584465 - <iframe> containing large XML file with no closing tags results in possible memory corruption/stack overflow vulnerability

Status: RESOLVED DUPLICATE of bug 485941

(Core :: Layout, defect)

Description

[Reed Loden [:reed]]

Attachment: crash.xml

Alex Miller <[e-mail]> reported a possible "memory corruption" issue to security@.

From initial review, the issue looks very similar to bug 485941, but I'm going ahead and filing this as a separate issue just in case.

===============================================================================

Hi, I am just emailing you to report a memory corruption/stack overflow 
vulnerability I found in Firefox. Basically just make an Iframe containing a 
MASSIVE xml file with no closing tags, which causes the browser to crash, and 
Debuggy to give an exception C00000FD (stack overflow) error.

This was tested against Firefox 3.6.8, on Windows 7 Intel Pentium M processor 1 
Core.

As a workaround, just disable iframes and don't open .xml files... That's all 
you can really do to prevent this :|

As for solving this in programming, in the XML parser, don't accept an XML 
document that is not properly formatted, then the parser can't freak out.

============================================================================

Comment 1

[Reed Loden [:reed]]

Attachment: PoC (calls crash.xml)

Comment 2

[Boris Zbarsky [:bzbarsky]]

Yeah, this is just bug 485941.  In particular, not exploitable, not memory corruption...  People need to get better about understanding that "stack overflow" != "stack buffer overflow".