Closed
Bug 664397
Opened 13 years ago
Closed 13 years ago
Crash in [@ nsBindingManager::RemovedFromDocument(nsIContent*, nsIDocument*) ]
Categories
(Core :: XML, defect)
Core
XML
Tracking
()
RESOLVED
DUPLICATE
of bug 485941
People
(Reporter: Tobbi, Unassigned)
Details
(Keywords: crash, testcase, Whiteboard: [sg:dos])
Crash Data
Attachments
(1 file)
|
(deleted),
text/xml
|
Details |
I'm not sure how exploitable this is, so turning on security-group, just to be sure.
I got mailed about this some time ago (a week or so). I ignored it at first because I thought it was spam. But apparently, it's a valid crash.
The XML file attached crashes in [@ nsBindingManager::RemovedFromDocument(nsIContent*, nsIDocument*) ]. See https://crash-stats.mozilla.com/report/index/bp-5dcf3de9-125b-49d2-ad5a-3d4d12110615
|
||
Comment 1•13 years ago
|
||
dupe of bug 485941 ?
|
||
Comment 2•13 years ago
|
||
Sure looks like it....
|
|
||
Comment 3•13 years ago
|
||
The stack in the crash report is definitely not exploitable.
|
||
Updated•13 years ago
|
Group: core-security
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Whiteboard: [sg:dos]
You need to log in
before you can comment on or make changes to this bug.
Description
•