448884 - wmp 9.00.00.3354 crashes when repeatedly loaded with empty src [@ wmvcore.dll@0x42272]

Status: RESOLVED INCOMPLETE

(Plugins Graveyard :: Windows Media Player (Microsoft), defect)

Description

[chris hofmann]

http://www.0x000000.com/?i=625
blog posted on: 02 08 08
	
→


First off, I am not sure why it crashes. So I am going to speculate on this obvious stability issue a bit here. When I create an embedded object with a mime-type set to application/x-mplayer2, Firefox 3 raises a plugin warning. Doing this 10 consecutive times, Firefox instantly crashes. Now, my hunch is that in Firefox they've build in some protection against malicious plugins being sourced from remote locations. Sounds fair enough, because a plugin should reside at the owners website, or at a known plugin page like Microsoft or Adobe. So without the mime-type, Firefox just prompts that it needs the Media Player plugin, which in term I do not have in Firefox. The difference is the mime-type that I set for the application I want to embed. This also sparked my new interest in mime-type fuzzing.

Proof of concept:

<script>



  for(i=0;i<11;++i){



    document.write('<embed src="" pluginspage="file://" type="application/x-mplayer2">');



  }



</script>



My guess is that it happens around line 6522 of the nsPluginHostlImp.ccp where nsresult rv is already NS_OK; while we did not press the confirmation button on a second run:

http://mxr.mozilla.org/firefox/source/modules/plugin/base/src/nsPluginHostImpl.cpp#6522

Firefox warns users with a popup indicating plugin abuse, but to give hints into restarting Firefox seems a bit off base to me. In any case, I just found it and it needs some more investigation why this happens, it certainly means that Firefox 3 is far from being stable yet.

Comment 1

[chris hofmann]

I've reproduced the crash on windows builds of both fx2.x and fx3.x

waiting for stack traces out of talback and socorro

Comment 2

[chris hofmann]

test case at http://people.mozilla.com/~chofmann/security/test-mime-crash.html

Comment 3

[chris hofmann]

looks like we are off in the plugin when we crash

0  	wmvcore.dll  	wmvcore.dll@0x42272  	
1 	wmvcore.dll 	wmvcore.dll@0x2ae84 	
2 	wmvcore.dll 	wmvcore.dll@0xd316 	
3 	wmvcore.dll 	wmvcore.dll@0xf257 	
4 	wmnetmgr.dll 	CStreamerCallbackMessenger::OnIoCompletion 	
5 	wmnetmgr.dll 	_alldiv 	
6 	wmnetmgr.dll 	CNSIoCompletionPortNT::WaitAndServeCompletions 	
7 	wmnetmgr.dll 	CWorkThreadManager::CWorkerThread::ThreadMain 	
8 	wmnetmgr.dll 	CWMThread::ThreadFunc 	
9 	kernel32.dll 	BaseThreadStart

Comment 4

[chris hofmann]

more details on the report above are at http://crash-stats.mozilla.com/report/index/673e0e94-60d5-11dd-91d9-001a4bd43ef6?p=1

Comment 5

[Frank Wein [:mcsmurf]]

Chris: What media player version do you have installed? And what plugin version (there's this special Firefox plugin from Microsoft)?

Comment 6

[chris hofmann]

http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=48293376

has the similar crash report from 2.x

wmp 9.00.00.3354 is the version of the player that is installed on the vm where I'm testing.

Comment 7

[chris hofmann]

I was offered an upgrade to wmp so I took it.  testing both fx2.x and 3.x I'm not able to get the crash (yet?) with the wmp 11.0.5721.5145 version installed and lots of attempts to reload the test URL.

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

Try upping the bound on the loop to make sure?

Comment 9

[chris hofmann]

I doubled, then tripled the loop.  Still no crash on the fx3/wmp11 combo.  

When I was able to generate the crashes it looked like it might be more timing related that hitting some kind of memory or other boundry.

Comment 10

[Benjamin Smedberg]

Closing old bugs in the Plugins component. We aren't going to track issues in 3rd-party plugins in the Mozilla bug tracker. In addition, support for NPAPI plugins will be removed at the end of this year; for more details see the post at https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/

If there is a serious bug in Firefox, it needs to be filed in the "Core" product, "Plug-Ins" component.