mailing list archives
Re: firefox 188.8.131.52 crash
From: Valdis.Kletnieks () vt edu
Date: Fri, 09 Mar 2007 17:27:34 -0500
On Fri, 09 Mar 2007 16:33:58 EST, "M. Shirk" said:
0x8040 through 0x9D40 Crash
But 0x9E40 does not crash (72x40512) :-)
Shooting in the dark here - I wonder if that's being treated as a signed number
and thus negative, and from 0x8040 to 0x9D40 lands it on something that's
immediately critical and causes a crash, but 0x9E40 lands on some memory that
isn't used very soon, thus avoiding an immediate crash but producing
destabilizing results down the road, like your bookmarks evaporating, or
strange infinite loops, or any of the other usual symptoms of random
fandango-on-core memory overlays....
One has to wonder if any offset happens to land on something that eventually
leads to a remote-code-execute.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/