Closed
Bug 770861
Opened 14 years ago
Closed 10 years ago
crafted .html file crashes firefox
Categories
(Core :: Graphics, defect)
Tracking
()
RESOLVED
INVALID
People
(Reporter: hans.peter999999999, Unassigned)
Details
(Keywords: crash, testcase, Whiteboard: oom, DUPEME)
Crash Data
Attachments
(1 file)
|
322 bytes,
text/html
|
Details |
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11
Steps to reproduce:
I found an older firefox Crash Exploit. This script was not working an the Firefox 13.0.1.
I tried to improve this script and found a way how to crash firefox.
Actual results:
If you open up the file the Browser does not react any more (No response).I tooks more than 2 GB of my RAM and after 3 or more minutes the browser closed and the firefox crash reporter opened up.
|
Reporter | |
Updated•14 years ago
|
Component: Untriaged → File Handling
Attachment #639069 -
Attachment mime type: text/plain → text/html
I tried with FF16, it crashed too after a few minutes of script running.
It looks like the script implies an overflow in memory allocation.
Crash report: https://crash-stats.mozilla.com/report/index/bp-15db9465-1b8e-46ab-8d21-dbb262120704
Crash Signature: [@ mozalloc_abort(char const* const) | mozalloc_handle_oom(unsigned int) | moz_xrealloc | nsTArray_base<nsTArrayDefaultAllocator>::EnsureCapacity(unsigned int, unsigned int) | nsTArray<gfxShapedWord::DetailedGlyph nsTArrayDefaultAllocator>::AppendElement.…
Keywords: crash
|
|
||
Updated•14 years ago
|
Severity: normal → critical
Status: UNCONFIRMED → NEW
Component: File Handling → Graphics
Ever confirmed: true
Keywords: testcase
Product: Firefox → Core
QA Contact: untriaged → thebes
Hardware: x86_64 → All
Whiteboard: oom
Version: 13 Branch → Trunk
|
||
Comment 2•14 years ago
|
||
Of course it crashes. The script tries to more-than-double the length of the 'buffer' string 66666 times, and write each of those successively-longer strings into the document. That's not going to work....the length of the text will rapidly exceed the available address space (let alone actual memory). Remember the legend of the chessboard and the grains of rice....
|
|
||
Updated•14 years ago
|
Whiteboard: oom → oom, DUPEME
Jonathan, I know this is a pretty old bug. Does comment 2 make this an invalid issue? In other words, is this a situation in which we'd either expect or even want to crash?
Flags: needinfo?(jfkthame)
|
|
||
Comment 4•10 years ago
|
||
I'd say it's invalid, provided we detect the OOM situation and deliberately crash as a result. It'd only be a real issue if we -fail- to crash safely.
Flags: needinfo?(jfkthame)
Thanks Jonathan. I'm marking this bug as invalid based on your assessment. Please reopen this bug if there's something we can/should fix here.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → INVALID
You need to log in
before you can comment on or make changes to this bug.
Description
•