Fl0wer.png.html

http://demoseen.com/windowpane/fl0wer.png.html

by ent • 14 years ago

111 73 14 years ago

ent• 14 years ago

The file seems to be a png with some html tags in it that trick the browser. Seems to work on firefox and conkeror but not on my chromium.

ComputerGuru• 14 years ago

Works in Chrome/Windows.

benguild• 14 years ago

Doesn't work in Safari.

martindale• 14 years ago

Doesn't work on Chromium/Ubuntu.

18.0.1025.151 (Developer Build 130497 Linux) Ubuntu 12.04

sohn2• 14 years ago

Same here.

TazeTSchnitzel4• 14 years ago

1) Restricted Drivers

2) about:flags disable software rendering blacklist

pan69• 14 years ago

Works for me on Chrome 18.0.1025.162/Ubuntu 11.04

Note: Chrome, not Chromium.

hristov• 14 years ago

Works for me. And I have exactly the same version as you. (But I am running Xubuntu if that matters).

18.0.1025.151 (Developer Build 130497 Linux) Ubuntu 12.04

agravier• 14 years ago

For this kind of bug you should specify your graphics module, GLX setup, etc...

zbowling3• 14 years ago

It worked the first time in chrome. Crashed it the second time. Very clever.

The blackhat-spidy-sense in me is getting a tingle. XSS injection if a PNG could used to execute javascript possibly.

daeken2• 14 years ago

This can't be used for XSS or the like, really. The way it works is that the PNG is first interpreted as HTML by the browser (hence the filename) and then it loads itself into an image tag, causing it to be interpreted as a PNG. Once it's loaded into the image tag, the image is drawn to a canvas so that the code -- embedded in the PNG -- can be extracted and executed.

While fun, the only real security concern here is that it's really good at pissing off IDSes.

Edit: I linked my article describing the technique in another comment here if you want to see how horrible it really is. I'm always both proud of and disgusted by myself for this technique.

zbowling3• 14 years ago

I just dug into and can confirm. MIME is returned as text/html and browser reads it as such. still very clever.

It's actually kind of a good test of browser compliance in a sick way.

zbowling3• 14 years ago

It did actually uncover something. A huge leak in chrome for me. While this is running Chrome memory usage just climbs and climbs. http://dl.dropbox.com/u/586869/Screenshots/chrome%20leak.png

jes5199• 14 years ago

Works on Chrome/MacLion

... but I'm not sure what it's doing

daeken2• 14 years ago

Huh, didn't think this would be posted. This is a little demo effect I threw together last week when I was bored. It's built on top of WebGL (the effect itself is really just in a shader), and the reason it looks like a PNG is that it's a self-extracting PNG as described in my article here: http://daeken.com/superpacking-js-demos

NDizzle• 14 years ago

I'm freakin' out, man!

xkcdfanboy• 14 years ago

This crashed my OSX Lion running Chrome, lost all my work and had to reboot. Just tested Firefox too, crashes as well. Safari doesn't load anything, just a bunch of PNG binary text? Might want to work on compatibility ;)

dewiz• 14 years ago

.. same platform but none of the problems you experienced, perhaps you're using some old versions ?

saturn7• 14 years ago

Works, Amazing, I think you accidently just created a way to hypnotize people in a second.

kba• 14 years ago

What is this supposed to do, other than attempt to crash my browser?

swhitt• 14 years ago

Ah! My browser! I lost my thesis :(

icebraining3• 14 years ago

What kind of crappy online editor are you using that doesn't save continuously?

moconnor• 14 years ago

Office Live. You have to click on the save button. I'm not even making this up.

icebraining3• 14 years ago

(Note: I'm not blaming anyone!)

Impressive: Firefox hold fine and rendered it, but after I opened it the second time, all the text in my system (that includes the browser, but also the terminals, Awesome, etc) was FUBAR - even after restarting the X server!

I have no idea what kind of bug leads to only the text being corrupted (so, it doesn't seem a bug in the graphic drivers, since AFAIK they're agnostic to that) but survives restarting the display manager.

gcr• 14 years ago

Hm. Interesting. Using binary graphics drivers (nvidia et al)? Maybe something corrupted memory. Did it survive even a restart?

icebraining3• 14 years ago

I'm using the OSS radeon drivers and no, fortunately it was fine after a reboot :)

Corrupted memory was my first thought, but affecting only text is odd - I mean, the drivers aren't even supposed to know those particular pixels are text, right?

cydonian_monk2• 14 years ago

I've had similar experiences with graphical corruption in X, and Firefox was almost always involved. Same radeon driver as you. And it seems to be distro-agnostic: I've seen it with Arch, Gentoo and Mint. All I know is that it's a recent thing: if I run an older version of my Gentoo build, it doesn't happen. But otherwise I see the same results.

I have no idea what to point to, because it's really weird. Scrambles /everything/ that goes through video. (And until now, I figured it was a quirk of my bizarre hardware. Guess not.)

dfc• 14 years ago

its a bug with cairo and the radeon driver:

https://bugs.freedesktop.org/show_bug.cgi?id=47266

on debian you can pin libcairo to fix the issue. /etc/apt/preferences:

  Package: libcairo2
  Pin:version 1.10.2-7
  Pin-Priority: 1001

  Package: libcairo-gobject2
  Pin:version 1.10.2-7
  Pin-Priority: 1001

cookingrobot• 14 years ago

I tried zooming in and out in Chrome on Windows 7, and it crashed my NVIDIA kernel mode driver.

sohn2• 14 years ago

In Arch / Chromium / Intel card, and after starting Chromium disabling the webgl graphic cards blacklist, it just shuts my monitor down and I have to reboot.

PStamatiou2• 14 years ago

This crashed my mac entirely. avoid.

cjfont• 14 years ago

What browser are you using? Worked fine for me on Chrome.

PStamatiou2• 14 years ago

Chrome 20. browser went full-screen, all white. Couldn't even force quit, had to reboot.

burke• 14 years ago

Same here. Had to reboot.

njharman• 14 years ago

If viewing a web page crashes your OS, seriously, you need to take that crap back and get a refund.

lloeki3• 14 years ago

How do I get a refund on my Arch setup? Seriously, WebGL talks to the driver almost directly. All it takes is a browser/driver bug and the whole display stack goes down, possibly bringing the OS with it.

RKearney2• 14 years ago

OS X 10.7.3 Safari 5.1.5 here and had no problems.

Granted it didn't work... No hangs or crashes though.

gmac• 14 years ago

In Safari you need to enable WebGL from the Develop menu, which is in turn enabled from the Advanced tab of Preferences.

dguaraglia• 14 years ago

It worked OK using latest stable Chrome on OS X 10.6.8

Jimmie• 14 years ago

Same situation, worked perfectly for me.

jlarocco• 14 years ago

Worked great on my mac.

packetslave• 14 years ago

This didn't crash my mac entirely. don't avoid.

mike-cardwell2• 14 years ago

Worked great here using Ubuntu 12.04/Firefox 12 on my Thinkpad T420 with integrated Intel graphics only.

Cushman• 14 years ago

I think we need to start using a [WebGL] tag or something for these... obviously some browsers don't take it well, and it would keep a lid on all the (kinda pointless) "Doesn't work"/"works for me" comments.

Works for me. Super cool.

sigmaxipi• 14 years ago

In some cases, it's even worse. Low end netbooks running Chrome will load the page and then the entire machine locks up as the WebGL starts rendering and takes over the weak GPU. Easy way of DOSing someone is to send them a WebGL link if they're on a weak computer.

pooriaazimi• 14 years ago

Shame. It's not working on Safari 5.2 beta (Lion 10.7.3); nor does it work in Opera, or any of iOS browsers. But is fine on both Chrome and Firefox...

I'm sure Safari supported WebGL...

eridius• 14 years ago

There's an option in the Develop menu to enable WebGL, but even with that on this doesn't work.

Jach• 14 years ago

NoScript is the new subject for "I run Linux, I don't have to worry about..." But after I enabled scripting it worked fine, very neat-looking demo. Also I admit that I enjoy reading about the problems of others here...

simplyinfinity• 14 years ago

Had no effect in Opera 12 alpha with HW acceleration and webgl turned on, just black screen

machrider2• 14 years ago

Not seeing anything (totally white browser) in both Firefox 12 and Chromium 18 on Ubuntu.

TazeTSchnitzel4• 14 years ago

>Ubuntu

There's your problem. Are you using an ATI card, by the way?

Make sure you have restricted drivers installed. If you're using an ATI card you'll have to do the further step of going to about:flags in Chrome and making it ignore the software rendering blacklist.

machrider2• 14 years ago

Actually I'm on a nVidia Quadro card with the Nouveau driver.

gphilip• 14 years ago

Shouldn't there be some kind of seizure warning to go with the link?

zokier2• 14 years ago

I think the comments hilight very nicely why some people are not all that thrilled about having OpenGL in their browsers in the form of WebGL. Graphics drivers seem to be extremely difficult to "get right", especially if any degree of performance is wanted.

willvarfar3• 14 years ago

My considered opinion (from the industry) is that its really shocking how under-invested-in the drivers are.

If a fraction of the effort that went into making the card went into making the drivers and maintaining and fixing them, we'd all be massively better off.

modeless2• 14 years ago

The problem may be too much investment in drivers. Modern graphics card drivers are little operating systems unto themselves; they even have built-in compilers. They are incredibly complex, yet written in unsafe languages for maximum performance, with tons of ugly hacks for compatibility.

What we really need is a simplification of graphics APIs so that graphics drivers don't need to be so complex. That may be impossible without convergence in hardware though.

zokier2• 14 years ago

I don't know if drivers are really under-invested. I did couple of quick searches at nVidia site (as an example) and got the following results:

    Keyword   Job openings
    driver    176
    software  387
    hardware  218
    asic      117

The keywords were picked arbitarily, and are probably not very representative, but it seems like at least nVidia is actually investing in driver/software developement.

mike-cardwell2• 14 years ago

FYI, NoScript has a "Forbid WebGL" option which lets you selectively allow it in the same way it does with Flash, Java and SilverLight.

unicornporn• 14 years ago

Crashed Firefox 12 on OS X. Crashed latest Opera Mobile on Android ICS.

wordsaretoys• 14 years ago

If you're having WebGL/video driver issues and you'd like to assist the developers in fixing them, here's a link to a crowdsourced driver test at Khronos: http://www.khronos.org/webgl/wiki/CrowdsourcingDriverTesting

TazeTSchnitzel4• 14 years ago

Goes well with trance music. Keep forgetting it's not in the demo.

DiabloD3• 14 years ago

All I see is the text "‰PNG IHDR[$‘þVœjawh". MIME type screw up server side?

Fl0wer.png.html

Related Stories