Proving the Turing Completeness of Fonts
litherum.blogspot.com
Proving the Turing Completeness of Fonts
1–10 of 15 posts
Re: Proving the Turing Completeness of Fonts
#2Can you use this to bypass Spectre mitigations in Javascript? You would need to measure time, somehow.
Re: Proving the Turing Completeness of Fonts
#3Fonts aren't really something I've dived into.
Could someone explain at what level this is happening. What classes of software/libraries are affected?
Re: Proving the Turing Completeness of Fonts
#4Can you use this to bypass Spectre mitigations in Javascript? You would need to measure time, somehow.
It's not arbitrary code execution, just a toy observation about the specification. Additionally, 1) as noted, none of the font rendering libraries used were capable of recursion without the author's modifications, 2) in a web context, Javascript is unable to access information about actual glyphs rendered or other "font-internal" calculations.
If anything, exposing glyph data to the web API would be a bigger problem for fingerprinting, and probably expose some sort of user browsing history snooping flaw...
Re: Proving the Turing Completeness of Fonts
#5Can you use this to bypass Spectre mitigations in Javascript? You would need to measure time, somehow.
It's not arbitrary code execution, just a toy observation about the specification. Additionally, 1) as noted, none of the font rendering libraries used were capable of recursion without the author's modifications, 2) in a web context, Javascript is unable to access information about actual glyphs rendered or other "font-internal" calculations. If anything, exposing glyph data to the web API would be a bigger problem…
> Javascript is unable to access information about actual glyphs rendered or other "font-internal" calculations.
Just render the text to a canvas and read out the pixel data to see the glyphs, a.k.a. canvas fingerprinting. I'm not sure whether getting clever with the font would reveal any information you can't get more easily, though.
Re: Proving the Turing Completeness of Fonts
#6Fonts aren't really something I've dived into. Could someone explain at what level this is happening. What classes of software/libraries are affected?
GSUB handling is done by a library called a text shaper. Examples of libraries that do shaping include the cross-platform HarfBuzz, Windows DirectWrite, and macOS Core Graphics/Core Text.
Re: Proving the Turing Completeness of Fonts
#7>But even in HarfBuzz and CoreText, there are hard limits on the recursion depth. HarfBuzz sets its limit to 6. Therefore, the above example will only work on strings of length 7 or fewer. HarfBuzz is open source, though, so I simply used a custom build of HarfBuzz which bumps up this limit to 4 billion. This let me recurse to my heart’s content. A limit of 6 is probably a good thing; I don’t think users generally expect their text engines to be running arbitrary computation during layout.
Truly, Zalgo waits just beyond the wall.
Re: Proving the Turing Completeness of Fonts
#8Seems like lambda calculus would have been a more natural thing to implement since it’s basically just symbol substitution.
Re: Proving the Turing Completeness of Fonts
#9Any font is turning complete if you use it in powerpoint
Re: Proving the Turing Completeness of Fonts
#10>But even in HarfBuzz and CoreText, there are hard limits on the recursion depth. HarfBuzz sets its limit to 6. Therefore, the above example will only work on strings of length 7 or fewer. HarfBuzz is open source, though, so I simply used a custom build of HarfBuzz which bumps up this limit to 4 billion. This let me recurse to my heart’s content. A limit of 6 is probably a good thing; I don’t think users generally ex…
What we need is a Regex parser written in this language, and I can finally start on my HTML renderer font.