I don't know what the severity of this bug is, but it's an integer overflow. I haven't seen the code, I don't know the potential impact, it may be harmless. <Freaky> I just can't resume this fucking HUGE file from fileplanet ;.; <Freaky> goddamned browser crash after 2030 megs <Freaky> the file is little over 2190 <Bluefox> you can't wget it? <Freaky> it just seems to do nothing <Freaky> but it also appears to report a negative number for how much of the file is retrieved <Bluefox> signed integer <Freaky> yes I know <Freaky> it's a mistake <Freaky> should be unsigned, you can't have a negative part of a file :P <Bluefox> it's an integer overflow <Freaky> I know what the bloody problem is <Bluefox> it's mozilla? <Freaky> firefox <Bluefox> <Freaky> goddamned browser crash after 2030 megs <Freaky> WGET overflows, and I don't know what at <Freaky> that wasn't related to the download <Freaky> wget reports a negative file size, makes the connection, then quits without any fucking reason for WHY it's quitting. Appears as if wget can't resume a very large file, not sure if this causes a dangerous integer overflow or just a harmless exit when wget sees +int > -int. I can't tell from this conversation what caused the browser crash, but I suspect downloading a file bigger than 2^31 bytes causes an integer overflow in Firefox as well. Maybe. I haven't even reproduced the problem, and no way am I gonna crack open the code and pretend I can security audit it. http://www.fileplanet.com/files/140000/148736.shtml is allegedly where to access the file in question, though any file >2048M should work. Just run a local apache and host a 2200M dd from /dev/zero or something.
mozilla, seemant, gregf: please confirm/advise.
Debunking this looks like a job for our Auditing team. Mozilla and others, we'll call you back when we'll have debunked it.
Keeping everyone in otherwise they can't see the bug anymore.
firefox part looks a little like bug 77381 and https://bugzilla.mozilla.org/show_bug.cgi?id=228968
I just successfully downloaded a 2099MB file using wget 1.9. So I don't see any apparent problem with wget. I don't have time to audit it, but I'll suggest it around. Anyway, I believe Matthias is right about Firefox, so I'm just gonna mark this as a dupe, unless anyone objects. *** This bug has been marked as a duplicate of 77381 ***
