673095 - Hang with too many Set-Cookie headers

Status: RESOLVED INVALID

(Core :: Networking: Cookies, defect, P3)

Description

[mssbyassg]

If someone sends a lot of cookies to the browser, it crashes. IE stays stable...

<?php
	for($x=0;$x<100000;$x++)
	{
		setcookie('test'.$x, 'test', time()+3600);
	}
?>

Comment 1

[Ludovic Hirlimann [:Usul]]

Can you provide a crashID or a stack trace of such a crash ?

Comment 2

[mssbyassg]

Firefox does not crash, it just hangs and does not throw any errors.
Can't analyze it, but system performance goes up to 50% (dual core).
Internet Explorer just rejects the TCP (HTTP) Packet if there are more than X Set-Cookies...

Comment 3

[Daniel Veditz [:dveditz]]

We have a general problem of trying to handle whatever sites send us, in this case too many headers but the same basic approach gets us into trouble if the site sends a never-ending (or at least very large) page.

Is it worth adopting an upper limit? I believe we have a maximum length for a single header we accept, maybe we should give up if coalesced headers combine to an equivalent length.

Comment 4

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 5

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 6

[Andrea Marchesini [:baku]]

Firefox actually doesn't crash. It rejects the entire channel. This bug is invalid.