939453 - crashing when opening crafted JS webpage

Status: RESOLVED DUPLICATE of bug 537620

(Core :: DOM: Core & HTML, defect)

Description

[R4NG3R]

Attachment: Break.html

User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)

Steps to reproduce:

Simply open the attached html page and it crashes the browser.


Actual results:

Crashes the browser. This is denial of service attack. This happens in all the version of browser way from version 22 to 25.0.1 tested in the windows 7 PC fully patched(14/11/2013)


Expected results:

Should load the page with the text which is mentioned in the write.document

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

It appears this is OOMing the browser but not security sensitive

Comment 2

[tsnrchary]

Check the protocol

Comment 3

[Vlad Bacia-Mociran [:VladB]]

When I have opened the attached HTML page in Firefox latest release(43.0.4) and the latest Nightly(46.0a1), a notification is displayed that a page is slowing down the browser with 2 buttons  "Stop it" and "Wait". I have clicked the "Stop it" button but the whole system freezes, no crash report. Only a system restart will solve the freezing issue.

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20160105164030

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160111030207

This issue is also reproducible on Windows 8.1.

Regarding this, I will change the Status to NEW and adding the component DOM: Core & HTML.
If anyone considers that the component is not the right one, please change it to a more appropriate one.

Comment 4

[Boris Zbarsky [:bzbarsky]]

This is a duplicate: it's just doubling the size of the DOM a bunch of times (300000 of them, not like you can get that far).  Please find the original and mark this duplicate.

Comment 5

[Vlad Bacia-Mociran [:VladB]]

Hi,

I made some digging in bugzilla and have not managed to find any duplicates for this issue. Maybe I haven't been searching the right thing. Can you provide a link with the main issue so I can update this one as duplicate ?

Thank you,
Vlad

Comment 6

[Boris Zbarsky [:bzbarsky]]

I suggest searching for bugs with "document.write" in the comments and "oom" in the summary, for a start.