)

Comment 4

[Luke Wagner [:luke]]

js> s='_';while(1)s+=s
typein:2: InternalError: allocation size overflow