The Register:
Apple last month fixed a flaw in macOS and iOS that allowed a text message to crash its chat software – and now it has the opportunity to do so again.
Various macOS, iOS, and watchOS apps that rely on Apples’s text-rending code can be crashed when sent a message containing a symbol composed of characters used in the Indian language Telugu.
And:
The symbol represents a combination of Telugu letters and signs, specifically the letter “ja,” the sign “virama,” the letter “nya,” a zero-width non-joiner and the vowel sign “aa.”
Trying to open a message with this symbol in iMessage or other apps that rely on Apple’s UIKit framework for text rendering, like Facebook Messenger, Twitter, and WhatsApp, will cause a crash. Don’t what ever you do try to create a filesystem folder using that symbol.
Unless you use Telugu or interact with someone who does, chances are you’ll never encounter this bug. But it is interesting. This came to light when this OpenRadar post appeared.
The original radar was marked as a duplicate, meaning Apple already knew about the problem. And sure enough, there’s already a fix in place in the latest betas:
The scary thing about this kind of bug is that it shows that Apple is not testing its software against random inputs.
I thought fuzz testing was part of recommended best practices because it uncovers exactly this kind of bug?
It’s baffling to me that their unicode handling can crash on some arbitrary symbols, frankly.
I’d love, notionally, to know what the hell kind of code they’re running in UIKit such that A Few Arbitrary Unicode Symbols crash things.
Fuzzing only captures things it happens to fuzz.
There are something like 136,000 Unicode characters in use, and lots more waiting to be defined; it’s trivially easy to not hit the one symbol that for no obvious reason crashes UIKit.
(Fuzzing is great for catching boundary conditions or parser vulnerabilities or the like; making sure noise doesn’t break anything.
“Crashes UIKit on a symbol that is actually valid input” is not the sort of thing fuzzing is really aimed at, though you can get lucky with it.)
(Given that it evidently repros in everything using UIKit, and doesn’t seem limited to e.g. Helvetica Neue, it can’t be the obvious suspect of “that character is corrupted in the system font”.
Unless nobody’s tried that. Though frankly I’d expect UIKit to have better exception handling than that; corrupt font data is a known problem going back as long as the concept of computer typography.)
Cue the “why doesn’t Apple test something so obvious?” comments. Or the “That aged well.” comment at the end of the article. It’s easy to fling turds from the cheap seats.
Bugs are going to happen, especially with 1 billion devices out in the wild. Apple has a testing challenge that makes n-complete problems look like child’s play. And we’re talking devices here, not services. You can’t release to production thousands of times per day.
The best solution is being able to respond to problems when they occur quickly. Ensure that bugs don’t regress. Learn and get better.
The smartest thing Apple did was bypass the carriers and release their software directly to consumers. They can respond far faster than Google can with Android because of the OEM’s and carriers.
It’s only only the “Telugu Letter Ja” It’s actually a combination of that letter and 3 character with one Zero width non-join.
To be exactly precise it’s: “Telugu Letter Ja, Telugu Sign Virama, Telugu Letter Nya, Zero Width non-Joiner and Telugu Vowel Sign Aa” or
Imagine permuting all Unicode characters with all the combinations possible.
<
blockquote>Gℴogle is giving every one $98 per-hour to complete easy work on the laptop .. Do work Some only few hours in a whole day and enjoy more time with your friends .. Any one can also catch this specific job!on Monday I purchased a great new Fiat Multipla just after earnin $18476 this six weeks .it looks the most rewarding however you may no longer forgive yourself if you don’t check this.!wh65p:❣❣❣ http://GoogleJustBusinessIdeas/get/$99/eachhour… ♥♥g♥s♥♥♥l♥♥♥j♥♥♥b♥♥y♥♥♥x♥y♥f♥♥♥q♥c♥♥♥o♥♥♥l♥♥t♥f♥♥♥w♥♥♥o♥♥w♥c♥r♥♥d♥♥♥x♥♥z♥♥♥m♥♥♥t:::::::!qf55p:ednaz