887226 - OOM [@JS_BasicObjectToString mozilla::detail::GuardObjectNotificationReceiver::init nsTArray_Impl<nsIAtom*, nsTArrayInfallibleAllocator>::operator[] obj_toString js::CompartmentChecker::check]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Found via bughunter.

Loading  http://goo.gl/b4gxL -> http://library.iitd.ac.in/title.php?show=%27%3E%3Cimg%20src=%22http://s3.amazonaws.com/kym-assets/photos/images/original/000/096/044/trollface.jpg%22%20onLoad=%22javascript:alert%281%29;%22%20/%3E%3Cinput%20type=%22text%22

result in windows in OOM. For linux it was reported OOM [@JS_BasicObjectToString mozilla::detail::GuardObjectNotificationReceiver::init nsTArray_Impl<nsIAtom*, nsTArrayInfallibleAllocator>::operator[] obj_toString js::CompartmentChecker::check]

Creating a testcase might turn out very difficult here, since i tried to download this page for a local testcase and ended up with a +2GB file.

Comment 1

[Carsten Book [:Tomcat]]

Attachment: linux stack

Comment 2

[Carsten Book [:Tomcat]]

Attachment: windows stack

Comment 3

[Andrew McCreight [:mccr8]]

It isn't entirely clear that this is a security problem.  In the Linux stack we're crashing in the compartment checker, which is a little odd, and on Windows we're crashing with the OOM crasher.

Comment 4

[Bob Clary [:bc] (inactive)]

url is 404