HTML Rendering Crashes IE

Inquirer says one line by A+nonymous+Coward · 2003-05-02 19:46 · Score: 4, Informative

Here is their story

--
Infuriate left and right

Re:Inquirer says one line by Selanit · 2003-05-02 21:20 · Score: 4, Insightful

I just crashed my copy of IE (5.00.2614.3500) with no more than .

And anyway, even if your version requires more than that, it can still be all on one line, eg:

<html><form><input type crash></form></html>

Since carriage return/line feed pairs are totally unimportant in HTML (except with the <pre> tag, and maybe one or two others), it's silly to talk about how many "lines" it takes anyway.
Re:Inquirer says one line by craigeyb · 2003-05-03 03:37 · Score: 3, Interesting

Not to be overly trollish here, but you could also squish poetry onto one long line or a big novel onto one really huge page, like something in Guinness's Book of World Records I suppose.

The point is, we use line counts in computer languages, even though most computer languages can be spaced out in numerous ways, because it provides a good rough estimate of length and complexity. It's not always the best metric, but oftentimes it serves its purpose well. In this case, the typical slashdot reader can see that the exploit is only "five lines" and realize that it's not a overly complicated HTML parser exploit but instead something ridiculously simple.

--
Social Contract? I don't remember signing any Social Contract!
Re:Inquirer says one line by norweigiantroll · 2003-05-03 04:28 · Score: 5, Funny

<input type crash>
It's not a bug, it's a feature! The "crash" input type allows the user to crash the browser. It's very useful and another Microsoft (TM) innovation.

Wonder if that works deeper in a page by ShieldW0lf · 2003-05-02 19:46 · Score: 4, Funny

Could wreak havoc in html-enabled forums

--
-1 Uncomfortable Truth

Re:Wonder if that works deeper in a page by zook · 2003-05-02 20:00 · Score: 5, Informative

I doubt it. From my quick toying around, it seems that if the offending tag appears inside of a tag there's no such effect.

It's hard to divine the exact fatal combination, of course. :)
Re:Wonder if that works deeper in a page by goph · 2003-05-02 21:49 · Score: 3, Interesting

actually it could indeed... just putting "about:<input type crash>" in the url bar already worked... which is just 1 line
Re:Wonder if that works deeper in a page by mr3038 · 2003-05-03 00:15 · Score: 2, Informative

Make it shorter. Just type
about:<input type>
in the url bar and IE crashes.
The important thing is to leave the value of type attribute undefined.
For example, this works too:
about:<input with sans-serif type "ALL YOUR BASE ARE BELONG TO US">

--
_________________________
Spelling and grammar mistakes left as an exercise for the reader.
Re:Wonder if that works deeper in a page by dattaway · 2003-05-03 00:25 · Score: 2, Interesting

Does this work as a ">link?

If it does, I can imagine many people posting malicious links in blogs everywhere by the end of the day.
Re:Wonder if that works deeper in a page by Anonymous Coward · 2003-05-03 01:13 · Score: 3, Informative

BTW, the above link does not make use of the about-link method to inject the malicious code. Slashcode filters attempts to use about: in links and IE does not follow redirects to the about: protocol. Also the most well known URL obfuscating redirector, http://yahoo.com?http://host/foo/bar.html, won't redirect to about: anyway. The script which is addressed by the above URL does not filter the URL data which it then uses in the redirection announcement. It's not my script or webserver, and if I had taken proper precautions, that link would not be traceable to me. It is also possible to further obfuscate the target by chaining it with the yahoo redirector: bye bye. With this method, anyone who knows the URL of an amateurish script like the one mentioned above, can post "killer-links" to message boards.
Re:Wonder if that works deeper in a page by RzUpAnmsCwrds · 2003-05-03 04:25 · Score: 2, Informative

As of IE6SP1, the about: protocol is disabled, and this no longer works (you can still get it, of course, by going to a page).

OS X IE Is Unaffected by WiseWeasel · 2003-05-02 19:47 · Score: 5, Interesting

It seems that IE 5.x on MacOS X is not affected by this. Not that it's such a big deal, I imagine any affected Windows versions of IE can be relaunched and people will just avoid going to places with such code. I fail to see the significance. Oh well, glad to see their Mac port is more stable in this regard.

--
"I like systems, their application excepted", George Sand (French)

Re:OS X IE Is Unaffected by petecarlson · 2003-05-02 20:15 · Score: 2, Funny

When I clicked the crash link,Explorer crashed but then relaunched all by itself. First time I have ever seen that happen.
Running IE 6 on 2000 pro.
guess I have to fire up Mo*illa to see what the lines of html are.

# There is a key broken on my laptop and I am not
# getting out of bed at four in the morning to
# plug in the keyboard
Re:OS X IE Is Unaffected by Elwood+P+Dowd · 2003-05-02 20:56 · Score: 4, Insightful

Somehow I imagine that the folks at securityfocus.com would check pretty carefully for that. If there were serious danger involved, they'd either give MS some time to fix it before this release, or they would have told us the whole story.

So hold your chickens before they jump the conclusion.

--

There are no trails. There are no trees out here.
Re:OS X IE Is Unaffected by Anonymous Coward · 2003-05-02 21:17 · Score: 5, Funny

It seems that IE 5.x on MacOS X is not affected by this.

I've had it. I'm switching.
Re:OS X IE Is Unaffected by Zan+Zu+from+Eridu · 2003-05-03 00:27 · Score: 2, Interesting

Seems to me like the people at securityfocus missed something: what would happen if someone where to put up a page that changes IEs default startup url to about:<input type about> or something like that?

mozilla crashes too by Anonymous Coward · 2003-05-02 19:47 · Score: 5, Informative

I use galeon most of the time and it crashes often too... Just put this in a document

<body onblur="javascript:self.focus()">

browse it, and galeon will crash (as of 1.3.3.20030419). Do the same in mozilla, close the browser window, and it will segfault (version 1.3).

Re:mozilla crashes too by arvindn · 2003-05-02 21:22 · Score: 5, Interesting

Even simpler:
<script> for(;;){window.open('');} </script>
Just tried with mozilla 1.2.1: froze.
OTOH:
<script> for(;;){} </script>
If I do this a dialog pops up saying: "A script on this page is trying to screw you. Do you want to kill it?" (not in those words though :)
Re:mozilla crashes too by metalpet · 2003-05-02 22:22 · Score: 5, Interesting

That's actuallly a good point.
Everybody who has spent any time developing web pages has learnt that bad (and sometimes even good) html can crash browsers.

Are we *that* confident in the maturity of our web browsers that causing a browser crash is nowadays considered a serious issue?

Before jumping the gun on parsing errors that kill the app, it might be smart to go over design errors first (scripts that keeps on going and that bypass the simple "lengthy script" checks are a good example. recursive frameset tricks would qualify too.). I've yet to see a full-featured browser that doesn't choke and/or die when presented with the right mix of recursion, active content and wickedness.

<tidbit type=outdated>
Netscape 3 had a neat crash code:
<script>delete new Location</script>
The neat part about it is that 2 of those 3 words were undocumented.
Of course any attempt to pass that as a security concern back then would have been laughed at. loudly.
I'm not sure what has fundamentally changed since then.
</tidbit>
Re:mozilla crashes too by JimDabell · 2003-05-02 22:57 · Score: 4, Insightful

Everybody who has spent any time developing web pages has learnt that bad (and sometimes even good) html can crash browsers.

I can't think of a browser released in the past couple of years that *crashes* on bad HTML, except for this particular issue. Misrenders, yes, but crashes, no. Bad javascript is another issue; you can protect yourself from that quite easily, and most of the time the browser catches infinite loops, fork bomb-style attacks, etc anyway.

<tidbit type=outdated>
Netscape 3 had a neat crash code:
<script>delete new Location</script> The neat part about it is that 2 of those 3 words were undocumented.
Of course any attempt to pass that as a security concern back then would have been laughed at. loudly.
I'm not sure what has fundamentally changed since then.
</tidbit>

IE has become a standard part of the Windows OS. As more and more applications use it, the impact of crashing greatly increases.
Re:mozilla crashes too by craigeyb · 2003-05-03 03:55 · Score: 4, Funny

...and most of the time the browser catches infinite loops...

Give it up for the Halting Problem Solution. Whoo whoo!

--
Social Contract? I don't remember signing any Social Contract!
Re:mozilla crashes too by Wastl · 2003-05-03 07:00 · Score: 2, Interesting

Since when does any script on a normal website need to run more than a few seconds without halting?
Can you guarantee that? I had a student who was using JavaScript in an editor written in dynamic HTML to traverse the HTML DOM tree in Mozilla and reconstruct information out of it to form an XML document. The program takes several seconds even on relatively small documents. Where would you put a reasonable timeout?

Sebastian

Re:Phoenix by thesadjester · 2003-05-02 19:49 · Score: 5, Interesting

Well, just to note, the Mac OS X version of IE did NOT crash. However, anyone using IE on mac when Camino, Mozilla, and Safari are well put together should have their head examined. Don't forget Opera too.

The bug seems to be Windows only....so the Mac coders at MS may be better coders...who knows.

--
-gabe

input type _____ by BoBathan · 2003-05-02 19:51 · Score: 3, Funny

Seconds after reading this, I tried this out on my own, slightly modified.

input type giveBoBathan$1,000,000USD

Unfortunatly, Microsoft must have known of this potential exploit. :(

--Travis

--
EOF

Re:input type _____ by Scarblac · 2003-05-02 20:08 · Score: 3, Funny

Try $999,999. They can't have thought of everything!

--
I believe posters are recognized by their sig. So I made one.

Re:Damnit! by antoy · 2003-05-02 19:52 · Score: 2, Interesting

Not only did THIS version of IE crash, but the others I had open did too!

It crashed only a single IE window on my pc. I run IE 6.0 on XP with all the updates, but maybe it has something to do with the 'Open folder windows in separate processes' option I have enabled.
It's not a serious vulnerability, but it sure is a very embarassing one :)

Does it have to be ``type crash?'' by mgrant · 2003-05-02 19:52 · Score: 2, Interesting

Does it have to be ``type crash?'' Why would ``crash'' be hardcoded into any library? It is just the lack of the ``='' that's doing it? I'd try it myself, but I don't own a copy if IE. Can anyone confirm?

Comment removed by account_deleted · 2003-05-02 19:55 · Score: 3, Informative

Comment removed based on user account deletion

bah by chadamir · 2003-05-02 19:55 · Score: 5, Interesting

people are up in arms over this because it's an ms blunder. It does nothing more than simply halt your browser. As many can testify, halted browsers happen with any of the many browser flavors available.

I heard someone suggest they hire better testers? How was anyone supposed to test for this. I know this is /. and trolling about MS is ok, but I mean come on, how could anyone see that coming.

The fact remains though that this crash isn't really that big of a deal. Sure it crashes IE, but it's not like most content webpages want their reader's browsers crashing when they reach the page. Who do we have to worry about? HTML enabled web boards? I have to worry about someone linking c:\con\con as an image everytime I click a link. You just go on with your life. If they are stupid enough to have html enabled then it's their problem, not MS's.

--
NJ Local Music Scene

Re:bah by gerardrj · 2003-05-02 20:09 · Score: 5, Insightful

People are up in arms over this because Bill Gates made it priority one in the company to make their software more secure and more reliable. This is just another blatent example of how they are failing in that mission. (This and the almost daily security updates).
Here we have a simple bug that should be a test case. The word "crash" is not required, just that the type directive has a null value since it is not followed by an equal sign.
The code would not hang the browser. The code would crash it just the same as it is again missing the equal sign. It's completely concievable that a developer that hand codes HTML would accidentally omit the character.

This is simple buffer underflow checking: "does the thing I just recieved have the minimum expected size/value?" and just like all the buffer overflow issues, they don't bother checking the untrusted input before sending it off for critical processing.

--
Article X: The powers not delegated... by the Constitution...are reserved...to the people
Re:bah by ch-chuck · 2003-05-02 21:33 · Score: 2, Interesting

I heard someone suggest they hire better testers?

It's an old, perfectly legal, tradition of software: the paying licensees are the testers. I just crashed IE and XP automatically sent in a bug report.

I just love the simplicity of it, kinda like the early vesions of NT where you could just telnet to port 139, type a few random characters and hang up, then watch CPU utilization stay at 100% untill reboot.

--
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Re:bah by nordicfrost · 2003-05-02 22:07 · Score: 3, Informative

The fact remains though that this crash isn't really that big of a deal. Sure it crashes IE, but it's not like most content webpages want their reader's browsers crashing when they reach the page.
I (have to (it's a app made for the MS version of java)) use IE for inputting data to the web publishing system at work. I also like to have more than one window open and surf around while researching stories. I have encountered lots and lots of annoying IE errors that either crashes the app or renderes it unsuable. When that happens, I risk losing my work unless I save it whenever I do anything else with the browser. That is really annoying, that is why I don't like IE.
Re:bah by shepd · 2003-05-02 22:12 · Score: 2, Insightful

>Crashing the OS? I didn't see that in the article, and when I tried it on my machine, it only killed the browser. In fact, it only killed the new window that I'd opened up, leaving my other Explorer windows functioning normally.

Je me souviens.

According to Microsoft Intenet Explorer is part of the OS. Therefore, if MSIE crashes, your OS has crashed. Bill Gates said it, not me. Complain to him if you think it's wrong! He made your OS!

You can't lie to a judge and not expect to be picked apart on it for life.

--
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
Re:bah by GreenEggsAndHam · 2003-05-02 23:42 · Score: 2, Insightful

"This and the almost daily security updates"

Talk about biased. Not a MS fanboy myself but it looks like they can do no right. First you complain about MS's dismal security record and when they finally start addressing the issue and release fixes you blast them again.

why it crashes by mejh · 2003-05-02 19:57 · Score: 5, Informative

Just one line is really required:

According to a post on bugtraq:
IE tries to compare the type of the input field to "HIDDEN", to see if it
should be rendered. When there is no type string, a null-pointer is used.
mshtml.dll calls shlwapi.dll#158 @ 0x636f0037 with a pointer to a static
unicode string "HIDDEN" and a null-pointer.
shlwapi.dll#158 does a case-insensitive comparison of two unicode strings:
it reads from address 0x0 because of the null-pointer and thus causes an
exception.
This is not exploitable, other then a DoS because there is no memory mapped
@ 0x0 and even if you could load something there, you could only compare it
to "HIDDEN" which gets you nowhere.

Re:why it crashes by frisket · 2003-05-03 02:40 · Score: 3, Informative

When there is no type string, a null-pointer is used.
There's the bug. When TYPE is absent, the default is the value "TEXT". This is in the HTML spec, and in the DTD, but as I said earlier, browser makers don't read doc. It should only compare the value to HIDDEN if a value has been specified.
Handling default values is something most 12-year-old programmers can master. Why do some browser makers fail to do it right?

Hah! I've got something that will crash IE also.. by [PF]+Lurch · 2003-05-02 19:58 · Score: 5, Interesting

Ran into this while doing some website design, simplified the problem down to this. Note, the green background is just so you can see the cell a little better.

<html>
<head>
<style>
.header
{
position: fixed;
background-color: green;
}
</style>
</head>

<body>
<table border=1>
<tr>
<td class="header">sdf</td><td>sdfsdfsdf</td>
</tr>
</body>
</html>

You have to mouseover the table cells and you will get a gpf. Should work on IE 5.5 and 6.0.

note: there is a bogus semicolon after the /td when I preview this post... it shouldn't be there, but I can't get rid of it.

Actually it's just one line by arunkv · 2003-05-02 19:58 · Score: 5, Informative

Actually only one line of HTML is required:
<input type>
As someone on BugTraq already figured out 10 days ago, it's caused due to a null value for the type attribute.

Comment removed by account_deleted · 2003-05-02 20:00 · Score: 3, Informative

Comment removed based on user account deletion

So is IE 5.1.6 on OS 9.XX by Rxke · 2003-05-02 20:01 · Score: 3, Funny

Heh. Thank you so much for porting a better IE to the Mac, Billy...

Re:So is IE 5.1.6 on OS 9.XX by b1t+r0t · 2003-05-03 01:03 · Score: 4, Insightful

Even if exactly the same code was used, it still wouldn't crash on the Mac. Why? RTFL, people. It's a null-dereference bug. That means something tried to access memory location zero. Apparently under Winderz, location zero is not mapped to anything and causes a crash from an invalid memory access.
Under Mac OS 9 and earlier, memory location zero was explicitly a real memory location. I wouldn't be surprised if null accesses under OS X also don't cause a crash. So this bug wouldn't cause a crash on a Mac, period.
It's really amazing how many people posting here have stupid conspiracy theories about this, like how it's an intentional mis-feature to test crashing the browser, and how they think the word after 'type' means anything. Look folks, the problem is that 'type' is naked, when it should be 'type="TEXT"' or something similar.

--

--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
Re:So is IE 5.1.6 on OS 9.XX by Genyin · 2003-05-03 03:54 · Score: 2, Insightful

It's a null-dereference bug. That means something tried to access memory location zero. Apparently under Winderz, location zero is not mapped to anything and causes a crash from an invalid memory access.

You don't know what you're talking about. I'll bet $5 that you have never done serious C programming before...

This is a decent explanation of what a null pointer is.

(Oh yeah, this is slashdot... why am I surprised?)
Re:So is IE 5.1.6 on OS 9.XX by Delphix · 2003-05-03 05:01 · Score: 2, Informative

Gotta call you on this one because you're talking out your ass.

It's obvious you don't understand how the operating systems handle memory on MacOS, MacOS X, and Windows NT/2K/XP.

First of all when something says NULL, it does not always mean zero. It's true that many systems use zero as an alias for NULL, but NULL can be defined as anything (read your C/C++ language definitions... that's why that have something called null and NULL defined.)

Secondly, Mac OS is not a protected memory operatating system. So yeah, it will let you write to any address you give it. WHICH IS VERY VERY BAD. It will let you write to the memory space whether or not you own it. And it's the reason why Mac OS when it crashes, crashes hard.

However, attempting to read from or write to NULL even on Mac OS will cause it to terminate your program. It's not valid to access the NULL identifier.

In Windows and Mac OS X, where protected memory is implemented... it will generate a Segmentation Fault for trying to access memory outside of your program and thus terminate your program.

If you really want to see how fast you can crash a Mac by writting to null this simple C program will demonstrate:

int main(int argc, char** argv)
{
int *a;
a = (int*)NULL;
*a = 5;

return 0;
}

And it's not explorer itself that causes the crash on Windows, it's a specific DLL it's accessing, SHLWAPI.DLL. I imagine whatever the Mac version of Explorer uses in it's place is implemented correctly. So go read the RTFA yourself, then go read some books on Computer and OS architecture before you make a post about something you don't understand again, because I'm sure a lot of people are nodding their heads at you saying "yeah, that makes sense." when its a bunch of BS.

what happens? by scubacuda · 2003-05-02 20:01 · Score: 3, Interesting

Does anyone actually *know* what happens when you submit these errors to Microsoft?

Re:what happens? by miguel_at_menino.com · 2003-05-02 20:31 · Score: 4, Funny

It generates an e-mail to Steve Balmer.

That's why he freaks out sometimes and starts screaming DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS!!

No by Zo0ok · 2003-05-02 20:02 · Score: 2, Informative

According to TheInquirer the answer is no.

I cannot confirm my self... now Windows machines here...

Where is this IE you speak of? by westyvw · 2003-05-02 20:02 · Score: 5, Funny

I have looked all over my computer for this IE thingy you all speak of. I cant find it anywhere. I typed "whereis ie" in the console but nothing turned up. I typed find / -name IE and again nothing. I looked for a man page found none. I clicked on the gear icon thing and looked though the programs installed I dont have it. So I typed apt-get IE. No luck. Must be some obscure piece of software that I cant find. Guess I am better of WITHOUT IT!

Re:Where is this IE you speak of? by fenix+down · 2003-05-02 21:09 · Score: 2, Funny

Congratulations! You're the most intelligent post on this thread!
*CUE MUSIC*
There she is... la la blah whateveerrr...

Its now my new homepage!! by stonezone · 2003-05-02 20:03 · Score: 2, Funny

what fun, just set it to your homepage, then have it restart explorer automatically once you send in the error report. Hours of fun for the bored slashdotters....

Pretty simple bug really by JanusFury · 2003-05-02 20:04 · Score: 3, Interesting

If you skip over the assembly instruction that causes the exception in a debugger, everything works fine. So if anyone pulls this trick on you, just open the debugger and skip the instruction. :) That, or get a better browser.

--
using namespace slashdot;
troll::post();

So.... by The+Bungi · 2003-05-02 20:04 · Score: 4, Insightful

It's not a vulnerability. It's a bug. It's a stupid bug, but a bug nonetheless. I used to consistently crash Mozilla on some Hotmail pages. But I didn't submit it to /. as a great story to hysterical giggles from the peanut gallery.

Slow news night, eh?

Re:So.... by zook · 2003-05-02 20:43 · Score: 5, Insightful

First: I agree.
Second: It's simple. It's cute. It's the kind of bug that makes a dev go, "Doh!", and so it's not absurd to show some interest in it. It's also a fun game to try to pin down what the problem is.
Third: Does it warrant a /. story? Have you seen half the stories that come through here? ;)
Re:So.... by Eudial · 2003-05-03 02:17 · Score: 2, Insightful

It is a vounerability. DoS vounerability to be specific. By being able to totally screw up someones Outlook Express by appending '' into a html-mail. And since it is the newest mail, OE will render it every time he/she opens it.
It can also be further exploited by javascript-based emailworms by adding a document.write("<INPUT TYPE 'Hastala visa baby'>"); after having spread itself to everyone on the contact-list.

--
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!

Bill! Get it together, Bill! by fm6 · 2003-05-02 20:08 · Score: 2, Interesting

The ease with which Microsoft software manages to generate invalid pointers has bothered me for a long time. But for the web brower to crash in the face of such a god damned simple HTML error is just plain scary. Here's the entire web page:

<html> <form> <input type crash> </form> </html>

I mean, does anybody in Redmond do any QA work at all? Or are they all too busy writing white papers, fighting lawsuits, and babbling about "freedom to innovate"?

Light-weight alright ;o) by maharg · 2003-05-02 20:09 · Score: 2, Interesting

The error is invalid page fault in shlwapi.dll

DLL Name: Shell Light-weight Utility
Library Description: Contains utility functions for handling paths, urls, strings, registry entries and color settings

Interesting that this dll can also 'handle' registry entries....

In fact, the 5 lines of html can be reduced down to one:

<input type>

..although placing this in the middle of a page doesn't always work:

<html>
<head>
<title>foo</title>
</head>
<body>
<h1>foo</h1>
<input type>
</body>
</html>

type seems to be the only attribute that has the desired effect

--

$ strings FTP.EXE | grep Copyright
@(#) Copyright (c) 1983 The Regents of the University of California.

Couldn't resist. by jkitchel · 2003-05-02 20:10 · Score: 5, Funny

Who else couldn't resist from clicking on the link that would crash IE?

Re:Couldn't resist. by UnknownQ · 2003-05-03 00:10 · Score: 2, Funny

Who else couldn't resist from clicking on the link that would crash IE?
I couldn't, but then again I have Mozilla 1.3. I typed "BWAHAHAHAHAHA!" in the resulting text box.

--
Wherever you go, there you are!

Very big deal by fm6 · 2003-05-02 20:17 · Score: 5, Informative

The IE HTML renderer is actually in a DLL that's shared by several application. And yes, they crash too. It's sort of interesting that that this DLL has no MacOS equivalent. Or perhaps there is an MacOS equivalent, but the usual low-level kludges are different on Mac and Windows.

Why is this a big deal? Because the largest software company on the planet has no better development practices and safeguards than some half-literate garage hacker.

Re:Very big deal by bratmobile · 2003-05-03 01:54 · Score: 2, Funny

Oh my god! Someone found! A BUG! In SOFTWARE! And it happens on TOTALLY INVALID HTML! How could Microsoft possibly make such a horrible, horrible mistake!!

THIS NEVER HAPPENS ANYWHERE ELSE! Thank GOD the rest of the world is bug-free!
Re:Very big deal by ATMAvatar · 2003-05-03 06:50 · Score: 2

It might not be such a big deal if IE wasn't embedded into Windows so deeply...

We would probably hear much more about bugs/exploits in Mozilla if it gave root-level access to the machine :)

--
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."

Re:Microsoft...bleh. by theVicar · 2003-05-02 20:18 · Score: 2, Interesting

It does surprise me... I mean, 'input type crash' ?? or is the input type significant or just for emphasis? It seems like what with 1-6, 8, and 9 of 9, plus all those eager-beaver interns and million typing monkeys at Microsoft this would have been caught earlier, unless the 'crash' thing was put there on purpose to intentionally cause a segfault or something so people could see what happens with all the activex controls etc. when IE does crash, and somebody forgot to remove it. Or, is Slashdot in permanent April Fool mode now? I hope so.

--
---The Vicar---

Hmm.. by chibiyoukai · 2003-05-02 20:19 · Score: 2, Interesting

I haven't decided which is worse... The fact that such a silly bug exists, or the fact that it went undetected for six years.

Crash by Hobobo · 2003-05-02 20:20 · Score: 2, Interesting

A crash bug? Mozilla has none of those, right? Right? (seriously, if anything Microsoft should be proud that one pointless crash bug is such a big deal)

Re:Microsoft...bleh. by inaeldi · 2003-05-02 20:22 · Score: 2, Informative

The "crash" part is just for looks. It would still crash with

Re:Phoenix by bockman · 2003-05-02 20:25 · Score: 4, Informative

Well, phoenix (0.5) crashes on my machine (Debian) in many ways, often downloading stuff. A couple of times, in not yet determined situations, it started to eat all memory, making the kernel to swap furiously until I killed phoenix threads.

Nothing wrong with that, Phoenix being still an alpha product. But please do not compare it with mature products, even if they are from Microsoft.

Also I don't understand why there are so many threads when nothing is going on (no download in progress and a single page shown).

--
Ciao

----

FB

Worth Pointing Out, I Think by coloth · 2003-05-02 20:32 · Score: 5, Insightful

I've crashed IE 6 several times with this HTML just fooling around, and each time, an exception is raised, a debug report generated, an optional offer is made to submit the report to the OS manufacturer to inform them of the problem, upon which immediate technical support is often given. After that action is complete, the OS remains stable, and the crash can be repeated ad nauseum, experimenting with different tags/debugger experiments/versions.

That is in a consumer OS (XP Home) that costs less than $100, and has tens of thousands of commercial apps available in almost every language. (probably millions if you include shareware/freeware)

Whether it's my mom or another engineer, I feel pretty good about telling them XP is a solid OS that can do what they need. (likewise with IE)

Not many years ago, it would have seemed pretty petty to obsess about such a bug--and that's when it would've forced a reboot.

I'm not shy about criticizing MS when appropriate, but to come from Windows for Workgroups to XP in 10 years is pretty impressive, especially for a company of its size.

If it were me, I'd spend my time debating the Software Formerly Known As Palladium, and not lose the forest for the trees by mocking MS for this kind of item. I fart bugs bigger than this.

--

Machines take me by surprise with great frequency. -A. Turing

Re:Worth Pointing Out, I Think by Vidiot3k · 2003-05-02 23:38 · Score: 5, Funny

You might want to get that checked out, I don't think it's healthy to fart bugs.
Re:Worth Pointing Out, I Think by cscx · 2003-05-03 00:10 · Score: 4, Informative

What's most interesting about this is after the "crash/error/send error report" dialog pops up, I get a small message box that says "IE has encountered an error and will need to close. Click OK to do so." However, if you don't click OK you still have complete use of the browser. I am submitting this in IE after having clicked the "crash" link on the front page.

Re:Hah! I've got something that will crash IE also by Anonymous Coward · 2003-05-02 20:42 · Score: 5, Funny

note: there is a bogus semicolon after the /td when I preview this post... it shouldn't be there, but I can't get rid of it.

does IE crash when you use backspace?

Opera and Mozilla are not affected. by Taco+Cowboy · 2003-05-02 20:44 · Score: 5, Informative

Tested with the Opera and Mozilla browsers, both on Windoze and Linux platforms, the exploit doesn't affect any of them.

IE on the other hand, crashed.

By the way, here is the entire "exploit code":

<html>
<form>
<input type crash>
</form>
</html>

--
Muchas Gracias, Señor Edward Snowden !

Re:Opera and Mozilla are not affected. by spectral · 2003-05-02 21:41 · Score: 5, Funny

And the funny part is, you only need the input line. So therefore putting something like this on your page: <a href="about:<input type die>">Click here</a> to crash IE. will also work. Though it kind of gives it away how it works if you look at the status bar. Too bad /.'s filter won't let me post that link properly. Bleh. :)
Re:Opera and Mozilla are not affected. by questionlp · 2003-05-03 03:33 · Score: 3, Informative

I believe the about:whatever has been disabled (with the key ones like about:blank and about:mozilla) by one of the patches in the IE6 "branch" as typing about:<input type foo> or using the HTML:
<a href="about:<input type foo>">Click Here</a>
just cases my installs of IE6 to come up with "Action canceled". Testing it under IE5.5 (with the latest patches) does indeed crash the browser.
Re:Opera and Mozilla are not affected. by Guppy06 · 2003-05-03 04:49 · Score: 4, Funny

<input type crash>

IE is doing exactly what the tag is telling it to do. It's a feature, not a bug!

Use a fresher Phoenix by peterwilm · 2003-05-02 20:47 · Score: 3, Insightful

Unfortunately, 0.5 is very old and there are only nightly releases since then. Try the nightly build from March 20th. It haven't managed to crash it once in those weeks.

What I really want to see... by weave · 2003-05-02 20:57 · Score: 4, Funny

I want to see some simple HTML code that will crash a spammer's email harvesting web crawler. Now THAT would be "News.*that matters..."

An infinite loop is not a bug in the application by Rares+Marian · 2003-05-02 20:57 · Score: 2, Interesting

It's a bug in the document.

What happens I guess is:

1. You move the mouse outside the body to an image or off window.
2. That blurs it.
3. It wants focus, but the mouse is off the window.

Somewhere javascript is point to self, so it runs focus, but the mouse is not on an object with any relation to javascript.

This one may just be on the boundary between what is and what isn't.

--
The message on the other side of this sig is false.

Write a worm.... by clambake · 2003-05-02 20:58 · Score: 2, Interesting

Write a worm that sets everyone's home-page to this... so very evil.

Re:Phoenix by mojowantshappy · 2003-05-02 21:02 · Score: 2, Insightful

Yeah, I use the windows copy of phoenix and I have zero problems with it. In linux I just use Mozilla.

--

This page was generated by a Barrel of Circus Midgets, and that is the way I like it!!!

I just found what to auto answer to all my spam... by ArcticCelt · 2003-05-02 21:06 · Score: 5, Interesting

"This HTML also crash Outlook" Sweet, I just found what to auto answer to all my spam. Of course with a subject line that says: I am very interested to buy your products.

--

Yahh, hiii haaaaa! -Major Kong, from Dr. Strangelove

MSFT Mac Apps by green+pizza · 2003-05-02 21:10 · Score: 3, Informative

Do you ever notice that when Microsoft makes a Mac version of a piss-poor Windows product that it tends to not suck [as much]?

Somewhat. When it comes to Office, I prefer the Mac versions to those for Windows. Perhaps it's because MS had some extra time in bringing the Mac versions to market. (MS Mac Office 98 / MS Windows Office 97.... MS Mac Office 2001 / MS Windows Office 2000.... Office v.X for OS X doesn't really count as it's a hybrid of Office 2001 and Office XP). The look and feel seems easier to live with and the Entrouage email/calendar/pim app is a lot more sane than Outlook (though is lacking full Excange integration).

MSN Messenger for the Mac is a pretty smooth little app... single file to deal with and none of the virus-like atributes of the Windows version.

MS IE for Mac was pretty good back in the days of Netscape 4. But these days there are MUCH better choices for Mac users.

Windows Media Player for the Mac (they need a better name for that app) works, but feels like quick and dirty port... I wouldn't be surprised if it wasn't done by the MS MBU (Macintosh Business Unit -- MS's Mac software team located in the Silicon Valley).

Re:MSFT Mac Apps by Ninja+Programmer · 2003-05-02 23:22 · Score: 4, Funny
- Windows Media Player for the Mac (they need a better name for that app) works, but feels like quick and dirty port...
No big surprise, it feels that way under Windows as well.

Aren't you people missing something? by madmarcel · 2003-05-02 21:16 · Score: 2, Funny

Whats wrong with you people?

This is a *SPLENDID* way to keep internet exploder (l)users away from webpages.

You don't want the average person to visit your website? smiple, insert 1 wee little line of code, et voila, bob's your uncle.

Come to think of it...if /. were to use this code/bug/feature, would that keep the trolls away?
(Hah! syeah right! Wishfull thinking ;^)

<wonderful dream>
It'll take 6 months before micro$oft fixes the problem, so that'll give the rest of us six months of troll-free slashdot happiness :P

<reality>
Having said that, I'm using Exploder on WinMe to submit this post - but mind you, it's the first time in 2 months I've been anywhere near windows - and yes, thats a real bug, it did crash - exploder only though...I figured windows would keel over with it. How eh...dissappointing ;)

Ironic thoughts for the day:
1) this IE bug WILL become a feature.
<insert appropriate marketspeak here>
2) This post will get rated 'Troll' :P

Re:Aren't you people missing something? by Isofarro · 2003-05-02 23:06 · Score: 5, Informative

This is a *SPLENDID* way to keep internet exploder (l)users away from webpages.

Careful - we shouldn't stoop to invalid and non-standard HTML as a means of highlighting abusive and non-standards compliant browsers. So before implementing this, think about validity.

Obviously, if we wrap this syntax up in a comment, it will be valid HTML. Now, considering Microsoft are stupid enough to implement conditional comments in Internet Explorer, we can wrap things up very nicely:

There you go - something which is a valid comment, but MSIE decides to think its something else - like conditional markup.

Re:Ok ok, that's it, nothing more to see here... by Duckie01 · 2003-05-02 21:24 · Score: 2, Insightful

And now... Shall we continue to post all the bugs that crash Mozilla, Netscape or Galeon?

Sure. It'd be appreciated, too.

Two points of significance for crashes. by jbn-o · 2003-05-02 21:27 · Score: 5, Informative

I fail to see the significance.

I see the significance in two ways right now:

No matter what the input stream, the application should not respond by crashing.
If the entire application crashes and the user had something valuable in another window, that data loss could be a big deal. As we become more dependant on web browsing ordinary users type more valuable data into browsers, often without thinking about the need for making backups by entering data in some other place and copying it into the browser.

--
Digital Citizen

Re:Two points of significance for crashes. by evilviper · 2003-05-02 22:47 · Score: 5, Funny

No matter what the input stream, the application should not respond by crashing.

Man, do I wish someone would tell the Mozilla team that...

--
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Re:Two points of significance for crashes. by Skuggan · 2003-05-02 23:41 · Score: 2, Insightful

This is one of the bugs in MS Products that actually don't make a big difference.

It's a usual bug. All browsers have them. This bug does *not* exist because MS is Evil. And MS probably will fix it, but I can't say they have to hurry. If someone inserts this text into a page to crash a browser, let him. It doesnt stop anyone to go to serious web sites.

Get over it. Stop this useless bashing. I'm not in anyway pro MS, but this story has got to be a joke. And if I had paid for the Slashdot subscription I would have been able to see this breaking-story before many others... What has happened to this site?

CowboyNeal - Help me!!! Come back. Plz

--
http://www.millnet.se/ GO/U d- s+:+ a C++ UL++++ P- L+++ E W+++ N+ w++ M-- PE+ t+ X++
Re:Two points of significance for crashes. by Spoing · 2003-05-02 23:44 · Score: 4, Insightful
1. 1. No matter what the input stream, the application should not respond by crashing.
  Man, do I wish someone would tell the Mozilla team that...
Got a current example?
--
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Re:Two points of significance for crashes. by blibbleblobble · 2003-05-03 00:48 · Score: 4, Informative

"Got a current example? [of mozilla crashing]"

Yep. GNU/Linux/Windowmaker, visiting pages containing java, on a machine at best unfamiliar with the language.
ps -a 14472 java-vm [defunct] 14475 java-vm 14476 java-vm 14479 java-vm ... etc
Re:Two points of significance for crashes. by Zaiff+Urgulbunger · 2003-05-03 02:31 · Score: 3, Interesting

Re potential for Outlook crashing, I'm not going to try this but if an outlook user receives an email containing this HTML then as soon as they view the email, Outlook crashes right?

But the email would still be in their Inbox... so the next time they start outlook... oh just rememebered, Outlook Express (not sure about the full Office Outlook version) will not display an email after a crash.

Worrying though!
Re:Two points of significance for crashes. by stinky+wizzleteats · 2003-05-03 05:02 · Score: 3, Insightful

I must admit, there's something strangely fitting about a Microsoft apologist argument based on sheer arrogance.

It's a usual bug. All browsers have them.

An oddball javascript gyration that changes colors for the rest of the session is a usual bug. A fundamental HTML rendering flaw that can crash the entire Internet application suite for the world's most popular and profitable operating system is a big deal.

This bug does *not* exist because MS is Evil

Agreed. Never attribute to malice that which can be explained by incompetence.

It doesnt stop anyone to go to serious web sites.

It will if (as someone else has suggested) the next Melissa-type virus includes a payload to put the bad HTML on your computer and set it as your homepage.

So much for security by indifference.
Re:Two points of significance for crashes. by rgmoore · 2003-05-03 06:46 · Score: 2, Informative

I know that Galeon has an automatic "recover session" option. If the program crashes, the next time you start it you're given the option of re-opening it in its previous state. I'm not sure if it actually keeps track of what you had typed into forms, but at least it means that if you had twelve different, hard to reach pages open at once you can get back to where you were.

--
There's no point in questioning authority if you aren't going to listen to the answers.
Re:Two points of significance for crashes. by gilroy · 2003-05-03 06:58 · Score: 2, Insightful

Blockquoth the poster:

Internet Explorer is free as well.

Is it? Or do you have to shell out $200+ for an OS license?

--
The Mongrel Dogs Who Teach
Re:Two points of significance for crashes. by FauxPasIII · 2003-05-03 08:18 · Score: 4, Funny

> Internet Explorer is free as well.

Only in the same sense that the Sports Illustrated football phone is free.

--
25% Funny, 25% Insightful, 25% Informative, 25% Troll
Re:Two points of significance for crashes. by LPetrazickis · 2003-05-03 10:49 · Score: 2

I know that Galeon has an automatic "recover session" option.

Opera had it first.;) Unfortunately, it doesn't remember form contents either.

--
Is this a sigs-optional kind of place? 'Cause I am totally down with that if you know what I mean.

<input type crash> will crash the browser... by eet23 · 2003-05-02 21:29 · Score: 2, Funny

... and will email it to all your friends as well.

Re:Users look like kids on slashdot by Anonymous Coward · 2003-05-02 21:35 · Score: 2, Interesting

Unix has had hundreds of buffer overflows in "small places" written "in a very simple way" that any coder "should be able to catch". It still took decades before an effort was even made to identify them, and we're still finding them now, despite the many man-years of auditing. Face it, no-one writes perfect code every time, not even Knuth, and most of us aren't even half way to his rigo(u)r.

If you can identify all the bugs "that any coder should be able to catch" in every line of Linux kernel and GNU support code, so nothing ever goes wrong ever again on my system, I will personally pay you a full-time wage to do it. And so would Microsoft if you wished to do it for them. So, ready to convince us that you can debug the most complex consumer software?

Get the Fix! by DarkHelmet · 2003-05-02 21:43 · Score: 3, Funny

Windows Update:

BugFix Q3823982

This patch solves a vulnerability with Microsoft Internet Explorer Versions 4.0, 5.0, 5.5 and 6.0. A missing validation allowed snippits of code such as <form><input type cras.....

-----

This program has had a critical error and must be shut down...

--
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i

Not THAT serious... by KAMiKAZOW · 2003-05-02 21:54 · Score: 5, Informative

I made some experiments and this bug is not that serious, if you use IE correctly.
IE has a feature, Mozilla/Firebird and Opera sadly don't have: IE can run in multiple processes.
If you open a new window by clicking IExplore.exe instead of pressing Ctrl-N, the new window runs in a seperate process. If you visit that crash page, only the one IE process crashes while the other processes stay unaffected (at least on NT based systems).

OTOH if a page makes Mozilla crash, the whole app suite goes down. The process seperation with Firebird and Thunderbird is a step into the right direction, but different Firebird windows do still run in a single thread.
I hope those kind of crashes send a message to all app developers (*cough*OpenOffice.org*cough*), to use multiple processes if possible (at least optional, because that would use more RAM).

This is correct behavior by Christian+Schladetsc · 2003-05-02 22:01 · Score: 5, Funny

// html_parser.cpp,v (C) 1990- Microsoft #include "html/parser.h" template void html_block(II F, II L) { for (; F != L; ++F) if (tag(*F)()) for (++F; F != L; ++F) if (tag(*F)::Type::val == Type::Crash) __asm int 3; } OK, they didnt use meta-programming C++ techniques, but there's code similiar to that in the IE source. This HTML rudely crashes IE: I didnt make that up. That's the actual contents of the html code that when processed by the HTML parser in IE crashes it. Its safe to look at here, because its not being processed by the parser - its being processed by the text renderer, which just draws text. Read it. Its not hard to understand, even if you've never seen HTML source before. The phrase "input type crash" demonstrates a clear intention, to, um, crash. It was included by the programmers for a number of very good reasons. I dont really care to list them all here. But this is clearly not a "bug". Actually, it shows good engineering practise. Microsoft rox0r. No, really, they do.

Why wasn't this discovered earlier? by JustKidding · 2003-05-02 22:03 · Score: 2, Interesting

I mean, hurds of people must have mistyped the input type tag at one point or another, how come we never heard of this before?

Bugs, crashes by fm6 · 2003-05-02 22:09 · Score: 5, Insightful

HTML clients are supposed to do skip over input they can't render. And in general, software should do something reasonable when it can't deal with input. Like deliver an error message. Crashing is always evidence of a bug, whether the data that caused it is buggy or not.

Re:Bugs, crashes by craigeyb · 2003-05-03 03:48 · Score: 2, Funny

Nah, it's a feature, man! It prevents IE users from seeing non-Microsoft-certified websites!

--
Social Contract? I don't remember signing any Social Contract!

Security Audits by aking137 · 2003-05-02 22:11 · Score: 2, Interesting

If someone has left this around since 4.0, why haven't all these security audits Microsoft claim to be doing haven't found that out yet? Are we still to believe that they actually spent a whole month in early 2002 just rooting out security holes, when they didn't notice this? Or is someone going to try and say that they /did/ notice it and then deliberately didn't fix it, on the grounds that it's just a bug and maybe not technically a security hole? Come on, really...

Andrew

Re:An infinite loop is not a bug in the applicatio by jbn-o · 2003-05-02 22:17 · Score: 2, Insightful

It's a bug in the document.

No, if that does indeed crash an application it's a bug (and I'll assume, for the sake of argument, that the parent is correct even though other posters have stated they can't get Mozilla to crash from this). Applications should not respond to any input by crashing and applications should give the user a chance to lose data because someone on the net essentially (perhaps inadvertantly) instructed the application to crash.

I appreciate the logic of the loop you're describing, but the proper response to that is not to crash or enter some state where a user's data can be lost.

--
Digital Citizen

Wait a minute. by blanks · 2003-05-02 22:28 · Score: 5, Informative

This makes it on to slashdot, but bugs like this Netscape exploit didn't?

--
I deleted my sig years ago.

Re:Wait a minute. by moncyb · 2003-05-03 06:35 · Score: 2, Funny

Maybe because no one can read it? What does it say? It appears to use english words, but well...

Who needs a few lines.. by Anonymous Coward · 2003-05-02 22:29 · Score: 2, Funny

I'm running IE 5.x and it crashes constantly with any help from a few lines of html.

Re:Phoenix by snilloc · 2003-05-02 22:33 · Score: 2, Informative

My experience with the Windows builds is that April 1 barfs a lot less than 0.5

It still barfs, and it barfs in a slightly different color, but less often. Experiment with nightlies. When you find one that doesn't barf too often, go with it.

MOD PARENT UP AS FUNNY by thynk · 2003-05-02 22:34 · Score: 2, Funny

this is one of those times when I wish I had mod points. AH... maybe someday.

--

Good judgment comes from experience, and a lot of that comes from bad judgment.

Re:Phoenix by RoLi · 2003-05-02 22:37 · Score: 2, Flamebait

But please do not compare it with mature products, even if they are from Microsoft.

No offense, but many Alpha-products are perfectly comparable to ultra-mature Microsoft products like IE or MSOffice.

Especially Phoenix/Firebird/Mozilla-Browser/whateveritscalled now which is very stable at least on my installation.

Whoa! This is worst than I thought. by Anonymous Coward · 2003-05-02 22:49 · Score: 2, Interesting

This does not just effect IE, it also appears to effect apps using the IE html rendering engine including Outlook Express and Frontpage.

Try sending someone the crash code as an html e-mail. It crashed Outlook before even previewing. SHIT.

I sincerely hope anti-virus software blocks this one soon.

Re:Whoa! This is worst than I thought. by netsharc · 2003-05-03 04:06 · Score: 3, Insightful

Is it really the responsibility of anti-virus makers to shield MS's bad programming with a it's-getting-bloatier-all-the-time syntax checker? I mean, it's good for Norton/McAfee that they can live out of MS's dumbness and user ignorance ("I run Norton, and no virus in the world, even the one that just came out today can affect me. A virus definition file, what's that?"), but heck, if you think Norton/McAfee should check everything that is to be sent to the browser, they'll pretty soon have a program as complex as the OS itself, just to check data. I think it's an OS maker's responsibility to build a whole OS, not let Norton/McAfee take care of the other half.

--
What time is it/will be over there? Check with my iPhone app!

This could turn into a new email worm by juniorkindergarten · 2003-05-02 22:51 · Score: 2, Interesting

I just pasted the code into mozilla mail and emailed my outlook express 6 client and it caused it to crash. (Go figure)
I haven't tried outlook 2000 yet. Anyone want to give it a shot?

--
"Every security scheme that is based on secrets eventually fails." - Steve Jobs

Re:Microsoft...bleh. by mrjb · 2003-05-02 22:52 · Score: 2, Funny

If you really want to prove a point, make sure its an html email then.

--
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book

Outlook Express affected by kh0ng · 2003-05-02 22:58 · Score: 2, Interesting

Outlook Express uses the IE-Rendering Engine, so...

One HTML-Message posted in a Newsgroup and containing the line "<input type>" (Shortest form of the exploit...12 bytes to crash IE) will kill all Outlook Expresses who try to read it (remember that OE _always_ displays the HTML-Version of the post), leaving the users puzzled and perhaps "insightful +5"...

Re:ME??? by thynk · 2003-05-02 22:59 · Score: 2, Insightful

I'm a big linux fan, I really am. I just don't really have the time to set it up properly if I'm working on something "non standard". After spending 2 days working to get Via Voice working on various linux distros I finally gave up and installed XP on the box. Total time till the project was done, less than one hour including install.

What kind of makes me mad is when I request that our IT department install some software on my box at work. They leave it at the BSOD and try to blame me for it. Now that kind of thing stopped right away once my boss was backing me up. Now we have the only TWO home brewed PCs out of several thousand. Our IT department has admin access to them, but doesn't use it since we support them ourselves. Funny, hasn't crashed once since then.

I think Linux has a very powerful user base, I think most people who run linux are a touch smarter than those who *can't* run linux or don't know any better than to run what their computer came with. I think *nix in general is far more powerful than winderz, but I think windows also has it's place in the market.

Yes, this particular bug crashes IE in Windows. BFD. Opening Netscrape was iffy at best on a *nix box. The nice/scary thing about working where I do is we have 2 flavors of unix, dos 6.x to Windows 95, at least 3 distros of linux, a few NT boxes, several 2k boxes and even the odd OS/2 machine. Every OS has it's place and is useful in it's own right.

Now, take a time out in the corner and meditate on these teachings of tolerance of other OSes.

--

Good judgment comes from experience, and a lot of that comes from bad judgment.

I tried with Opera by Azahar · 2003-05-02 23:09 · Score: 2, Informative

Opera 7.10 on Win 2k just gave a blank page leaving the other pages up and running no matter what identification I set it to.

--
Cuiusvis hominis est errare; nullius nisi insipientis in errore perseverare.

Re:I tried with Opera by Old+Uncle+Bill · 2003-05-03 00:28 · Score: 3, Funny

Those sneaky bastards must have QA'd that piece of code. How can MS really compete with that?

--
Yes, I am an agent of Satan, but my duties are largely ceremonial.

Re:Simpler repro by Ollierose · 2003-05-02 23:11 · Score: 2, Informative

In the aim of experimentation, I looked this up on the W3C HTML 4 pages. OK, so IE isn't usually one for sticking to the standards, but bear with me here...
here is the bit distilled into /.ism below
INPUT
type (implied) one from text|password and so on
if type is not present, text should be assumed. (This explains why everything renders it as a textbox, at least)

In the code that kills IE, the type attribute is present but not set, so its quite feasible that other browsers check for the type value in a different method, like assuming it is text unless the attribute value is in the list of valid types.

Re:Phoenix by Alorelith · 2003-05-02 23:14 · Score: 2, Interesting

I tried it in Netcaptor which is based on Internet Explorer--the page opened and the error message popped up, but Netcaptor kept on chugging. It's really a great browser. Offtopic, but when is Mozilla/Firebird going to incorporate something similar to Captorgroups. And don't even mention that multiple bookmarks on startup, that's not the same thing. Captorgroups are much more versatile.

Time to recognize a wider social significance. by jbn-o · 2003-05-02 23:28 · Score: 2, Insightful

Of course any attempt to pass that as a security concern back then would have been laughed at. loudly.

And undeservedly. People who could not see the potential for the web and understand that a critical application like a web browser must be made crash-proof should be corrected. Not by pointing and laughing, but by careful and patient explanation about how more people in everyday society depend on a well-functioning web browser that can handle any input (including input from potentially hostile webpage authors) without crashing (and thus losing what could be valuable data).

I'm not sure what has fundamentally changed since then.

What has changed since the days when people used Netscape's version 3 browser is an increase in the number of people who use web browsers for important work. Developers who don't take this concern seriously are not developers one should trust with important data.

--
Digital Citizen

Outlook and Frontpage are also affected... by Uzull · 2003-05-02 23:33 · Score: 2, Insightful

Just imagine : a spam mail using that code going to millions of IE / Outlook users... This would at least have one positive effect : Make the consumer aware that Yes, there are bugs and security issues in Windows and IE. You can no more read your email...

In related news......... by sjoel · 2003-05-02 23:56 · Score: 2, Funny

in related news, the microsoft operating system is buggy and full of holes.

So what.. by destiney · 2003-05-03 00:18 · Score: 2, Informative

Last time I checked I could still crash Mozilla with onSelect="select()" or an onFocus="select()" in a <textarea>.

They all have bugs to some point. You're a fool if you think otherwise.

confirmed: the crash happens by Anonymous Coward · 2003-05-03 00:38 · Score: 3, Informative

Using IE6 on WinXP prof. with all SPs and updates installed.

IE version: 6.0.2800.1106.xpsp2.021108-1929

but I cannot see any obvious reason, WHY this happens. and WHY this only happens, when you put the mouse over the cell...

actually a bit mysterious to me

(Also checked: Mozilla 1.4a renders this page fine and has no problems with the mouse hovering over the cells. Again, mysterious, eeeeh...)

OSS and the w3 falling behind - AGAIN! by IIRCAFAIKIANAL · 2003-05-03 01:22 · Score: 4, Funny

I mean, IE implements the tags correctly and you all just noticed? Yet again we see that Microsoft IE is ahead of the game, implementing useful tags that the w3 hasn't even thought of yet.

Why is it that Microsoft is saddled with the burden of creating useful standards? Isn't this supposed to be the job of the w3?

I expect we'll have to wait a few years to see it in Moz and by then, microsoft will have implemented <input type explode into tiny pieces> or something even more spectacular.

--
Robots are everywhere, and they eat old people's medicine for fuel.

I got a fix... by miketang16 · 2003-05-03 01:34 · Score: 4, Informative

http://www.w3c.org

nuff said.

--
-------
"In times of universal deceit, telling the truth becomes a revolutionary act."
-- George Orwell

Re:A new way... by dorward · 2003-05-03 01:43 · Score: 2, Informative

you either have body tags or you have frameset tags, the one you use depends on the type of html document you have

No, the specification says you need a body element or a frameset element, you don't need to use a tag to create an element though.

7.5.1 The BODY element
Start tag: optional, End tag: optional

The following is a valid HTML 4.01 Strict document, feed it in to the validator if you want conformation.

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"> <title>Demo of a Valid Document</title> <h1>Demo of a Valid Document</h1> <p>This is a valid HTML 4.01 Strict document. Note the lack of <body> tags.</p>

Careful with those emails! by Anonymous Coward · 2003-05-03 01:54 · Score: 5, Interesting

I just sent a HTML email with this in to a friend who runs Outlook 2000. As soon as he got it, it crashed Outlook. Funny thing is every time he starts Outlook up it crashes again so he can't rmeove it. Disables his email program with one crafted email!

Re:Careful with those emails! by HoaryCripple · 2003-05-03 04:09 · Score: 3, Funny

Is he still your friend?
Re:Careful with those emails! by netsharc · 2003-05-03 04:15 · Score: 4, Informative

That sucks. :) Better find the Outlook.pst file (%HOME%\Application Data\Microsoft something something), which has all the data Outlook shows. Rename that file temporarily, start Outlook (it'll probably create a blank PST file), turn off the Preview Pane/AutoPreview, close Outlook and replace the new PST file with a copy of the original one. Hopefully you can then start Outlook with the Preview Pane turned off. Of course, this may not work when Outlook stores the Preview Pane settings inside the PST file itself. When that's the case, you can always go back to the previous method, but don't close Outlook and instead try to open the old PST file (Right click on "Outlook Today - [Personal Folders]" on the Folders List and choose "Open Outlook Data File...").

Hey why am I bothering, you are AC and probably won't see this anyway.

--
What time is it/will be over there? Check with my iPhone app!
Re:Careful with those emails! by barfy · 2003-05-03 14:41 · Score: 2, Insightful

um, a virus needs to be able to propogate. This would be as effective an epidemic as if SARS killed the carrier on contact.

It is however a great way to piss off a friend or if someone had a good spam list, or a DOS of a company...

But it makes a really bad virus.

Re:Hah! I've got something that will crash IE also by CCRancor · 2003-05-03 02:03 · Score: 2, Funny

It's really not a bug - you're just moving your mouse too slow ;)

--
Open source is the art of letting other people write your bad code.

It did not crash Lynx by drunk_as_in_beer · 2003-05-03 02:09 · Score: 5, Funny

I repeat, it did not crash Lynx.

--
--Drunk as in Beer

It crashes with other input "types" by rollingcalf · 2003-05-03 02:47 · Score: 2, Informative

You don't need to specifically put "input type crash", as something like this also crashes IE:

<html>
<form>
<input type abc123>
</form>
</html>

--
---------
There is inferior bacteria on the interior of your posterior.

What if... by dumboy · 2003-05-03 02:49 · Score: 2, Funny

MS did it on purpose for debugging purposes? Maybe a couple more tags like
<input type bluescreen>
<input type slow_machine_to_crawl>
<input type bsa_audit>
<input type flood_ISP>
exist and they just haven't been discovered yet.

Crashes desktop in auto-preview!!! by Anonymous Coward · 2003-05-03 02:49 · Score: 2, Interesting

Just for grins, I saved the file, and now can't delete it (without mucking around) due to the fact that the whole desktop crashes while IE tries to render the little thumbnail of the page in Exploder. And no--I don't have active desktop enabled.

Fun for the whole family!

This is not fair by unborn · 2003-05-03 03:06 · Score: 2, Funny

Why do Windows people get all these features. I don't even have a way to test it. Damn you Microsoft Monopoly. Damn you Konqui for refusing to crash when most needed.

no prob with Konqueror by The+Tyro · 2003-05-03 03:12 · Score: 2, Interesting

it shook it off just fine.

--
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.

Re:Crashing != bug by satch89450 · 2003-05-03 03:21 · Score: 4, Insightful

I work on an industry-leading mathematical library. We rely, in a few places, on getting sensible input from our client apps. If they give us garbage, they have no guarantees about getting a sensible error back, or even about anything ever coming back.

I'm sorry you don't mention the name of your company, because your company makes software that should be shunned. No software should respond in an astonishing way when fed valid data that is outside of the domain of the function -- it should do range-checking and set an appropriate error flag and return to the caller with something, even if that "something" is a NAN. Even when fed absolute junk, it should detect the junk and error out in a predictable manner.

In particular, taking down the application (and perhaps the entire system it's running on) is not an option.

Crasher warning by edsel · 2003-05-03 03:50 · Score: 2, Insightful

I just noticed that the tantek.com link I posted above crashes Webcore-based browsers. After posting the comment from OmniWeb 4.5 (which uses KHTML Webcore) I clicked on the link. OmniWeb crashed.

Since I'm using a "Sneaky Peek" version of OmniWeb, I thought that maybe it was just a bug in the beta code. I tried the same link in Safari and it crashed too.

I assumed that since this was a page on Tantek Çelik's site the CSS would be valid. The page flunks the HTML validator at w3c.org because of a misplaced noscript tag. - I wouldn't expect that to crash a browser.

Must be a WebCore bug. Kind of ironic given the topic.

NULL pointers and error handling by _xeno_ · 2003-05-03 03:51 · Score: 5, Informative

Actually, under Windows and UNIX and almost every OS I know about memory location 0 is mapped. It's mapped to the kernel. (Hense the talk of "user space" vs "kernel space".) Attempting to read or write to this location will cause an access violation on the resulting page fault, whatever the OS chooses to call the error. UNIX calls it a segmentation fault, and Windows calls it a general protection fault. (XP calls it "a problem.")

This is a good thing. NULL is generically used to indicate that a pointer is invalid. Attempting to read or write to a NULL pointer is always a bug and should cause the application to be stopped. Writing and reading from random memory address is a sure fire way to cause interesting results. Enforcing such restrictions helps to force programmers to ensure their programs are at least less buggy in that respect.

MacOS 9 allowing location 0 read/write is a bug, not a feature. (Well... probably not, really. MacOS 9 and prior probably allowed 0 as a valid userspace location.) When a program attempts to read or write to NULL, it should be terminated, as this is an error condition. This would be like ignoring the low oil pressure light on your car - you might be able to keep running for a while, but disaster could strike further down the road.

--
You are in a maze of twisty little relative jumps, all alike.

Re:NULL pointers and error handling by Krach42 · 2003-05-03 08:59 · Score: 2, Interesting

OS1-9 used a non-protected memory model. There was no virtualized memory, because every application worked in the same memory space. And actually, this is nearly the same way that Win9x worked. Thus, the recommendation from Microsoft to reboot the entire system if a program crashed in 9x.

--

I am unamerican, and proud of it!
Re:NULL pointers and error handling by HiThere · 2003-05-03 09:49 · Score: 2, Funny

And this is a part of why idiot lights are a really inferior replacement for gagues. If the gague died, you could tell immediately, as it needle dropped to the bottom (or pegged the top).

Another vile interface with idiot lights is the one that has an indecipherable light. Several mechanics have not been able to figure out what it means that one idiot light in my car sometimes comes on. One time it was fixed for about a week by adding oil (the oil light didn't come one, but when I checked the dipstick it was v. low). The owner's manual is... inscrutable.

Now, how to tie this back to null pointers... null pointers are sometimes 0 values that get stuck into pointers by accident. I don't think I've ever seen a good valid use of a null pointer as a pointer. But it's the default initial value (when there is one). So null pointer references *should* be disallowed. But I've encountered bad valid uses of null pointers. I've seen code where location 0 was used to store a value that needed to be globally accessible. (This may have been on a Z80, or some such.) Now that was a bad valid use of a 0 pointer, but it did allow code to be relocated. The problem was, if you encountered a pointer, you couldn't tell the difference between a null pointer and a 0 pointer. This lead to many troublesome errors. A far better choice is to just disallow it.

--

I think we've pushed this "anyone can grow up to be president" thing too far.
Re:NULL pointers and error handling by Pyrion · 2003-05-03 12:47 · Score: 2, Insightful

Unless you have something like MS Visual Studio installed, in which case it comes up with something like...
The instruction at "0x70a71927" referenced memory at "0x00000000". The memory could not be "read".

--
"There is much pleasure to be gained from useless knowledge." - Bertrand Russell.

Re:Current example Mozilla crash by pointym5 · 2003-05-03 04:07 · Score: 2, Informative

The 1,3 version seems to fix all the ebay crash problems.

Re:Crashing != bug by Malc · 2003-05-03 04:16 · Score: 2, Insightful

Rubbish. A library has to be bullet-proof too. For example, look at the bugs in the C library for malformed input - the worst ones result in buffer-overflows that result in remote exploits.

Re:IE Mac is fine by KefkaFloyd · 2003-05-03 04:44 · Score: 2, Informative

You need some reading comprehension skills. He meant that in ADDITION to IE.

--

Conglom-O: We Own You (TM).

No "bashing", well-earned untrustworthiness. by jbn-o · 2003-05-03 04:46 · Score: 4, Insightful

It's a usual bug. All browsers have them.

No, not all browsers have this bug and so far I can't replicate similar sounding bugs in Mozilla producing a crash and loss of work. Also, not all browsers are so widely used and not all browsers integrate code with widely used e-mail clients (Outlook and Outlook express still use the same HTML renderer that is subject to so many problems). This leads to multiple paths to sabotage someone remotely, perhaps even anonymously. Let's not forget that any application that embeds MSIE/Windows' renderer is vulnerable. Considering how many people use MSIE on MS Windows and how many of them are affected by this bug, I'd hardly call revealing the bug a "joke".

This bug does *not* exist because MS is Evil.

I'm not encouraging anyone to think in the false dichotomy of good vs. evil and neither should you. Nobody is helped by glossing over relevant details of how this works or ignoring the wide scope of the bug. This is one of a long string of Microsoft bugs that directly adversely affects ordinary users. We are much better served by suggesting real-world fixes (such as switching to Mozilla to do most browsing, even under a proprietary operating system). We're also better off identifying this exemplar of the practical shortcomings of proprietary software. There's no workaround here--MSIE/Windows users must simply wait for a fix from the proprietor if they won't switch browsers (and any other app adversely affected by embedding the MSIE renderer).

--
Digital Citizen

Re:Crashing != bug by NickFitz · 2003-05-03 04:53 · Score: 2, Interesting

You don't need to idiot-proof it, you just need to make sure it doesn't behave ungracefully when assaulted by an idiot.

It's impossible to do that. Turing demonstrated that it is not possible to determine whether any given algorithm will execute to completion for all possible inputs. As the library in question is a mathematical one, it will undoubtedly contain algorithms which will not complete for some input or inputs, and all the bounds-checking in the world cannot guarantee security from input which will cause an infinite execution time. If it was possible, it would be a solution to the Turing machine halting problem, and such a thing cannot be, by definition.

--
Using HTML in email is like putting sound effects on your phone calls. Just say <strong>no</strong>.

Re:Crashing != bug by NickFitz · 2003-05-03 04:57 · Score: 2, Funny

He writes a library not software.

What, like a mediaeval monk? ;-)

--
Using HTML in email is like putting sound effects on your phone calls. Just say <strong>no</strong>.

0 isn't mapped to the kernel... by pr0ntab · 2003-05-03 05:00 · Score: 2, Insightful

On Linux and Windows, the .text segment of the currently rybbubg program starts one page AFTER 0. the page containing the address 0 is marked no-access so that NULL pointer deferences PURPOSEFULLY crash the program. They waste 4k of memory for that feature.

Otherwise, the program would just keep going. YOu wouldn't see the crash until you attempt to write there and clobber your code.

--
Fuck Beta. Fuck Dice

I can do it in 12 bytes!!!! by Anonymous Coward · 2003-05-03 05:33 · Score: 2, Funny

You people are just like microsoft with your bloated code. Wasting all the extra space with unneeded characters. If there's one thing a Bleveskovolokian knows how to do it's to save an extra few bytes. Try:

<input type>

That's all. None of that unneeded crap. 12 bytes and crash!! The most efficient IE crasher web page yet. Beat that! I dare you.

Re:Crashing != bug by Anonymous+Brave+Guy · 2003-05-03 05:48 · Score: 2, Insightful

No software should respond in an astonishing way when fed valid data that is outside of the domain of the function -- it should do range-checking and set an appropriate error flag and return to the caller with something, even if that "something" is a NAN.

Please tell me you're not just talking about things like forgetting to check before dividing by zero or SQRTing a negative number! If you are, then you are totally misunderstanding this conversation. We're in a different league here.

Even when fed absolute junk, it should detect the junk and error out in a predictable manner.

Unfortunately, you've spent so long checking that your algorithm will work correctly and terminate (assuming such checks are even possible) that no-one else will ever use your code because the alternatives are several orders of magnitude faster, which is the dominant requirement for the type of software we provide.

Any library can get bad input. You can pass me a pointer to your data structure and claim it's valid, but actually give me an address outside of memory that I'm allowed to access so I segfault when I follow it. It is not possible to write a 100% bulletproof library in this situation.

You have to trust your calling code to do its job, and you have to be clear about what input you accept with defined results so those writing the calling code can do their job. There is no other option.

The only remaining question is how broad you choose to make the set of valid inputs. This is simply a trade-off between safety and performance, and in this particular industry, standard practice is to trust your caller and go for performance. You're necessarily relying on them to give you good input anyway, so further checks just slow you down without any real safety benefit.

In particular, taking down the application (and perhaps the entire system it's running on) is not an option.

Actually, taking down the whole application and providing diagnostics is one of the better options, since it makes it clear during testing that there is a bug, which in turn implies that our client application has a logic error somewhere in it.

If my library doing something can take down your whole system, your OS is broken, of course.

--
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.

Couldn't you use it for anti-Outlook spam? by SysKoll · 2003-05-03 06:02 · Score: 2, Insightful

Well, guys, this has a serious consequence. Suppose that some shoddy business guy wants to paralyze the operations of a competing company that runs Outlook (don't laugh, I know several Very Important Companies that depend on Outlook).

All you have to is to spam this company with this small HTML one-liner. Outlook is set to preview on most desktops. So the hapless users' Outlook would crash and could not be brought back: If you start it again, it would try to preview the offending message again and CRASH.

That would seriously hamper the operations of a company, and if that company is, say, a Wall Street broker, the financial losses could amount to millions.

So IT support people should really demonstrate this vulnerability to the clueless PHBs who insist on putting Outlook on their company's desktops. Maybe they'd stop being so foolishly blind to MS-induced security risks if, say, THEIR Outlook crashes and burns...

-- SysKoll

--

--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/

DIY IE by usotsuki · 2003-05-03 06:02 · Score: 3, Informative

5.50.4134.0600

Type address
about:<input type crash>

and watch IE go up in smoke

IEXPLORE caused an invalid page fault in module SHLWAPI.DLL at 016f:70bd1d1e. Registers: EAX=00000001 CS=016f EIP=70bd1d1e EFLGS=00010202 EBX=01b9bf20 SS=0177 ESP=0279fa00 EBP=0279fa10 ECX=0279fa18 DS=0177 ESI=00000000 FS=138f EDX=70d4b0a8 ES=0177 EDI=00000000 GS=0000 Bytes at CS:EIP: 0f b7 06 46 46 83 f8 41 7c 05 83 f8 5a 7e 1d 0f Stack dump: 70e7f5b0 70e4e2e2 00000000 70d4b0a8 00000034 70c93150 00000000 00000034 01ba6148 01b9b1d0 01b9bf20 01ba6148 01ba6148 70c9300b 00000034 01ba6148

--
Dreams, dreams, don't doubt dreams, dreaming children's dreaming dreams. Sailor Moon SS

crash test by kavau · 2003-05-03 06:53 · Score: 2, Funny

...you can test/crash your IE by going here.

It wor

IE under XP crashes by pollotech · 2003-05-03 07:48 · Score: 2, Funny

I can't beleave this Micro$oft people, I have XP Professional with IE 6.0.26 and crashes too. I thought this kind of so evident IE problems where over after version 4.

This is not really a Microsoft problem... by rnd() · 2003-05-03 08:04 · Score: 2, Insightful

It's a C++ problem. One of these days, IE will be written in VB.NET or C#, and problems like these (as well as those that don't cause a crash but cause a security vulnerability) won't happen nearly as often.

--

Amazing magic tricks

IE by gobbligook · 2003-05-03 08:39 · Score: 2, Funny

IE just crashes cause it has nothing better to do. Bottom line, if you want reliability use lynx, if you want unreliable bloat use IE.

Re:Hah! I've got something that will crash IE also by Krach42 · 2003-05-03 09:23 · Score: 2, Informative

The semicolon is from Slashdot breaking your & g t ; apart, to ensure that it properly line wraps.

They still insist that breaking apart &blah; tags is not a bug.

--

I am unamerican, and proud of it!

MS Crash Month by lostchicken · 2003-05-03 09:45 · Score: 2, Funny

...as it seems that [this] is the Microsoft Crash mounth [sic]...

Isn't every month MS crash month?

--
-twb

input type crash by cyclist1200 · 2003-05-03 13:46 · Score: 3, Funny

Finally, software that does what it's told!

Would the inverse apply? by Transcendent · 2003-05-03 16:28 · Score: 2, Funny

If that crashes it... would "" fix windows?

way to fight spam by sewagemaster · 2003-05-03 16:49 · Score: 2, Interesting

this shall now be my procmail autoresponse to filter all those annoying unwanted emails. just reply with those html tags and outlook will crash on their computer. ha!

--
my blog

smaller code by Fletch · 2003-05-03 17:12 · Score: 2, Informative

this alone yields the same result (in IE 6.0.2800.1106.xpsp1.020828-1920, at least):
<table border="1"> <tr> <td style="position: fixed;"></td><td></td> </tr> </table>
it looks like the table border must be >0, but only because the crash actually occurs when you mouse-over (any part of) the border, not the cell itself. weird.

167 of 887 comments (clear)