Issue metadata
Sign in to add a comment
|
Security: HeapSpray in chrome with long URL
Reported by
php3...@gmail.com,
Sep 29 2016
|
||||||||||||||||||||
Issue descriptionThis template is ONLY for reporting security bugs. If you are reporting a Download Protection Bypass bug, please use the "Security - Download Protection" template. For all other reports, please use a different template. Please READ THIS FAQ before filing a bug: https://www.chromium.org/Home /chromium-security/security-faq Please see the following link for instructions on filing security bugs: http://www.chromium.org/Home/chromium-security/reporting-security-bugs NOTE: Security bugs are normally made public once a fix has been widely deployed. VULNERABILITY DETAILS Please provide a brief explanation of the security issue. VERSION Chrome Version: [53.0.2785.143 m] and [53.0.2785.116 m] [stable] Operating System: [windows, 10] REPRODUCTION CASE sorry for my bad English language , by browsing tester.php from chrome in windows 10 when i click a href i notice url in url bar are empty blank so i debug it i found it write memory with heapspray AAAAA FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: [ browser]
,
Sep 29 2016
Are you able to crash Chrome or make it otherwise misbehave (beyond failing to paint text in the Location Box when that text is >2mb in length? Observing the URL string within Chrome's memory isn't a surprise; Chrome has to keep it somewhere, and it's not unexpected that you would observe it in memory.
,
Sep 29 2016
As to why the URL renders blank, it's probably due to limits in the size of URLs that we're willing to transmit via IPC: https://cs.chromium.org/chromium/src/url/ipc/url_param_traits.cc?sq=package:chromium&dr=CSs&l=45 if (!iter->ReadString(&s) || s.length() > url::kMaxURLChars) { *p = GURL(); const size_t kMaxURLChars = 2 * 1024 * 1024;
,
Sep 30 2016
i will write exploit to prof it
,
Sep 30 2016
Anther buggy if u edit code like that
<a id="exploit" href="data:image/jpeg;base64,';for($i = 0;$i<= 2097129 ;$i++){echo 'A';} echo'Write any thing here">Exploit Me HeapSpray !</a> Will stop chrome from working when u try to browse any simple url like google.com will not showup just keep loading
,
Sep 30 2016
We appreciate the report, but I am closing this bug because there isn't any evidence of a vulnerability. It can be re-opened if you can show evidence of memory corruption, such as a crash stack that looks potentially exploitable. Regarding comment 5, we don't consider denial of service attacks to be security problems, as described in the FAQ. https://www.chromium.org/Home/chromium-security/security-faq#TOC-Are-denial-of-service-issues-considered-security-bugs-
,
Jan 7 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by php3...@gmail.com
, Sep 29 2016