465615 - Very long Radius value for CIRCLE attribute in SVG results in DoS Condition

Status: RESOLVED DUPLICATE of bug 393832

(Core :: SVG, defect)

Description

[Thierry Zoller]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4

r='1.79769313486231E+308' 

Reproducible: Always

Steps to Reproduce:
1.Open attached file
2.
3.
Actual Results:  
Consumes lots of ressources and not longer response to user input

Comment 1

[Thierry Zoller]

Attachment: SVG Proof of Concept

Comment 2

[Daniel Veditz [:dveditz]]

Might be a cairo bug rather than SVG (seems to be looping in libthebes), but I can definitely confirm the DoS.

Comment 3

[Thierry Zoller]

Any action planed on this (would see this as a low risk issue)

Comment 4

[timeless]

personally, i intend to open this bug to the public unless someone gives me a reason not to.

DoS isn't critical, there are many ways to do that, and if the user kills their firefox, they can uncheck the tab when they restore. if session restore doesn't have a good enough way for users to incrementally load pages then that's a bug in session restore.

a bug like this is more likely to be fixed by being visible to more people than by leaving it in a closet.

Comment 5

[Thierry Zoller]

I do not oppose to that, no other vendor is affected. Denial of Service is a vulnerability, depends on where the application or code is being it might be very
critical. Unlikely but possible.

Anyways: I hereby set the disclosure date to the 15th of January.
-> http://blog.zoller.lu/search/label/Vulnerability%20disclosure%20Policy


Regards,
Thierry

Comment 6

[Daniel Veditz [:dveditz]]

http://www.milw0rm.com/exploits/8794

Comment 7

[Robert Longson [:longsonr]]

Is there any significant difference between this and bug 393832?

Comment 9

[Thierry Zoller]

The bug is marked as resolved, is there a patch?

Comment 10

[Martijn Wargers (dead)]

It has been marked as a duplicate of a bug that hasn't been fixed yet.