798374 - SVG nested patterns allow exponential entity-expansion explosion, leading to hangs, arbitrarily-high memory usage & swapping, and eventual content-process crash

Status: NEW

(Core :: SVG, defect)

Description

[Michael Tandy]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:15.0) Gecko/20100101 Firefox/15.0.1
Build ID: 20120905151427

Steps to reproduce:

Loaded the attached file.

Inspired by 'Billion Laughs' [1] the attached file contains an SVG pattern containing ten elements, each styled with an SVG pattern containing ten elements, each styled with an SVG pattern containing ten elements and so on for nine levels.

[1] http://en.wikipedia.org/wiki/Billion_laughs


Actual results:

Nothing displays; the window stops repainting, CPU usage rises to 100% and I have to kill the browser.


Expected results:

An error message or something similar.

Comment 1

[Michael Tandy]

Attachment: SVG image demonstrating bug

Comment 2

[Robert Longson [:longsonr]]

Opera suffers from this too. Does any existing UA produce such a message?

Comment 3

[Michael Tandy]

Not that I know of; chrome also has trouble, but with its process-per-tab architecture it doesn't lock up the entire browser.

Comment 4

[ciro.santilli]

Same on Chromium: https://code.google.com/p/chromium/issues/detail?id=231562.

Comment 5

[ciro.santilli]

Chromium 48 does not have this problem any more. Finally I got to see that image :-)

Comment 6

[ciro.santilli]

Duplicate of: https://bugzilla.mozilla.org/show_bug.cgi?id=455100

Comment 7

[Pablo]

I am still able to reproduce the bug somehow but it never loads the attachment, I keeps loading and i have to close the tab
Tested on windows10 64bit with firefox release 89.0.2