full-disclosure - Re: Internet Explorer Crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 18 Apr 2007 18:52:02 +0200
From: "Michele Cicciotti" <mc@...msa.net>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: Internet Explorer Crash

> There should be an implimentation on ALL browsers that a loop such
> large is
> unacceptable and refuse to even run it. There is no viable reason for a
> client-side to run a loop through so many itterations.

It's an unsolvable problem in computer science: a program (the browser) cannot calculate exactly how long another program (the script) will execute except by executing it... thus running at least as long as the latter. Proven mathematically, inescapable fact. The PoC at hand only demonstrates the easiest case, but there are infinitely more possible ones. The only safe way out is a timeout, like Internet Explorer (or PHP on the server side) implements

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/