| Summary: | Limit parsing recursion to prevent crashes | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Mark Larson (Google) <mal> |
| Component: | DOM | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | ||
| Priority: | P2 | ||
| Version: | 525.x (Safari 3.1) | ||
| Hardware: | PC | ||
| OS: | Windows XP | ||
I think this is a denial-of-service nuisance attack and not an exploitable crash. You can create a deeply nested tree by doing something similar to: perl -e '{print "<x>"x100000}' >foo.html (I can provide this as an attachment, but it's 300K and easy to create on any machine.) If you load that page and then reload or navigate away, Safari 3.1 crashes. This might be similar to bug 14886: Stack overflow due to deeply nested parse tree. Neither IE nor Firefox crash with the same input.