606790 - Firefox crashed after document.write function execution

Status: RESOLVED INCOMPLETE

(Core :: General, defect)

Description

[tomaszkalinowski123]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11

This code still crashed Firefox (sometimes DEP report error):

var payload = "";
var i=0;
for(i=0;i<100000000;i++)
payload+="a";
document.write(payload);

Reproducible: Always

Comment 1

[tomaszkalinowski123]

Attachment: Example code

Exmple

Comment 2

[Matthias Versen [:Matti]]

I get a slow script warning with FF3.11 and Seamonkey trunk on win32
Why do you think that the crash is security related ?

Please post a crash ID
https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Comment 3

[tomaszkalinowski123]

Firefox 3.6.12 repair this vulnerable.

I discovered it one day before it:

https://bugzilla.mozilla.org/show_bug.cgi?id=607222

Comment 5

[Daniel Veditz [:dveditz]]

This is nothing like bug 607222.

The long string here is causing an Out of Memory (OOM) condition, which should fail safely. There may be cases where it doesn't if you're seeing a DEP violation (on WinXP, right?). IIRC we have a nearly identical bug based on a milw0rm or exploit-db testcase, this is a fairly obvious DoS attack and has been reported a lot.

Comment 6

[Tim (fmdeveloper)]

Reporter -> Are you still experiencing this issue with the latest version of Firefox 6? Does the issue occur with the latest nightly? http://nightly.mozilla.org/