'Text bomb' is latest Apple bug • Hacker News Board

Re: 'Text bomb' is latest Apple bug

#31

Post by teej » Thu, Jan 18, 2018, 4:56 PM UTC

Someone1234 wrote: post #26

FPGAhacker wrote: post #24

Earlier quoted context omitted.

They do if you file them at radar.apple.com. I've had back and forths with them on some video card performance issues after sleep after filing a report there.

What is that site? I have a working Apple ID and it won't even let me sign in.

Radar is Apple’s internal bug tracking system. Outsiders have limited access to it. I believe bugreport.apple.com is the path for submitting bugs as an external developer.

Re: 'Text bomb' is latest Apple bug

#32

Post by lisper » Thu, Jan 18, 2018, 4:56 PM UTC

lostlogin wrote: post #25

lisper wrote: post #23

Earlier quoted context omitted.

Because Apple once prided itself as a company that made computers that "just worked".

I like how you wrote all that in the past tense.

If the shoe fits... :-(

Re: 'Text bomb' is latest Apple bug

#33

Post by jakobegger » Thu, Jan 18, 2018, 4:56 PM UTC

So a crashing bug in the text rendering framework is now worth an article in major publications?

I stumbled over two or three of them in the last couple of years while debugging crash reports sent in by customers.

Seems that text rendering is hard. Maybe fuzzing CoreText would be a worthwhile target to discover vulnerabilities?

Re: 'Text bomb' is latest Apple bug

#34

Post by Someone1234 » Thu, Jan 18, 2018, 4:59 PM UTC

devit wrote: post #5

Based on a web search, https://bogdanz.me/work/diddu.html might be a working mirror of the proof of concept. It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link. I'd guess it's supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhap…

That site caused Firefox 57 (64bit) to lock up on Windows 10...

It is an i7, 16 GB total (7 GB free), and an SSD.

Re: 'Text bomb' is latest Apple bug

#35

Post by rmrfrmrf » Thu, Jan 18, 2018, 5:01 PM UTC

srphm wrote: post #17

jdlyga wrote: post #2

Sounds like AOL punters. Fate X anyone?

Right? I remember spamming people with h1 tags, then seeing them go offline. Welp, was fun for 5 minutes.

AOL sent my dad an e-mail :(

Re: 'Text bomb' is latest Apple bug

#36

Post by Someone1234 » Thu, Jan 18, 2018, 5:02 PM UTC

jakobegger wrote: post #33

So a crashing bug in the text rendering framework is now worth an article in major publications? I stumbled over two or three of them in the last couple of years while debugging crash reports sent in by customers. Seems that text rendering is hard. Maybe fuzzing CoreText would be a worthwhile target to discover vulnerabilities?

Or take text rendering out of the kernel.

The whole device shouldn't restart due to malformed text, that's just sloppy. If Microsoft can do it with Windows then Apple can do it on iOS.

Re: 'Text bomb' is latest Apple bug

#37

Post by menacingly » Thu, Jan 18, 2018, 5:03 PM UTC

mixmastamyk wrote: post #19

Their lock screen crashing bug from iOS 11 that was fixed with 11.1 came back with 11.2 and I want to throw the thing out the window. Every time I hit the power button it crashes and have to type out the pin.

I still have the issue where if I access the camera from the lock screen it randomly renders my phone unlockable

Re: 'Text bomb' is latest Apple bug

#38

Post by [deleted] » Thu, Jan 18, 2018, 5:05 PM UTC

lisper wrote: post #23

herodotus wrote: post #18

So shipping software has an obscure bug that can cause a crash. Why is this news?

Because Apple once prided itself as a company that made computers that "just worked".

[deleted]

Re: 'Text bomb' is latest Apple bug

#39

Post by 68c12c16 » Thu, Jan 18, 2018, 5:06 PM UTC

NedIsakoff wrote: post #3

Anyone have the clode?

a mirror of the page could be found here...

  view-source:https://web.archive.org/web/20180117063656/https://iabem97.github.io/chaiOS/

google chrome browser seems to have disabled the display of the content but other browsers may still be fine with it...

Re: 'Text bomb' is latest Apple bug

#40

Post by hotpxl » Thu, Jan 18, 2018, 5:08 PM UTC

FPGAhacker wrote: post #24

hotpxl wrote: post #21

- Mr Masri said he "always reports bugs" before releasing them. Well I don't think Apple really reads bug reports.

They do if you file them at radar.apple.com. I've had back and forths with them on some video card performance issues after sleep after filing a report there.

I'll try resubmit my bug here and see how it goes. thanks!