7 ms·

Fl0wer.png.html

111 points by ent 14y ago

ent 14y ago
The file seems to be a png with some html tags in it that trick the browser. Seems to work on firefox and conkeror but not on my chromium.
- ComputerGuru 14y ago
  Works in Chrome/Windows.
benguild 14y ago
Doesn't work in Safari.
martindale 14y ago
Doesn't work on Chromium/Ubuntu. 18.0.1025.151 (Developer Build 130497 Linux) Ubuntu 12.04
- sohn 14y ago
  Same here.
  - TazeTSchnitzel 14y ago
    1) Restricted Drivers 2) about:flags disable software rendering blacklist
- pan69 14y ago
  Works for me on Chrome 18.0.1025.162/Ubuntu 11.04 Note: Chrome, not Chromium.
- hristov 14y ago
  Works for me. And I have exactly the same version as you. (But I am running Xubuntu if that matters). 18.0.1025.151 (Developer Build 130497 Linux) Ubuntu 12.04
- agravier 14y ago
  For this kind of bug you should specify your graphics module, GLX setup, etc...
zbowling 14y ago
It worked the first time in chrome. Crashed it the second time. Very clever. The blackhat-spidy-sense in me is getting a tingle. XSS injection if a PNG could used to execute javascript possibly.
- daeken 14y ago
  This can't be used for XSS or the like, really. The way it works is that the PNG is first interpreted as HTML by the browser (hence the filename) and then it loads itself into an image tag, causing it to be interpreted as a PNG. Once it's loaded into the image tag, the image is drawn to a canvas so that the code -- embedded in the PNG -- can be extracted and executed. While fun, the only real security concern here is that it's really good at pissing off IDSes. Edit: I linked my article describing the technique in another comment here if you want to see how horrible it really is. I'm always both proud of and disgusted by myself for this technique.
  - zbowling 14y ago
    I just dug into and can confirm. MIME is returned as text/html and browser reads it as such. still very clever. It's actually kind of a good test of browser compliance in a sick way.
    - willvarfar 14y ago
      The Duff's Device of browsers? :)
  - zbowling 14y ago
    It did actually uncover something. A huge leak in chrome for me. While this is running Chrome memory usage just climbs and climbs. http://dl.dropbox.com/u/586869/Screenshots/chrome%20leak.png http://dl.dropbox.com/u/586869/Screenshots/chrome%20leak.png
jes5199 14y ago
Works on Chrome/MacLion ... but I'm not sure what it's doing
daeken 14y ago
Huh, didn't think this would be posted. This is a little demo effect I threw together last week when I was bored. It's built on top of WebGL (the effect itself is really just in a shader), and the reason it looks like a PNG is that it's a self-extracting PNG as described in my article here: http://daeken.com/superpacking-js-demos http://daeken.com/superpacking-js-demos
NDizzle 14y ago
I'm freakin' out, man!
xkcdfanboy 14y ago
This crashed my OSX Lion running Chrome, lost all my work and had to reboot. Just tested Firefox too, crashes as well. Safari doesn't load anything, just a bunch of PNG binary text? Might want to work on compatibility ;)
- dewiz 14y ago
  .. same platform but none of the problems you experienced, perhaps you're using some old versions ?
saturn7 14y ago
Works, Amazing, I think you accidently just created a way to hypnotize people in a second.
kba 14y ago
What is this supposed to do, other than attempt to crash my browser?
swhitt 14y ago
Ah! My browser! I lost my thesis :(
- icebraining 14y ago
  What kind of crappy online editor are you using that doesn't save continuously?
  - moconnor 14y ago
    Office Live. You have to click on the save button. I'm not even making this up.
    - lloeki 14y ago
      You mean the one with a floppy disk (honest question: I'm not even remotely a Office Live user)?
icebraining 14y ago
(Note: I'm not blaming anyone!) Impressive: Firefox hold fine and rendered it, but after I opened it the second time, all the text in my system (that includes the browser, but also the terminals, Awesome, etc) was FUBAR - even after restarting the X server! I have no idea what kind of bug leads to only the text being corrupted (so, it doesn't seem a bug in the graphic drivers, since AFAIK they're agnostic to that) but survives restarting the display manager.
- gcr 14y ago
  Hm. Interesting. Using binary graphics drivers (nvidia et al)? Maybe something corrupted memory. Did it survive even a restart?
  - icebraining 14y ago
    I'm using the OSS radeon drivers and no, fortunately it was fine after a reboot :) Corrupted memory was my first thought, but affecting only text is odd - I mean, the drivers aren't even supposed to know those particular pixels are text, right?
    - chris_wot 14y ago
      In Firefox 12, if I click on the View menu and leave the menu open for a while, it turns into some sort of odd colour gradient. Interesting bug... can anyone else reproduce this?
    - entropy_ 14y ago
      Not necessarily, no, I think graphic cards are aware that certain things are text. For example, I have a thinkpad t400 with two graphic cards(ATI and intel), on the ATI the text in consoles is not anti-aliased, but on the intel one it is. So I'm pretty sure that the graphic card(or at least the drivers) are aware of what is text and what is not to some extent
- cydonian_monk 14y ago
  I've had similar experiences with graphical corruption in X, and Firefox was almost always involved. Same radeon driver as you. And it seems to be distro-agnostic: I've seen it with Arch, Gentoo and Mint. All I know is that it's a recent thing: if I run an older version of my Gentoo build, it doesn't happen. But otherwise I see the same results. I have no idea what to point to, because it's really weird. Scrambles /everything/ that goes through video. (And until now, I figured it was a quirk of my bizarre hardware. Guess not.)
PStamatiou 14y ago
This crashed my mac entirely. avoid.
- cjfont 14y ago
  What browser are you using? Worked fine for me on Chrome.
  - PStamatiou 14y ago
    Chrome 20. browser went full-screen, all white. Couldn't even force quit, had to reboot.
    - mattparlane 14y ago
      Same here, on Chrome stable (18.whatever).
- burke 14y ago
  Same here. Had to reboot.
- njharman 14y ago
  If viewing a web page crashes your OS, seriously, you need to take that crap back and get a refund.
  - lloeki 14y ago
    How do I get a refund on my Arch setup? Seriously, WebGL talks to the driver almost directly. All it takes is a browser/driver bug and the whole display stack goes down, possibly bringing the OS with it.
    - TazeTSchnitzel 14y ago
      Good thing we don't use composited rendering these days, or rely on hardware-accelerated interfaces. Oh wait.
Cushman 14y ago
I think we need to start using a [WebGL] tag or something for these... obviously some browsers don't take it well, and it would keep a lid on all the (kinda pointless) "Doesn't work"/"works for me" comments. Works for me. Super cool.
- sigmaxipi 14y ago
  In some cases, it's even worse. Low end netbooks running Chrome will load the page and then the entire machine locks up as the WebGL starts rendering and takes over the weak GPU. Easy way of DOSing someone is to send them a WebGL link if they're on a weak computer.
pooriaazimi 14y ago
Shame. It's not working on Safari 5.2 beta (Lion 10.7.3); nor does it work in Opera, or any of iOS browsers. But is fine on both Chrome and Firefox... I'm sure Safari supported WebGL...
- eridius 14y ago
  There's an option in the Develop menu to enable WebGL, but even with that on this doesn't work.
Jach 14y ago
NoScript is the new subject for "I run Linux, I don't have to worry about..." But after I enabled scripting it worked fine, very neat-looking demo. Also I admit that I enjoy reading about the problems of others here...
simplyinfinity 14y ago
Had no effect in Opera 12 alpha with HW acceleration and webgl turned on, just black screen
machrider 14y ago
Not seeing anything (totally white browser) in both Firefox 12 and Chromium 18 on Ubuntu.
- TazeTSchnitzel 14y ago
  >Ubuntu There's your problem. Are you using an ATI card, by the way? Make sure you have restricted drivers installed. If you're using an ATI card you'll have to do the further step of going to about:flags in Chrome and making it ignore the software rendering blacklist.
  - machrider 14y ago
    Actually I'm on a nVidia Quadro card with the Nouveau driver.
gphilip 14y ago
Shouldn't there be some kind of seizure warning to go with the link?
zokier 14y ago
I think the comments hilight very nicely why some people are not all that thrilled about having OpenGL in their browsers in the form of WebGL. Graphics drivers seem to be extremely difficult to "get right", especially if any degree of performance is wanted.
- willvarfar 14y ago
  My considered opinion (from the industry) is that its really shocking how under-invested-in the drivers are. If a fraction of the effort that went into making the card went into making the drivers and maintaining and fixing them, we'd all be massively better off.
  - modeless 14y ago
    The problem may be too much investment in drivers. Modern graphics card drivers are little operating systems unto themselves; they even have built-in compilers. They are incredibly complex, yet written in unsafe languages for maximum performance, with tons of ugly hacks for compatibility. What we really need is a simplification of graphics APIs so that graphics drivers don't need to be so complex. That may be impossible without convergence in hardware though.
    - willvarfar 14y ago
      Not really. That graphics drivers are a mess internally says more about the insufficient resourcing to do it properly and cleanly and refactor than it does about the really rather trivial and well-understood APIs that the driver implements.
      - modeless 14y ago
        You think OpenGL and DirectX are "trivial"? I'm sorry, but an API that involves passing text strings of complete programs for the driver to compile, link, and asynchronously run on a vector coprocessor is not trivial to implement, not to mention the complex NUMA memory management going on.
unicornporn 14y ago
Crashed Firefox 12 on OS X. Crashed latest Opera Mobile on Android ICS.
wordsaretoys 14y ago
If you're having WebGL/video driver issues and you'd like to assist the developers in fixing them, here's a link to a crowdsourced driver test at Khronos: http://www.khronos.org/webgl/wiki/CrowdsourcingDriverTesting http://www.khronos.org/webgl/wiki/CrowdsourcingDriverTesting
TazeTSchnitzel 14y ago
Goes well with trance music. Keep forgetting it's not in the demo.
DiabloD3 14y ago
All I see is the text "‰PNG IHDR[$‘þVœjawh". MIME type screw up server side?

Fl0wer.png.html

111 points by ent 14y ago

ent 14y ago

The file seems to be a png with some html tags in it that trick the browser. Seems to work on firefox and conkeror but not on my chromium.

ComputerGuru 14y ago
Works in Chrome/Windows.

benguild 14y ago

Doesn't work in Safari.

martindale 14y ago

Doesn't work on Chromium/Ubuntu. 18.0.1025.151 (Developer Build 130497 Linux) Ubuntu 12.04

sohn 14y ago
Same here.
- TazeTSchnitzel 14y ago
  1) Restricted Drivers 2) about:flags disable software rendering blacklist
pan69 14y ago
Works for me on Chrome 18.0.1025.162/Ubuntu 11.04 Note: Chrome, not Chromium.
hristov 14y ago
Works for me. And I have exactly the same version as you. (But I am running Xubuntu if that matters). 18.0.1025.151 (Developer Build 130497 Linux) Ubuntu 12.04
agravier 14y ago
For this kind of bug you should specify your graphics module, GLX setup, etc...

zbowling 14y ago

It worked the first time in chrome. Crashed it the second time. Very clever. The blackhat-spidy-sense in me is getting a tingle. XSS injection if a PNG could used to execute javascript possibly.

daeken 14y ago
This can't be used for XSS or the like, really. The way it works is that the PNG is first interpreted as HTML by the browser (hence the filename) and then it loads itself into an image tag, causing it to be interpreted as a PNG. Once it's loaded into the image tag, the image is drawn to a canvas so that the code -- embedded in the PNG -- can be extracted and executed. While fun, the only real security concern here is that it's really good at pissing off IDSes. Edit: I linked my article describing the technique in another comment here if you want to see how horrible it really is. I'm always both proud of and disgusted by myself for this technique.
- zbowling 14y ago
  I just dug into and can confirm. MIME is returned as text/html and browser reads it as such. still very clever. It's actually kind of a good test of browser compliance in a sick way.
  - willvarfar 14y ago
    The Duff's Device of browsers? :)
- zbowling 14y ago
  It did actually uncover something. A huge leak in chrome for me. While this is running Chrome memory usage just climbs and climbs. http://dl.dropbox.com/u/586869/Screenshots/chrome%20leak.png http://dl.dropbox.com/u/586869/Screenshots/chrome%20leak.png

jes5199 14y ago

Works on Chrome/MacLion ... but I'm not sure what it's doing

daeken 14y ago

Huh, didn't think this would be posted. This is a little demo effect I threw together last week when I was bored. It's built on top of WebGL (the effect itself is really just in a shader), and the reason it looks like a PNG is that it's a self-extracting PNG as described in my article here: http://daeken.com/superpacking-js-demos http://daeken.com/superpacking-js-demos

NDizzle 14y ago

I'm freakin' out, man!

xkcdfanboy 14y ago

This crashed my OSX Lion running Chrome, lost all my work and had to reboot. Just tested Firefox too, crashes as well. Safari doesn't load anything, just a bunch of PNG binary text? Might want to work on compatibility ;)

dewiz 14y ago
.. same platform but none of the problems you experienced, perhaps you're using some old versions ?

saturn7 14y ago

Works, Amazing, I think you accidently just created a way to hypnotize people in a second.

kba 14y ago

What is this supposed to do, other than attempt to crash my browser?

swhitt 14y ago

Ah! My browser! I lost my thesis :(

icebraining 14y ago
What kind of crappy online editor are you using that doesn't save continuously?
- moconnor 14y ago
  Office Live. You have to click on the save button. I'm not even making this up.
  - lloeki 14y ago
    You mean the one with a floppy disk (honest question: I'm not even remotely a Office Live user)?

icebraining 14y ago

(Note: I'm not blaming anyone!) Impressive: Firefox hold fine and rendered it, but after I opened it the second time, all the text in my system (that includes the browser, but also the terminals, Awesome, etc) was FUBAR - even after restarting the X server! I have no idea what kind of bug leads to only the text being corrupted (so, it doesn't seem a bug in the graphic drivers, since AFAIK they're agnostic to that) but survives restarting the display manager.

gcr 14y ago
Hm. Interesting. Using binary graphics drivers (nvidia et al)? Maybe something corrupted memory. Did it survive even a restart?
- icebraining 14y ago
  I'm using the OSS radeon drivers and no, fortunately it was fine after a reboot :) Corrupted memory was my first thought, but affecting only text is odd - I mean, the drivers aren't even supposed to know those particular pixels are text, right?
  - chris_wot 14y ago
    In Firefox 12, if I click on the View menu and leave the menu open for a while, it turns into some sort of odd colour gradient. Interesting bug... can anyone else reproduce this?
  - entropy_ 14y ago
    Not necessarily, no, I think graphic cards are aware that certain things are text. For example, I have a thinkpad t400 with two graphic cards(ATI and intel), on the ATI the text in consoles is not anti-aliased, but on the intel one it is. So I'm pretty sure that the graphic card(or at least the drivers) are aware of what is text and what is not to some extent
cydonian_monk 14y ago
I've had similar experiences with graphical corruption in X, and Firefox was almost always involved. Same radeon driver as you. And it seems to be distro-agnostic: I've seen it with Arch, Gentoo and Mint. All I know is that it's a recent thing: if I run an older version of my Gentoo build, it doesn't happen. But otherwise I see the same results. I have no idea what to point to, because it's really weird. Scrambles /everything/ that goes through video. (And until now, I figured it was a quirk of my bizarre hardware. Guess not.)

PStamatiou 14y ago

This crashed my mac entirely. avoid.

cjfont 14y ago
What browser are you using? Worked fine for me on Chrome.
- PStamatiou 14y ago
  Chrome 20. browser went full-screen, all white. Couldn't even force quit, had to reboot.
  - mattparlane 14y ago
    Same here, on Chrome stable (18.whatever).
burke 14y ago
Same here. Had to reboot.
njharman 14y ago
If viewing a web page crashes your OS, seriously, you need to take that crap back and get a refund.
- lloeki 14y ago
  How do I get a refund on my Arch setup? Seriously, WebGL talks to the driver almost directly. All it takes is a browser/driver bug and the whole display stack goes down, possibly bringing the OS with it.
  - TazeTSchnitzel 14y ago
    Good thing we don't use composited rendering these days, or rely on hardware-accelerated interfaces. Oh wait.

Cushman 14y ago

I think we need to start using a [WebGL] tag or something for these... obviously some browsers don't take it well, and it would keep a lid on all the (kinda pointless) "Doesn't work"/"works for me" comments. Works for me. Super cool.

sigmaxipi 14y ago
In some cases, it's even worse. Low end netbooks running Chrome will load the page and then the entire machine locks up as the WebGL starts rendering and takes over the weak GPU. Easy way of DOSing someone is to send them a WebGL link if they're on a weak computer.

pooriaazimi 14y ago

Shame. It's not working on Safari 5.2 beta (Lion 10.7.3); nor does it work in Opera, or any of iOS browsers. But is fine on both Chrome and Firefox... I'm sure Safari supported WebGL...

eridius 14y ago
There's an option in the Develop menu to enable WebGL, but even with that on this doesn't work.

Jach 14y ago

NoScript is the new subject for "I run Linux, I don't have to worry about..." But after I enabled scripting it worked fine, very neat-looking demo. Also I admit that I enjoy reading about the problems of others here...

simplyinfinity 14y ago

Had no effect in Opera 12 alpha with HW acceleration and webgl turned on, just black screen

machrider 14y ago

Not seeing anything (totally white browser) in both Firefox 12 and Chromium 18 on Ubuntu.

TazeTSchnitzel 14y ago
>Ubuntu There's your problem. Are you using an ATI card, by the way? Make sure you have restricted drivers installed. If you're using an ATI card you'll have to do the further step of going to about:flags in Chrome and making it ignore the software rendering blacklist.
- machrider 14y ago
  Actually I'm on a nVidia Quadro card with the Nouveau driver.

gphilip 14y ago

Shouldn't there be some kind of seizure warning to go with the link?

zokier 14y ago

I think the comments hilight very nicely why some people are not all that thrilled about having OpenGL in their browsers in the form of WebGL. Graphics drivers seem to be extremely difficult to "get right", especially if any degree of performance is wanted.

willvarfar 14y ago
My considered opinion (from the industry) is that its really shocking how under-invested-in the drivers are. If a fraction of the effort that went into making the card went into making the drivers and maintaining and fixing them, we'd all be massively better off.
- modeless 14y ago
  The problem may be too much investment in drivers. Modern graphics card drivers are little operating systems unto themselves; they even have built-in compilers. They are incredibly complex, yet written in unsafe languages for maximum performance, with tons of ugly hacks for compatibility. What we really need is a simplification of graphics APIs so that graphics drivers don't need to be so complex. That may be impossible without convergence in hardware though.
  - willvarfar 14y ago
    Not really. That graphics drivers are a mess internally says more about the insufficient resourcing to do it properly and cleanly and refactor than it does about the really rather trivial and well-understood APIs that the driver implements.
    - modeless 14y ago
      You think OpenGL and DirectX are "trivial"? I'm sorry, but an API that involves passing text strings of complete programs for the driver to compile, link, and asynchronously run on a vector coprocessor is not trivial to implement, not to mention the complex NUMA memory management going on.

unicornporn 14y ago

Crashed Firefox 12 on OS X. Crashed latest Opera Mobile on Android ICS.

wordsaretoys 14y ago

If you're having WebGL/video driver issues and you'd like to assist the developers in fixing them, here's a link to a crowdsourced driver test at Khronos: http://www.khronos.org/webgl/wiki/CrowdsourcingDriverTesting http://www.khronos.org/webgl/wiki/CrowdsourcingDriverTesting

TazeTSchnitzel 14y ago

Goes well with trance music. Keep forgetting it's not in the demo.

DiabloD3 14y ago

All I see is the text "‰PNG IHDR[$‘þVœjawh". MIME type screw up server side?