Bug 19514
| Summary: | DOM modification causes stack exhaustion (exact cause unknown) | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Berend-Jan Wever <skylined> |
| Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Critical | CC: | bfulgham, mitz |
| Priority: | P1 | Keywords: | InRadar |
| Version: | 525.x (Safari 3.1) | ||
| Hardware: | PC | ||
| OS: | Windows Vista | ||
| URL: | http://skypher.com/SkyLined/Repro/Safari/Stack%20exhaustion%20Unknown/repro.html | ||
Berend-Jan Wever
I found that the following javascript causes a stack exhaustion:
<BODY onload="go()"><SCRIPT>
function go() {
var oEmbed=document.createElement('embed');
document.body.appendChild(oEmbed);
var oEmbed2 = oEmbed.cloneNode();
oEmbed2.appendChild(document.body.parentElement);
var oA = document.createElement('a');
document.title = '';
oA.innerHTML = '<x><html></html>';
}
</SCRIPT></BODY>
Tested with Safari 3.1.1.
Marked as security, I'm not sure if you treat DoS as a security issue, so erring on the safe side.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Berend-Jan Wever
(In reply to comment #0)
OOOPS. I copy+pasted the wrong code (see bug 19516). This is the real repro code for this case:
<BODY onload="go()"><SCRIPT>
function go() {
oStrike=document.createElement('b');
oStrike.innerHTML='<object><table></table><colGroup></colGroup></object>';
document.body.parentElement.appendChild(oStrike);
}
</SCRIPT></BODY>
Berend-Jan Wever
Changing priority and security flag
Mark Rowe (bdash)
<rdar://problem/6007109>
mitz
I cannot reproduce in r35011. I think this bug was fixed along with bug 15919 in <http://trac.webkit.org/changeset/34692>.