Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Text bomb' is latest Apple bug

bbc.com

Post reply on HN
Print view View original

91–100 of 113 posts

Re: 'Text bomb' is latest Apple bug

#91

Post by skymt »

kevin_thibedeau wrote: post #66
dspillett wrote: post #44

Earlier quoted context omitted.

> but never on any other platforms There have been numerous crash-bugs for the Windows font renderer, and even security exploits using it (especially before windows 10, as earlier than that font rendering was performed in the kernel's space rather than user-land). I wouldn't be surprised to learn of issues (at least of the falling over variety) in common Linux rendering engines and for other OSs too.

The Windows bugs are usually tied into executing TTF hint bytecode which is ignored by Freetype.

FreeType used to ignore TrueType hint bytecode to avoid infringing on related patents, but those patents expired in 2010 and FreeType's interpreter is now enabled by default.

http://freetype.sourceforge.net/patents.html

Re: 'Text bomb' is latest Apple bug

#92

Post by danso »

amiga-workbench wrote: post #88
madeofpalk wrote: post #70

Earlier quoted context omitted.

How do you update software without updating it? I'm literally at a loss with how you would like them to resolve it if you don't want to install updates.

I assume he means backporting bugfixes to previous major releases.

Yeah I still haven't updated one of my iOS devices because quite a few good apps haven't been updated to be compatible with iOS 11

Re: 'Text bomb' is latest Apple bug

#93

Post by danso »

Bitcoin_McPonzi wrote: post #56
jakobegger wrote: post #33

So a crashing bug in the text rendering framework is now worth an article in major publications? I stumbled over two or three of them in the last couple of years while debugging crash reports sent in by customers. Seems that text rendering is hard. Maybe fuzzing CoreText would be a worthwhile target to discover vulnerabilities?

I'm not sure either Y Combinator News nor the linked site are "major publications". It is news, because there's a _completely passive_ way to crash a device, and crashes nearly always will allow for unauthorized code execution, given enough resources to work on the problem. You could launch a DOS attack on phones this way, and we all know that Cell Phones are how we're warned about emergencies, etc. For what it's wor…

The BBC is the largest broadcaster in the world.

Re: 'Text bomb' is latest Apple bug

#94

Post by 0x0 »

blackflame7000 wrote: post #77
AgentME wrote: post #64

Earlier quoted context omitted.

The bug causing this crash might be exploitable. Think of a classic buffer overflow: if you overflow a buffer with all zeroes or random data, then the return address most likely gets overwritten with garbage that doesn't point to valid code or a mapped address and the process crashes. But if the attacker specially chose the data they put in the buffer, then they could choose to overwrite the return address with a val…

The text-segment of the code containing the machine instructions is in read-only memory. You won't be able to overflow a heap variable with the intention of writing to the text-segment of memory without causing a segfault.

But with ROP, there's usually no need to write into the text-segment to execute arbitrary code.

Re: 'Text bomb' is latest Apple bug

#96

Post by rspeer »

yesenadam wrote: post #80
boombip wrote: post #74

Earlier quoted context omitted.

I find it unexpectedly hilarious that we now have issues that cannot be fully described without running the risk of crashing our machines. Its as if there are certain unholy words that could cause us to faint if we were to utter them.

Sounds right out of Gödel, Escher, Bach : Achilles : I see the dilemma now. If any record player—say Record Player X—is sufficiently high-fidelity, then when it attempts to play the song "I Cannot Be Played on Record Player X", it will create just those vibrations which cause it to break...So it fails to be Perfect. And yet, the only way to get around that trickery, namely for Record Player X to be of lower fidelity,…

Similarly (and also featured in a Hofstadter book), there's the short story "The Riddle of the Universe and Its Solution" by Christopher Cherniak. https://en.wikipedia.org/wiki/The_Riddle_of_the_Universe_and...

I don't think anyone ever intended for text rendering to be a "sufficiently powerful formal system" like second-order logic, number theory, or like Hofstadter says the human brain is. I would hope that, in the absence of bugs, rendering text X on computer system Y would be a plain old computable function.

Re: 'Text bomb' is latest Apple bug

#97

Post by rspeer »

68c12c16 wrote: post #46
68c12c16 wrote: post #39

Earlier quoted context omitted.

a mirror of the page could be found here... view-source:https://web.archive.org/web/20180117063656/https://iabem97.github.io/chaiOS/ google chrome browser seems to have disabled the display of the content but other browsers may still be fine with it...

if viewed in a hex editor, this same block of patterns repeated over and over again...seemingly to be an effort to overrun the buffer.... 0x00007B90: A5CCBACD 8774CCB4 CD81CC8D CC92CD8C .....t.......... 0x00007BA0: CD84CC86 CC8FCD8B CD97CD86 CC9BCC8F ................ 0x00007BB0: CC8ECC95 CC87CC82 CC94CC9B CC92CC92 ................ 0x00007BC0: CC86CD91 CD9BCC86 CC8ECCBD CC84CC8B ................ 0x00007BD0: CC91CC88 C…

The pattern of bytes above 0x7F isn't anything to do with x86 architecture. It's UTF-8, the most common way to encode Unicode in bytes.

You'll have more success understanding what it's doing if you decode it from UTF-8 first.

Re: 'Text bomb' is latest Apple bug

#98

Post by ClassyJacket »

madeofpalk wrote: post #70
gondo wrote: post #53

Earlier quoted context omitted.

and yet again they don't care about older iOS versions for people who don't want to brick their phones with updates

How do you update software without updating it? I'm literally at a loss with how you would like them to resolve it if you don't want to install updates.

I think what they're getting at it, release an iOS 10.3.4 or whatever so that people who don't want iOS 11 can still avoid this bug. They did this once before, around iOS 6 I believe, when the security certificate for Facetime ran out.

And it's understandable. iOS 11 made my iPhone 7 - the newest one at the time - so unusable I sold it and got a different phone. It went from a good, snappy phone, to a slow mess that took seconds more to open or switch apps, crashed all the time, had UI glitches all over the place, and was so slow it couldn't play locally downloaded audio without stuttering and slowing down. Ew.

Re: 'Text bomb' is latest Apple bug

#99

Post by rspeer »

rspeer wrote: post #55

Anyone got any information on how the text rendering bug actually works (not just hand-waving it away as "oh it's UTF-8")? I can see that the file alternates between segments of: - Repetitions of the glyph "t̴́̍̒", which is a lowercase t with a combining tilde overlay, an acute accent, a vertical line above, and a turned comma above - Random-looking ASCII characters with lots of apostrophes (spelled as ' in the H…

Okay, I have at least a guess about the type of thing that's going on, after seeing what it did to Firefox (which it at least didn't crash).

Various GUI elements such as title bars, tooltips, and thumbnails of links to Web pages, will try to fit the text they're given in a certain amount of space. If the text is too wide, it'll show some amount of text followed by "...". (I wonder if they're prepared for the text to be too tall.)

I saw Firefox rendering the long sequence of t̴́̍̒ characters in the mailto: link. It was being kerned in a way that made it nearly a solid black smear of pixels.

My guess is that apps are trying to determine how much of this text to show to fit within a certain width (and height?), and this text messes with a kerning algorithm in a way that makes it computationally very difficult to decide. I still don't know what's going on with the rest of the text, and why it can read 20 MB of text without making a final decision.

Post reply on HN