[webkit-dev] Fwd: Possible memory corruption problems in Apple
bwaters at nrao.edu
Thu Sep 29 11:51:35 PDT 2005
From bugtraq, I had not seen this before.
Basically, entering a URL of data://<h>/ will crash Safari?
Is this a bug on bugzilla? I cannot find such with a brief search...
Begin forwarded message:
> From: Jonathan Rockway <jon at jrock.us>
> To: bugtraq at securityfocus.com
> Subject: Possible memory corruption problems in Apple Safari
> Date: Fri, 16 Sep 2005 22:07:34 -0500
> Message-ID: <20050917030734.GA9837 at jrock.us>
> User-Agent: Mutt/1.5.7i
> I was playing around with Safari the other day and noticed that it
> crashes solid if you convince it to visit:
> Typing it into the address bar is sufficient for testing and crashes
> the browser completely. I loaded up Safari in gdb to see where it
> crashes and got the following result:
>> Program received signal EXC_BAD_ACCESS, Could not access memory.
>> Reason: KERN_INVALID_ADDRESS at address: 0x076fffff
>> [Switching to process 266 thread 0x6403]
>> 0xffff8ce4 in ___memcpy ()
> The fact that random data from the Internet is causing problems with
> memcpy worries me. I haven't figured out how to change the arguments
> to memcpy, but it seems possible. Hopefully someone that knows more
> about debugging threaded Objective-C programs running on PPC can
> look into it. I'm more of a simple x86/C person myself :)
> Just for reference, it seems that Safari needs a very specific set of
> inputs to actually crash:
> data://<h>/ doesn't crash
> data://<h>/< does
> (also data://<crash>test</crash> doesn't crash... the h in <h1> seems
> important somehow).
> Regards (and good luck),
> Jonathan Rockway
> ------- end -------
More information about the webkit-dev