553999 - A simple file that containts 1023 Unix LF chars kills Firefox, but it works on IE, Chrome, Opera, Safari. Tested on Firefox 3.6 and on 3.5.4 as well.

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Adam Tarcsi]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; hu; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; hu; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

A simple file that containts 1023 Unix LF chars kills Firefox, but it works on IE, Chrome, Opera, Safari. Tested on Firefox 3.6 and on 3.5.4 as well.
You can try it here: http://ade.web.elte.hu/_1023LF.txt

Reproducible: Always

Steps to Reproduce:
1. Create a simple text file with 1023 LF. Maybe less is enough, I've tested with 1023.
2. Open it with Firefox
3. Now you can restart your Firefox...
Actual Results:  
Firefox crashes

Comment 1

[Mardeg]

Testing on Minefield latest nightly build produces a hang, no crash.

Comment 2

[timeless]

https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Comment 3

[Arie Paap [:wildmyron]]

Attachment: Stack of main thread

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2

Fx hangs [@ xul!nsScannerIterator::advance] with 100% cpu usage on the main thread. I haven't been able to figure out what the unloaded modules are but hopefully it's not important.

Comment 4

[Henri Sivonen (:hsivonen)]

Bug 479959 will fix this eventually.

Comment 5

[Alex Miller]

Firefox 3.6.12 on Ubuntu just hangs.

Comment 6

[[e-mail]]

It works good in Firefox 10.0, Windows XP.  Maybe Someone Fixed it?

Comment 7

[Henri Sivonen (:hsivonen)]

Fixed by fixing bug 479959.

Comment 8

[wilsonchong8806222]

Attachment: tmp_26477--1906426413.null

[Security approval request comment]
How easily could an exploit be constructed based on the patch?

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?

Which older supported branches are affected by this flaw?

If not all supported branches, which bug introduced the flaw?

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?

How likely is this patch to cause regressions; how much testing does it need?

Ksks