Simple CSS code to crash IE 8 · IE 9 is found



Code that causes Internet Explorer to crash on just one lineThere was also a thing, but also the code found this time it is possible to crash Internet Explorer 8 and 9 just by adding a few lines to CSS.

Benutzer: Schinken / CSS - IE - Crash - Hackerspace Bamberg - Backspace
http://www.hackerspace-bamberg.de/Benutzer:Schinken/CSS-IE-Crash


The demo page is here,IE8 · IE9 crash at the moment of access and become inoperable.

http://schinken.github.io/experiments/iecrash/crash.html

When I actually accessed it with IE 8, as soon as I accessed the page, I no longer accept any operation, and freeze as it is. There is no such thing as "to run out of CPU" or "to eat memory", but only IE will be inoperable. Even if you right-click from the task bar it got no response and it takes time to try to terminate from the task manager.


As for the code which is the problem, since the part of ".trwurst" below is only specifying the class name, whatever it is OK.

.trwurst {
Filter: progid: DXImageTransform.Microsoft.gradient (startColorstr = '# f 8 f 5 ed', endColorstr = '# e 8 e 5 db', GradientType = 0); }

.trwurst: first-letter {
Text-transform: uppercase; }

It was German programmer Christopher Schirner who discovered this. This code occurs when you use two things together, "gradation" and "capitalize the first letter of the text" in CSS, Schirner says probably that redrawing has looped Guess. We have already reported to Microsoft, but because of its limited impact, we have not been corrected so far.

Combination of filter: and: first-letter {text-transform: uppercase;} freezes IE 8/9 | Microsoft Connect
https://connect.microsoft.com/IE/feedback/details/790265/combination-of-filter-and-first-letter-text-transform-uppercase-freezes-ie8-9


With the old version of Internet Explorer involved,IE6, IE7, IE8, IE9, there is no plan to fix vulnerability of XML tangle information leakage, I am not likely to expect too much modification of this case.

in Note,   Software, Posted by logc_nt