Bugtraq mailing list archives
Re: Safari HTTPS Overflow
From: Braden Thomas <braden127 () myrealbox com>
Date: Thu, 28 Apr 2005 19:29:14 -0700
Gilbert –This appears to be an issue where Safari is calling CFSocketEnableCallBacks on a null CFSocketRef. Not an overflow. An overflow would require a buffer, somewhere, to have overflowed. This is not happening at all. Just because a program crashes when you send it a relatively long string does not define it as an overflow. Look at the crash report:
Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0000000cAlso, did you notify Apple (https://bugreport.apple.com/cgi-bin/WebObjects/RadarWeb.woa) of this bug, or did you just figure they'd hear about it through the grapevine?
Braden Thomas On Apr 28, 2005, at 2:08 PM, Gilbert Verdian wrote:
Found a bug in the latest Safari that comes with Panther 10.3.9 - Safari 1.3 (v312), previous versions of Panther are also vulnerable.The problem is with the URI input for HTTPS which causes Safari to crash by inputting a large amount of A's i.e.https:// AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADid a debug of the crash, but it kept crashing in a spin_lock while reading from the text segment. Will post more details when have more info on it.Gilbert Verdian neoresearch.org
Current thread:
- Safari HTTPS Overflow Gilbert Verdian (Apr 28)
- Re: Safari HTTPS Overflow David Riley (Apr 29)
- Re: Safari HTTPS Overflow Braden Thomas (Apr 29)