6 ms·

AwSnap – This link crashes Chrome

71 points by jlblatt 12y ago

TaengguSone 11y ago
<a href="http://Lorem http://Lorem ipsum Culpa labore qui culpa enim nostrud eiusmod ullamco anim in dolor consequat voluptate in in laboris consequat dolor occaecat minim aliqua quis id in Duis eiusmod amet id do ex do dolore dolor anim sit deserunt do.">Hello World!</a>
TaengguSone 11y ago
<a href="http://Lorem http://Lorem ipsum Culpa labore qui culpa enim nostrud eiusmod ullamco anim in dolor consequat voluptate in in laboris consequat dolor occaecat minim aliqua quis id in Duis eiusmod amet id do ex do dolore dolor anim sit deserunt do.">Hello World!</a>
OmgImAlexis 12y ago
Interestingly enough the links on Reddit don't seem to crash Chrome but the cortexture.net link from Github does. I'm running Chrome 41.0.2272.101 m (64-bit) on Windows 8.1
- jlblatt 12y ago
  It seems hit or miss so far- Shardj just pointed out that https:// https:// doesn't seem to crash at all.
  - chrisfosterelli 12y ago
    That might make sense, since I'm seeing the same behaviour but have SSL enabled for Reddit.
    - jlblatt 12y ago
      Could be. My concern is: 1) Most people don't have SSL enabled for most (if any) sites that are optional. 2) Most normal users are using the standard build for MacOS/Win, not the dev channel, and not Linux. 3) This requires no XSS or anything remotely tricky. Just a couple hundred bytes of HTML, and that's it. 4) Most web forum filters and formatting code (including Markdown) let this thru just fine. Maybe I'm blowing it out of proportion, but if you wanted to be a jerk to a whole lot of people very easily, you probably could. EDIT: Grammar
      - chrisfosterelli 11y ago
        Oh, for sure. There are plenty of attack vectors for this sort of thing, I just find the SSL behaviour interesting.
guiambros 12y ago
Interesting. Confirmed crash on Ubuntu 14.04, version 42.0.2311.50 beta (64-bit). It crashes only the tab ("He's dead, Jim"), not parent Chrome process.
- jlblatt 12y ago
  Yup, it's not "serious", but could be used to DOS I believe.
tvvocold 12y ago
It doesn't work on Latest Chrome beta or hacker news. But a HK clone was crashed. http://news.dbanotes.net/ http://news.dbanotes.net/
- andrewpe 12y ago
  Yup, seems to be fixed.
  - jlblatt 12y ago
    Suggestion from a reply to my bug report (filed under security so it's non-public) points to a dupe of: https://code.google.com/p/chromium/issues/detail?id=472899 https://code.google.com/p/chromium/issues/detail?id=472899 and fixed in: https://chromium.googlesource.com/chromium/src/+/5922e15ca3d5c13d576e5d734c588852b509764d https://chromium.googlesource.com/chromium/src/+/5922e15ca3d... FWIW
- nivla 12y ago
  >or hacker news Its because HN defaults to https. Https rendering of a site seems to be unaffected by this bug.
  - tvvocold 12y ago
    Yup.
jgunsch 12y ago
I'm pretty sure this is https://code.google.com/p/chromium/issues/detail?id=464270 https://code.google.com/p/chromium/issues/detail?id=464270, which was fixed by https://codereview.chromium.org/1007323003 https://codereview.chromium.org/1007323003.
- jlblatt 12y ago
  Wow, that's an even better guess than the other (not mine) I posted: https://news.ycombinator.com/item?id=9326350 https://news.ycombinator.com/item?id=9326350
  - jgunsch 12y ago
    It's not just a guess, I broke it and I fixed it :) Can I ask why you took the approach of making a Github repo to post this rather than filing a Chromium bug?
    - jlblatt 12y ago
      I did file a Chromium bug last week, #472347. I filed under security (as I was unsure) so it's not public, but it was pretty much immediately marked as 'Won't Fix'. Hence the repo ;)
      - reitanqild 11y ago
        Now this is interesting, especially the lack of a reply.
        omaranto 11y ago
        I wouldn't call marking the bug as WONTFIX a "lack of reply".
        reitanqild 11y ago
        I see, I wasn't clear. I talked about the lack of reply to the comment where this was pointed out. Just asking why he didn't it and then leaving the conversation possibly means he either didn't wait for the answer or was bothered with it?
Smerity 12y ago
Tangentially related, I was performing an analysis of the billions of links available in Common Crawl[1] and ran across an interesting error: there was one link where the port number was 18779690999[2]. The library I was using converted the port text into a 32 bit integer but the library didn't account for the possibility that someone supplied a port well over the 32 bit int limits. I was curious how many tools that use URLs would suffer similar fates and whether there might be any interesting security vulnerabilities. Just goes to show, no matter how much crazy you've seen, there's likely crazier things hidden from you across the Internet ;) [1]: http://commoncrawl.org/ http://commoncrawl.org/ [2]: https://twitter.com/Smerity/status/576339945041707008 https://twitter.com/Smerity/status/576339945041707008
- ahoge 12y ago
  The port number is supposed to be a 16-bit number though. So, anything above 65535 is malformed. http://en.wikipedia.org/wiki/Port_%28computer_networking%29 http://en.wikipedia.org/wiki/Port_%28computer_networking%29
  - Smerity 12y ago
    Agreed that it's malformed. My point was more that I'm curious how many other libraries fail badly when confronted with an unexpectedly large port. It's the edge cases / "no-one would ever be silly enough to do that" that quite frequently lead to security issues =]
    - jlblatt 12y ago
      Yes, that's why I feel like this is more significant than a simple crash at first glance- no one would purposefully craft a 256+ unchecked character URL, unless they are being malicious, in which case they absolutely will craft a 256+ unchecked character URL.
      - userbinator 11y ago
        URLs can definitely get rather long if they contain lots of query data, and the de-facto limit seems to be around 2KB[1]. It's still not acceptable for such URLs to crash the browser though. [1] http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers http://stackoverflow.com/questions/417142/what-is-the-maximu...
deleted 12y ago
[deleted]
greggman 12y ago
I hope this doesn't come across as negative but why post this on HN? Why not just file a bug on crbug.com? Browsers have bugs, all them. It seems kind of negative to turn it into a spectacle rather than just be kind and report the bug to the team.
- jlblatt 12y ago
  Totally valid, and not negative at all. See: https://news.ycombinator.com/item?id=9326370 https://news.ycombinator.com/item?id=9326370
- ploxiln 12y ago
  Browser makers need pressure to prioritize robustness. Otherwise, to be competitive with each other, they will prioritize features much more highly, and we can see the results today. "Browsers have bugs, all of them." ...but we're not talking about very-tricky-to-trigger bugs found a couple of times a year, we're talking about 30 every 6 weeks, in various subsystems. I was initially turned off from Chrome in its early versions because it seemed that tabs crashed much more easily, since it wasn't as big a deal to have a tab crash. Firefox crashes as a whole, so it has much more motivation to diligently make sure its subsystems are not prone to crashing on high-level documents / languages, however malformed they may be. But as was posted below, it's still quite easy to lock up Firefox. So I applaud crashfirefox.com as well as this Chrome demonstration, they're needed to keep the balance between robustness and new features.
- omaranto 11y ago
  It seems that the author did file a bug report and it almost immediately got marked WONTFIX: https://news.ycombinator.com/item?id=9326370 https://news.ycombinator.com/item?id=9326370
myworldplz 12y ago
I've created something similar but for Firefox: http://crashfirefox.com/ http://crashfirefox.com/ Have added new crash options for users with NoScript (even if you're blocking 302s - try right clicking).
- jlblatt 12y ago
  Hah, that click was definitely my karma for today, ty. But the reason I posted this is because it doesn't rely on Javascript to eat up memory- anyone can post a malformed/long link to a web forum and crash the thread/site for other Chrome users immediately, without clicking thru.
- nmjohn 12y ago
  And it just keeps going, love it ➜ ~ curl http://crashfirefox.com/ ....................../´¯/) ....................,/¯../ .................../..../ ............./´¯/'...'/´¯¯`·¸ ........../'/.../..../......./¨¯\ ........('(...´...´.... ¯~/'....') .........\.................'...../ ..........''...\.......... _.·´ ............\..............( ..............\.............\... SNITCHES GET STITCHES ....................../´¯/) ....................,/¯../ .................../..../ ............./´¯/'...'/´¯¯`·¸ ........../'/.../..../......./¨¯\ ........('(...´...´.... ¯~/'....') .........\.................'...../ ..........''...\.......... _.·´ ............\..............( ..............\.............\... SNITCHES GET STITCHES ....................../´¯/) ....................,/¯../ .................../..../ ............./´¯/'...'/´¯¯`·¸ ........../'/.../..../......./¨¯\ ........('(...´...´.... ¯~/'....') .........\.................'...../ ..........''...\.......... _.·´ ............\..............( ..............\.............\... SNITCHES GET STITCHES ➜ ~ curl http://crashfirefox.com | wc -l % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 3613k 0 3613k 0 0 2020k 0 --:--:-- 0:00:01 --:--:-- 2019k 120000
  - ploxiln 12y ago
    Hah, I did the same thing, but it's not too hard to get past: curl -i -H 'User-Agent: Firefox' crashfirefox.com | head -n 80 | cut -b 1-100

71 points by jlblatt 12y ago

<a href="http://Lorem http://Lorem ipsum Culpa labore qui culpa enim nostrud eiusmod ullamco anim in dolor consequat voluptate in in laboris consequat dolor occaecat minim aliqua quis id in Duis eiusmod amet id do ex do dolore dolor anim sit deserunt do.">Hello World!</a>

TaengguSone 11y ago

OmgImAlexis 12y ago

Interestingly enough the links on Reddit don't seem to crash Chrome but the cortexture.net link from Github does. I'm running Chrome 41.0.2272.101 m (64-bit) on Windows 8.1

jlblatt 12y ago
It seems hit or miss so far- Shardj just pointed out that https:// https:// doesn't seem to crash at all.
- chrisfosterelli 12y ago
  That might make sense, since I'm seeing the same behaviour but have SSL enabled for Reddit.
  - jlblatt 12y ago
    Could be. My concern is: 1) Most people don't have SSL enabled for most (if any) sites that are optional. 2) Most normal users are using the standard build for MacOS/Win, not the dev channel, and not Linux. 3) This requires no XSS or anything remotely tricky. Just a couple hundred bytes of HTML, and that's it. 4) Most web forum filters and formatting code (including Markdown) let this thru just fine. Maybe I'm blowing it out of proportion, but if you wanted to be a jerk to a whole lot of people very easily, you probably could. EDIT: Grammar
    - chrisfosterelli 11y ago
      Oh, for sure. There are plenty of attack vectors for this sort of thing, I just find the SSL behaviour interesting.

guiambros 12y ago

Interesting. Confirmed crash on Ubuntu 14.04, version 42.0.2311.50 beta (64-bit). It crashes only the tab ("He's dead, Jim"), not parent Chrome process.

jlblatt 12y ago
Yup, it's not "serious", but could be used to DOS I believe.

tvvocold 12y ago

It doesn't work on Latest Chrome beta or hacker news. But a HK clone was crashed. http://news.dbanotes.net/ http://news.dbanotes.net/

andrewpe 12y ago
Yup, seems to be fixed.
- jlblatt 12y ago
  Suggestion from a reply to my bug report (filed under security so it's non-public) points to a dupe of: https://code.google.com/p/chromium/issues/detail?id=472899 https://code.google.com/p/chromium/issues/detail?id=472899 and fixed in: https://chromium.googlesource.com/chromium/src/+/5922e15ca3d5c13d576e5d734c588852b509764d https://chromium.googlesource.com/chromium/src/+/5922e15ca3d... FWIW
nivla 12y ago
>or hacker news Its because HN defaults to https. Https rendering of a site seems to be unaffected by this bug.
- tvvocold 12y ago
  Yup.

jgunsch 12y ago

I'm pretty sure this is https://code.google.com/p/chromium/issues/detail?id=464270 https://code.google.com/p/chromium/issues/detail?id=464270, which was fixed by https://codereview.chromium.org/1007323003 https://codereview.chromium.org/1007323003.

jlblatt 12y ago
Wow, that's an even better guess than the other (not mine) I posted: https://news.ycombinator.com/item?id=9326350 https://news.ycombinator.com/item?id=9326350
- jgunsch 12y ago
  It's not just a guess, I broke it and I fixed it :) Can I ask why you took the approach of making a Github repo to post this rather than filing a Chromium bug?
  - jlblatt 12y ago
    I did file a Chromium bug last week, #472347. I filed under security (as I was unsure) so it's not public, but it was pretty much immediately marked as 'Won't Fix'. Hence the repo ;)
    - reitanqild 11y ago
      Now this is interesting, especially the lack of a reply.
      - omaranto 11y ago
        I wouldn't call marking the bug as WONTFIX a "lack of reply".
        reitanqild 11y ago
        I see, I wasn't clear. I talked about the lack of reply to the comment where this was pointed out. Just asking why he didn't it and then leaving the conversation possibly means he either didn't wait for the answer or was bothered with it?

Smerity 12y ago

Tangentially related, I was performing an analysis of the billions of links available in Common Crawl[1] and ran across an interesting error: there was one link where the port number was 18779690999[2]. The library I was using converted the port text into a 32 bit integer but the library didn't account for the possibility that someone supplied a port well over the 32 bit int limits. I was curious how many tools that use URLs would suffer similar fates and whether there might be any interesting security vulnerabilities. Just goes to show, no matter how much crazy you've seen, there's likely crazier things hidden from you across the Internet ;) [1]: http://commoncrawl.org/ http://commoncrawl.org/ [2]: https://twitter.com/Smerity/status/576339945041707008 https://twitter.com/Smerity/status/576339945041707008

ahoge 12y ago
The port number is supposed to be a 16-bit number though. So, anything above 65535 is malformed. http://en.wikipedia.org/wiki/Port_%28computer_networking%29 http://en.wikipedia.org/wiki/Port_%28computer_networking%29
- Smerity 12y ago
  Agreed that it's malformed. My point was more that I'm curious how many other libraries fail badly when confronted with an unexpectedly large port. It's the edge cases / "no-one would ever be silly enough to do that" that quite frequently lead to security issues =]
  - jlblatt 12y ago
    Yes, that's why I feel like this is more significant than a simple crash at first glance- no one would purposefully craft a 256+ unchecked character URL, unless they are being malicious, in which case they absolutely will craft a 256+ unchecked character URL.
    - userbinator 11y ago
      URLs can definitely get rather long if they contain lots of query data, and the de-facto limit seems to be around 2KB[1]. It's still not acceptable for such URLs to crash the browser though. [1] http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers http://stackoverflow.com/questions/417142/what-is-the-maximu...

deleted 12y ago

[deleted]

greggman 12y ago

I hope this doesn't come across as negative but why post this on HN? Why not just file a bug on crbug.com? Browsers have bugs, all them. It seems kind of negative to turn it into a spectacle rather than just be kind and report the bug to the team.

jlblatt 12y ago
Totally valid, and not negative at all. See: https://news.ycombinator.com/item?id=9326370 https://news.ycombinator.com/item?id=9326370
ploxiln 12y ago
Browser makers need pressure to prioritize robustness. Otherwise, to be competitive with each other, they will prioritize features much more highly, and we can see the results today. "Browsers have bugs, all of them." ...but we're not talking about very-tricky-to-trigger bugs found a couple of times a year, we're talking about 30 every 6 weeks, in various subsystems. I was initially turned off from Chrome in its early versions because it seemed that tabs crashed much more easily, since it wasn't as big a deal to have a tab crash. Firefox crashes as a whole, so it has much more motivation to diligently make sure its subsystems are not prone to crashing on high-level documents / languages, however malformed they may be. But as was posted below, it's still quite easy to lock up Firefox. So I applaud crashfirefox.com as well as this Chrome demonstration, they're needed to keep the balance between robustness and new features.
omaranto 11y ago
It seems that the author did file a bug report and it almost immediately got marked WONTFIX: https://news.ycombinator.com/item?id=9326370 https://news.ycombinator.com/item?id=9326370

myworldplz 12y ago

I've created something similar but for Firefox: http://crashfirefox.com/ http://crashfirefox.com/ Have added new crash options for users with NoScript (even if you're blocking 302s - try right clicking).

jlblatt 12y ago
Hah, that click was definitely my karma for today, ty. But the reason I posted this is because it doesn't rely on Javascript to eat up memory- anyone can post a malformed/long link to a web forum and crash the thread/site for other Chrome users immediately, without clicking thru.
nmjohn 12y ago
And it just keeps going, love it ➜ ~ curl http://crashfirefox.com/ ....................../´¯/) ....................,/¯../ .................../..../ ............./´¯/'...'/´¯¯`·¸ ........../'/.../..../......./¨¯\ ........('(...´...´.... ¯~/'....') .........\.................'...../ ..........''...\.......... _.·´ ............\..............( ..............\.............\... SNITCHES GET STITCHES ....................../´¯/) ....................,/¯../ .................../..../ ............./´¯/'...'/´¯¯`·¸ ........../'/.../..../......./¨¯\ ........('(...´...´.... ¯~/'....') .........\.................'...../ ..........''...\.......... _.·´ ............\..............( ..............\.............\... SNITCHES GET STITCHES ....................../´¯/) ....................,/¯../ .................../..../ ............./´¯/'...'/´¯¯`·¸ ........../'/.../..../......./¨¯\ ........('(...´...´.... ¯~/'....') .........\.................'...../ ..........''...\.......... _.·´ ............\..............( ..............\.............\... SNITCHES GET STITCHES ➜ ~ curl http://crashfirefox.com | wc -l % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 3613k 0 3613k 0 0 2020k 0 --:--:-- 0:00:01 --:--:-- 2019k 120000
- ploxiln 12y ago
  Hah, I did the same thing, but it's not too hard to get past: curl -i -H 'User-Agent: Firefox' crashfirefox.com | head -n 80 | cut -b 1-100