Bug 311680

Application: konqueror (4.9.3)
KDE Platform Version: 4.9.3
Qt Version: 4.8.4
Operating System: Linux 3.6.9-2.fc17.x86_64 x86_64
Distribution: "Fedora release 17 (Beefy Miracle)"

-- Information about the crash:
- What I was doing when the application crashed:

Mainly to see what would happen :) I extracted the Billion Laughs xml from http://en.wikipedia.org/wiki/Billion_laughs and put it in a file and called
/tmp/billion.xml and ran:

    konqueror /tmp/billion.xml

konqueror opened up the window and then sat chewing CPU for quite a while and finally keeled over.  At the time it died, its RSS had reached 2.1GB.

This is a fairly well-known DoS attack and presumably could be triggered by visiting a suitably malicious web site.

-- Backtrace:
Application: Konqueror (konqueror), signal: Aborted
Using host libthread_db library "/lib64/libthread_db.so.1".
82	T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
[Current thread is 1 (Thread 0x7fbc1ad1e880 (LWP 8053))]

Thread 2 (Thread 0x7fbc0ab58700 (LWP 8055)):
#0  0x00000030db4e8bdf in __GI___poll (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>) at ../sysdeps/unix/sysv/linux/poll.c:87
#1  0x00000030dd447af4 in g_main_context_poll (n_fds=1, fds=0x7fbc04002bb0, timeout=-1, context=0x7fbc040009a0, priority=<optimized out>) at gmain.c:3440
#2  g_main_context_iterate (context=context@entry=0x7fbc040009a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3141
#3  0x00000030dd447c14 in g_main_context_iteration (context=0x7fbc040009a0, may_block=1) at gmain.c:3207
#4  0x00000033011a5fe6 in QEventDispatcherGlib::processEvents (this=0x7fbc040008c0, flags=...) at kernel/qeventdispatcher_glib.cpp:426
#5  0x00000033011766ef in QEventLoop::processEvents (this=this@entry=0x7fbc0ab57cd0, flags=...) at kernel/qeventloop.cpp:149
#6  0x0000003301176978 in QEventLoop::exec (this=0x7fbc0ab57cd0, flags=...) at kernel/qeventloop.cpp:204
#7  0x0000003301078940 in QThread::exec (this=<optimized out>) at thread/qthread.cpp:542
#8  0x0000003301156f0f in QInotifyFileSystemWatcherEngine::run (this=0x15972b0) at io/qfilesystemwatcher_inotify.cpp:256
#9  0x000000330107b91c in QThreadPrivate::start (arg=0x15972b0) at thread/qthread_unix.cpp:338
#10 0x00000030dc007d14 in start_thread (arg=0x7fbc0ab58700) at pthread_create.c:309
#11 0x00000030db4f168d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Thread 1 (Thread 0x7fbc1ad1e880 (LWP 8053)):
[KCrash Handler]
#6  0x00000030db435935 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#7  0x00000030db4370e8 in __GI_abort () at abort.c:91
#8  0x00000030dfc60dad in __gnu_cxx::__verbose_terminate_handler () at ../../../../libstdc++-v3/libsupc++/vterminate.cc:95
#9  0x00000030dfc5eea6 in __cxxabiv1::__terminate (handler=<optimized out>) at ../../../../libstdc++-v3/libsupc++/eh_terminate.cc:40
#10 0x00000030dfc5eed3 in std::terminate () at ../../../../libstdc++-v3/libsupc++/eh_terminate.cc:50
#11 0x00000030dfc5f146 in __cxxabiv1::__cxa_rethrow () at ../../../../libstdc++-v3/libsupc++/eh_throw.cc:116
#12 0x0000003301176be4 in QEventLoop::exec (this=<optimized out>, flags=...) at kernel/qeventloop.cpp:218
#13 0x000000330117b768 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1218
#14 0x00000033074b0572 in kdemain (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kde-baseapps-4.9.3/konqueror/src/konqmain.cpp:227
#15 0x00000030db421735 in __libc_start_main (main=0x400820 <main(int, char**)>, argc=2, ubp_av=0x7ffffd7d0658, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffffd7d0648) at libc-start.c:226
#16 0x0000000000400851 in _start ()

Possible duplicates by query: bug 308801, bug 308152, bug 306773, bug 306218, bug 305584.

Reported using DrKonqi