Bug 23550 – Browser eats can up all available memory and then crashs

• Component: DOM
• Status: RESOLVED DUPLICATE

[Yael]

Browser would eat up all the available memory in the system and crash when it processes this simple javascript:

e = document.createElement("select");

e.length=2147483647;

[Yael]

Created attachment 27044 [details]
Limit the length of select element that can be set from javascript

[Mark Rowe (bdash)]

Where did the limit of 1000 come from?  What maximum size do Firefox and IE allow?

[Yael]

(In reply to comment #2)
> Where did the limit of 1000 come from?  What maximum size do Firefox and IE
> allow?
> 

The 1000 limit is a guess, it could change if it breaks web sites.

IE and Opera do not have a limit. They eat up all the available memory and then crash.
FireFox does not support setting the length on HTMLSelectElemet and throws a NOT_SUPPORTED_ERR exception. This behavior is based on the spec in http://www.w3.org/TR/DOM-Level-2-HTML/html.html#ID-94282980. 

I thought that we still want to be compatible with IE and Opera, hence the limit.

[Yael]

I should mention that this bug was found by Thierry Zoller. http://secdev.zoller.lu/

[Sam Weinig]

*** This bug has been marked as a duplicate of 23319 ***

[black0ut]

Dear Yael,
You have been sent the POC to treat responsibly, not to submit it to vendors and not give credit for my discovery.

That said, Nokia devices are affected to, how are you proceeding I have tested a few of your devices.

[black0ut]

Dear Yael,
Sorry I have missed comment #4 - However please notify me before contacting vendors, I am currently coordinating disclosure and you just posted the POC as an open bug report

[Mark Rowe (bdash)]

Comment on attachment 27044 [details]
Limit the length of select element that can be set from javascript

Clearing review flag since the bug has been closed.