Bugtraq mailing list archives
Re: Crashing X
From: KF <dotslash () snosoft com>
Date: Thu, 31 Dec 1903 19:18:23 -0459
I reported a similar issue several months ago... I was seeing X crash via xterm -title `perl -e 'print "A" x 9000'` and also with html web pages with long title tags... Heres some strace snippits. I am on a ppc linux box Mandrake 8.0
root 1927 1389 3 12:17 ? 00:00:03 /etc/X11/X -deferglyphs 16 -auth [root@ibook root]# strace -o Xdebug.txt -ivfp 17151715 [0fea59dc] writev(11, [{"\26\0)T\0@\2(\0@\2(\0\0\0\0\0\0\0\0\0\205\0\26\0\0\0\f"..., 224}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 6000}], 2) = 6224 1715 [0fe987d8] read(11, "8\17\0\5\0@\1\222\0\10\0\10\0\0\177\377\0\0\0\0008@\0\4"..., 6624) = 6624
1715 [0fe9e980] brk(0x10617000) = 0x106170001715 [0fe987d8] read(11, "\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A"..., 9988) = 9988
1715 [1031f26c] --- SIGSEGV (Segmentation fault) ---1715 [0fe091b0] rt_sigaction(SIGSEGV, {SIG_IGN}, {0x1003d664, [SEGV], SA_RESTART}, 8) = 0
1715 [0fea577c] ipc_subcall(0, 0, 0, 0x30848000) = 0 1715 [0fe987e8] write(2, "\nFatal server error:\n", 21) = 21 This was a bit earlier on in the strace1715 [0fe987d8] read(11, "\24\0\0\6\2\0\0\16\0\0\0017\0\0\1\'\0\0\0\0\0\0\10\0", 6624) = 24 1715 [0fea59dc] writev(11, [{"\1\10)\26\0\0\10\0\0\0\1\'\0\0\3(\0\0 \0\0\0\0\0\177\377"..., 32}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 8192}], 2) = 8224 1715 [0fe987d8] read(11, "\24\0\0\6\2\0\0\16\0\0\1;\0\0\0\4\0\0\0\0\0\0\10\0", 6624) = 24
And before that1715 [0fe987d8] read(11, "\24\0\0\6\2\0\0\16\0\0\0\'\0\0\0\37\0\0\0\0\0\0 \0", 6624) = 24 1715 [0fea59dc] writev(11, [{"\1\10)\v\0\0\10\312\0\0\0\37\0\0\0\0\0\0#(\0\0\0\0\177"..., 32}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 9000}], 2) = 9032
1715 [0fea59dc] --- SIGALRM (Alarm clock) --- and before that1715 [0fe987d8] read(11, "\24\0\0\6\2\0\0\16\0\0\0017\0\0\1\'\0\0\0\0\0\0\10\0", 6624) = 24 1715 [0fea59dc] writev(11, [{"\1\10)\6\0\0\10\0\0\0\1\'\0\0\3(\0\0 \0\0\0\0\0\177\377"..., 32}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 8192}], 2) = 8224
Then this is mme running xterm in the VERY begining.1715 [0fe987d8] read(16, "\24\0\0\6\2\0\0\16\0\0\0\"\0\0\0\37\0\0\0\0\0\0\'\20", 4096) = 24 1715 [0fea59dc] writev(16, [{"\1\10\20\315\0\0\10\316\0\0\0\37\0\0\0\0\0\0#6\0\0\0\0"..., 32}, {"xterm\0-title\0AAAAAAAAAAAAAAAAAAA"..., 9014}, {"\0\0", 2}], 3) = 9048
BBBBBB these are the X processes running root 1389 1 0 12:13 ? 00:00:00 kdmroot 1927 1389 1 12:17 ? 00:00:08 /etc/X11/X -deferglyphs 16 -auth /var/lib/kdm/authfiles/A:0-KE8CBg
root 1928 1389 0 12:17 ? 00:00:00 -:0 root 1945 1928 0 12:17 ? 00:00:00 /bin/sh /usr/bin/startkde root 2027 1 0 12:17 ? 00:00:00 kdeinit: dcopserver --nosid root 2030 1 0 12:17 ? 00:00:00 kdeinit: klauncher root 2032 1 0 12:17 ? 00:00:00 kdeinit: kded root 2038 1 0 12:17 ? 00:00:00 kdeinit: kxmlrpcdroot 2041 1 0 12:17 ? 00:00:00 /usr/bin/artsd -F 5 -S 4096 -b 8 -s 1 -m artsmessage -l 3 -f
root 2046 1 0 12:18 ? 00:00:00 kdeinit: Running... root 2056 1 0 12:18 ? 00:00:00 knotify root 2057 1945 0 12:18 ? 00:00:00 ksmserver --restore root 2058 2046 0 12:18 ? 00:00:00 kdeinit: kwin root 2060 1 0 12:18 ? 00:00:01 kdeinit: kdesktop root 2062 1 0 12:18 ? 00:00:01 kdeinit: kickerroot 2066 1 0 12:18 ? 00:00:00 kdeinit: klipper -icon klipper -miniicon klipper
root 2069 1 0 12:18 ? 00:00:00 kdeinit: khotkeys root 2070 1 0 12:18 ? 00:00:00 kdeinit: kwritedroot 2071 2046 1 12:18 ? 00:00:04 kdeinit: konsole -icon konsole.png -miniicon konsole.png
root 2072 1 0 12:18 ? 00:00:00 alarmd root 2073 2070 0 12:18 pts/0 00:00:00 /bin/cat -KF John Scimone wrote:
If this is true couldn't a malicious website simply set the initial value of the form then use javascript to submit it upon loading the page causing the clients X to crash?ie. <input type="text" value="(9000 A's)"> and have a body onload=document.forms[0].submit()? John Scimone CS Major @ Ga Tech On Friday 07 December 2001 04:26 pm, you wrote:I have discovered a little bug in K Desktop 2.1.2 that crashes your X Server. By using the konqueror web browser and inputting around 9000+ A's (or whatever) into a search box (for instance www.yahoo.com's web search box) - this will crash your X environment. I have successfully done it using 9000 A's on one search box (crashing X instantly), then I used 90'000 and it also worked - but without immediate effect (took a few seconds). It also sometimes seems to work by just pasting 900000 A's into a search box and before it even displays the A's X crashes. (note: If you want it to display the A's before X crashes paste 9000, then as soon as you click to start the search - its bye bye X). Sorry but I can only test it on KDE 2.1.2, because I have no other systems available right now. By the way: [smackenz@mainframe smackenz]$ uname -a Linux mainframe 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 2001 i686 unknown (Rehat 7.1) (KDE 2.1.2) (this works in Gnome and KDE using with the konqueror web browser) To test simply use a shell and type: perl -e 'print "A" x 9000' Then copy these, and paste them into a search form. Also I tried this in netscape and it didn't work so it suggests its a konqueror error somewhere or other. Cheers Scott Mackenzie
Current thread:
- Crashing X scott (Dec 07)
- Re: Crashing X John Scimone (Dec 08)
- Re: Crashing X KF (Dec 10)
- Re: Crashing X Paul Starzetz (Dec 11)
- Re: Crashing X KF (Dec 10)
- Re: Crashing X Seth Arnold (Dec 08)
- Re: Crashing X Matthieu Herrb (Dec 08)
- Re: Crashing X munehiro (Dec 08)
- <Possible follow-ups>
- Re: Crashing X Joe Schmoe (Dec 11)
- Re: Crashing X John Scimone (Dec 08)