Skypher » Opera http://skypher.com The blog for absolutely nothing! Fri, 16 Jul 2010 08:26:58 +0000 en hourly 1 http://wordpress.org/?v=3.0 Apple QuickTime memory corruption when loading BMP file http://skypher.com/index.php/2010/04/12/apple-quicktime-memory-corruption-when-loading-bmp-file/ http://skypher.com/index.php/2010/04/12/apple-quicktime-memory-corruption-when-loading-bmp-file/#comments Mon, 12 Apr 2010 11:53:01 +0000 SkyLined http://skypher.com/?p=455 From http://support.apple.com/kb/HT4104: CVE-ID: CVE-2010-0536

Impact: Opening a maliciously crafted BMP image may lead to an unexpected application termination or arbitrary code execution

Description: A memory corruption issue exists in the handling of BMP images...]]> From http://support.apple.com/kb/HT4104:
CVE-ID: CVE-2010-0536

Impact: Opening a maliciously crafted BMP image may lead to an unexpected application termination or arbitrary code execution

Description: A memory corruption issue exists in the handling of BMP images. Opening a maliciously crafted BMP image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of BMP images.

More details here:
http://code.google.com/p/skylined/issues/detail?id=11

]]> http://skypher.com/index.php/2010/04/12/apple-quicktime-memory-corruption-when-loading-bmp-file/feed/ 0 Cross browser parallel asynchronous XMLHttpRequests with timeout. http://skypher.com/index.php/2009/09/29/cross-browser-parallel-asynchronous-xmlhttprequests-with-timeout/ http://skypher.com/index.php/2009/09/29/cross-browser-parallel-asynchronous-xmlhttprequests-with-timeout/#comments Tue, 29 Sep 2009 20:50:33 +0000 SkyLined http://skypher.com/?p=232 AsyncXMLHttpRequest is an extension of XMLHttpRequest with the following improvements: Uniform behavior on multiple different browsers (Apple Safari, Google Chrome, Microsoft Internet Explorer, Mozilla Firefox and Opera). Event handlers are called with the AsyncXMLHttpRequest object to which they apply as the first argument...]]> AsyncXMLHttpRequest is an extension of XMLHttpRequest with the following improvements:

  • Uniform behavior on multiple different browsers (Apple Safari, Google Chrome, Microsoft Internet Explorer, Mozilla Firefox and Opera).

  • Event handlers are called with the AsyncXMLHttpRequest object to which they apply as the first argument. This makes it easy to have multiple parallel requests because there is no need to find out for which object an event has fired.

  • A timeout attribute can be set to a number of milliseconds , the request is aborted if it didn’t complete within the given number of milliseconds after calling send().

  • A timedout attribute has been added that is false as long as the request has not been aborted because of a time out and true when it has.

  • Arguments passed to the open() and send() methods are saved in attributes of the object for later reference. These attributes are: method, url, user and password for open() and body for send().

  • Three additional events have been added: onload, onerror and ontimeout. These are called when the readyState has changed to 4 and the request has, respectively, succeeded (no timeout, status == 2xx), failed (no timeout, status != 2xx) or has timed out.

Cross Browser Uniform Behavior
To make AsyncXMLHttpRequest work uniformly across different browsers, it catches and handles some exceptions that are throw in some browsers, but not in others. Specifically, Firefox, MSIE and Opera throw exceptions when calling the open() and send() methods for certain invalid or cross-origin urls. If any of these exceptions are caught and handled, the request will fail similar to other browser by having status == 0 after the readyState has changed to 4.

Parallel Requests
To allow any number of parallel requests to take place and still keep track of which request is in what state, all event handlers are passed the AsyncXMLHttpRequest object to which they apply. In other words, when a certain AsyncXMLHttpRequest object is done (readyState == 4), the onreadystatechange event handler is called with the AsyncXMLHttpRequest object to which it applies as the first argument of the call.

Source
Available through Google code.

Example
This example shows that you can create any number of parallel requests (the browser or OS may have a built in limit) without having to keep track of which object an event is firing for because it is passes as an argument to the event handler:


<HTML>
<BODY onload=”go()”></BODY>
<SCRIPT src=”AsyncXMLHttpRequest.js”></SCRIPT>
<SCRIPT>
function go() {
for (var i = 0; i < 30; i++) {
request(location + “?” + i);
}
}
function request(url) {
span = document.createElement(“DIV”);
document.body.appendChild(span);
span.innerHTML = “<B>” + url + “</B>”;
xmlhttp = new AsyncXMLHttpRequest();
xmlhttp.span = span;
xmlhttp.onload = load;
xmlhttp.onerror = error;
xmlhttp.ontimeout = timeout;
xmlhttp.timeout = 1000;
xmlhttp.onreadystatechange = rs;
xmlhttp.open(“GET”, url);
xmlhttp.send();
}
function rs(xmlhttp) {
xmlhttp.span.innerHTML += ” rs:” + xmlhttp.readyState;
}
function load(xmlhttp) {
xmlhttp.span.innerHTML += ” load:” + xmlhttp.status;
}
function error(xmlhttp) {
xmlhttp.span.innerHTML += ” error:” + xmlhttp.status;
}
function timeout(xmlhttp) {
xmlhttp.span.innerHTML += ” timeout:” + xmlhttp.status;
}
</SCRIPT>
</HTML>
 

]]> http://skypher.com/index.php/2009/09/29/cross-browser-parallel-asynchronous-xmlhttprequests-with-timeout/feed/ 2 Security contacts http://skypher.com/index.php/2008/12/10/security-contacts/ http://skypher.com/index.php/2008/12/10/security-contacts/#comments Wed, 10 Dec 2008 17:52:49 +0000 SkyLined http://skypher.com/?p=78 I’ve created a table with contact information for security teams for mayor software vendors. I’m hoping you’ll find the information useful when you’re trying to report a vulnerability...]]> I’ve created a table with contact information for security teams for mayor software vendors. I’m hoping you’ll find the information useful when you’re trying to report a vulnerability. If you have any more contact information or find an error in the list, let me know.

The list is here:
http://skypher.com/wiki/index.php?title=List_of_security_teams_contact_information

]]> http://skypher.com/index.php/2008/12/10/security-contacts/feed/ 0 Fuzzing Opera browser: how to get rid of the “start-up dialog” after a crash http://skypher.com/index.php/2008/10/23/fuzzing-opera-browser-how-to-get-rid-of-the-start-up-dialog-after-a-crash/ http://skypher.com/index.php/2008/10/23/fuzzing-opera-browser-how-to-get-rid-of-the-start-up-dialog-after-a-crash/#comments Thu, 23 Oct 2008 15:50:19 +0000 SkyLined http://skypher.com/?p=61 If you want to automate running Opera to run fuzzers, you’ll find that once you’ve crashed Opera, it does not start as normal the next time you run it...]]> If you want to automate running Opera to run fuzzers, you’ll find that once you’ve crashed Opera, it does not start as normal the next time you run it. Opera had provided a “start-up dialog” for your convenience that shows up after you’ve crashed it. Also, Opera has a session restore feature that can cause problems when you start Opera using the command-line to open a URL; it will open the pages from the previous session as well. Unfortunately, I was unable to find configuration settings to disabled either one of these features. 

To get around these problems I’ve created a program that will modify the “Opera.ini” file as well as delete the session folder. If you run this program, it will remove all traces of a crash that cause Opera to open the start-up dialog and restore the previous session. After running it, you can start Opera as usual.

On the off chance that you’ve encountered this problem, I’ve made the program available here. The program is called “dirtyOperaHack.cmd”. It is a chimera file; part JavaScript, part batch-file. I’ve also included the individual source files from which it was created for your convenience. You can run “make.cmd” to create ”dirtyOperaHack.cmd” from the individual source files.

UPDATE
Opera 10 seems to have changed the paths for some of these settings. I have an updated version of my “Dirty Opera Hack” script available here.

]]> http://skypher.com/index.php/2008/10/23/fuzzing-opera-browser-how-to-get-rid-of-the-start-up-dialog-after-a-crash/feed/ 0