Live data from Hacker News

iMessage: Malformed Message Bricks iPhone

bugs.chromium.org

11–20 of 279 posts

Re: iMessage: Malformed Message Bricks iPhone

#12
Looks like the "curse of complexity" strikes again... every time I see bugs like this, I wonder if it's because of some code that tries to be a little "too smart" in trying to parse what could be arbitrary data, and forgetting some edge-case.

(If you have JS disabled, you can click "View in Old UI" and then view source to see the content. I find that a bit ironic in the context of this specfic bug...)

Re: iMessage: Malformed Message Bricks iPhone

#14

Wow, you could actually lose the data with this bug. Glad it was fixed in 12.3. I remember the last time something like this happened (4-5 years ago?) it would only crash the phone.

The problem isn’t that the bug itself will cause data loss - it’s that you have no way of using the phone because of the boot loop unless you wipe.

I’m not entirely sure how you’d go about updating the phone without booting into it, but I think it is possible, and that would be one way to avoid losing all your data due to the bug.

Re: iMessage: Malformed Message Bricks iPhone

#15

Looks like the "curse of complexity" strikes again... every time I see bugs like this, I wonder if it's because of some code that tries to be a little "too smart" in trying to parse what could be arbitrary data, and forgetting some edge-case. (If you have JS disabled, you can click "View in Old UI" and then view source to see the content. I find that a bit ironic in the context of this specfic bug...)

Is this an issue of complexity or lack of isolation? More isolation means more complexity, but at the same time, this issue should crash the iMessage app itself, not the whole system. The fact that springboard even knows about iMessage structure is crazy...

Re: iMessage: Malformed Message Bricks iPhone

#17

Wow, you could actually lose the data with this bug. Glad it was fixed in 12.3. I remember the last time something like this happened (4-5 years ago?) it would only crash the phone.

You only lose data if you’re not backing up your phone - it’s not a corruption bug that breaks the ability to restore backups (like one of the iOS iOS 11 developer betas did).

Re: iMessage: Malformed Message Bricks iPhone

#18

Wow, you could actually lose the data with this bug. Glad it was fixed in 12.3. I remember the last time something like this happened (4-5 years ago?) it would only crash the phone.

The problem isn’t that the bug itself will cause data loss - it’s that you have no way of using the phone because of the boot loop unless you wipe. I’m not entirely sure how you’d go about updating the phone without booting into it, but I think it is possible, and that would be one way to avoid losing all your data due to the bug.

One of the comments on the bug has the answer:

For testing purposes, there are three ways that I found to unbrick the device:

1) wipe the device with 'Find my iPhone'

2) put the device in recovery mode and update via iTunes (note that this will force an update to the latest version)

3) remove the SIM card and go out of Wifi range and wipe the device in the menu

Re: iMessage: Malformed Message Bricks iPhone

#19

Since a restore works it cannot be called a brick though?

It's a sliding scale which depends on the user's competence and not just the hardware. To a completely non-technical person, a hard lock-up is "bricked" even if it could be fixed by pressing buttons. To a normal user, a borked ROM is "bricked" even if it could be fixed by plugging into a computer and re-flashing. To a power user, a busted bootloader is "bricked" if it stops them flashing a ROM, even if it could be fixed with a JTAG debugger. To a sufficiently good EE, it's not bricked until the whole thing is physically destroyed.

Re: iMessage: Malformed Message Bricks iPhone

#20

Looks like the "curse of complexity" strikes again... every time I see bugs like this, I wonder if it's because of some code that tries to be a little "too smart" in trying to parse what could be arbitrary data, and forgetting some edge-case. (If you have JS disabled, you can click "View in Old UI" and then view source to see the content. I find that a bit ironic in the context of this specfic bug...)

Is this an issue of complexity or lack of isolation? More isolation means more complexity, but at the same time, this issue should crash the iMessage app itself, not the whole system. The fact that springboard even knows about iMessage structure is crazy...

right? ignoring the issue of invalid assumptions in iMessage taking content from the network (though at least it's objective-c so it's a "DoS" rather than RCE).

The problem here seems to be that the code handling the incoming message is inexplicably running inside springboard rather than a separate process. :-/

Post reply on HN