Tweet crashes Mac Twitter client(jwz.org)

93 pointsby kikibobo69vor 13 Jahren57 comments

http://www.jwz.org/blog/2013/02/you-doom-us-all-to-inhuman-toil-for-the-one-whose-name-cannot-be-expressed-in-one-hundred-forty-characters/

31 comments

mmastracvor 13 Jahren

The offending tweet content:

      ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ

Edit: I've narrowed it down to the following byte sequence. I can't seem to remove any of the characters without it no longer crashing:

    00000000  d9 88 d2 88 cd a5 cd a8  cd aa cd af 20 d2 88 d2  |............ ...|
    00000010  88 d2 88                                          |...|
    00000013

Hixie's unicode decoder says this is:

    U+0648 ARABIC LETTER WAW character (&#x0648;)
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)
    U+0365 COMBINING LATIN SMALL LETTER I character (&#x0365;)
    U+0368 COMBINING LATIN SMALL LETTER C character (&#x0368;)
    U+036A COMBINING LATIN SMALL LETTER H character (&#x036A;)
    U+036F COMBINING LATIN SMALL LETTER X character (&#x036F;)
    U+0020 SPACE character
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)

spdyvor 13 Jahren

Interesting on chrome Version 24.0.1312.57 the tab crashes when i try to view the tweet but not here.

Can someone explain what is happening and why the tweet is affecting the tab and this post does not?

In the end both just render unicode characters. And it looks like only Firefox is able to display it correctly on OSX 10.8.

DouweMvor 13 Jahren

Chrome uses OS X's CoreText for rendering the tab titles, but uses its own text rendering engine for the site body. CoreText is the one that crashes on that unicode.

nievevor 13 Jahren

Meanwhile on Chromium 26.0.1384.0 (build 176849) on OS X Lion everything is fine for me. The titlebar is (appropriately for the typography) messed up, but there are no tab loading issues, cpu/memory spikes, or screen corruption. The closest thing to an issue I see is that it makes using Witch's window switch dialogue a bit ugly. Contrary to the thread on jwz's journal YoruFukurou 2.77 doesn't crash or misbehave for me viewing that tweet, but behind the scenes fontd uses up a decent chunk of cpu for several seconds. Perhaps Mountain Lion has more severe bugs in CoreText?

[deleted]vor 13 Jahren

NelsonMinarvor 13 Jahren

And apparently Twitter puts the content of a tweet in the <title> tag if you are on the page for a single tweet. Surprised that doesn't cause more problems.

lutuspvor 13 Jahren

> And apparently Twitter puts the content of a tweet in the <title> tag if you are on the page for a single tweet.

Nope, Twitter uses a shortened, ellipsized version of the tweet as <title> ... </title>. Still, if there's Unicode in the shortened version, it might have the same outcome.

zmarnvor 13 Jahren

After reducing the html-code in the site, it seems to me that it is not the title that causes the crash, but the p-tag with the specific css-style applied.

spydumvor 13 Jahren

Wow that renders all sorts of glitchy on iPad/safari

a_pvor 13 Jahren

This is the tweet in html character entity form:

  &#1607;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#875;&#876;&#873;&#878;&#872;&#874;&#879;&#869;&#869;&#875;&#874;&#871;&#867;&#879;&#874;&#872;&#867;&#869;&#876;&#874;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#874;&#869;&#872;&#874;&#875;&#876;&#877;&#878;&#879;&#869;&#868;&#867;&#869;&#872;&#874;&#871;&#867;&#879;&#876;&#874;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#874;&#872;&#874;&#875;&#876;&#873;&#878;&#879;&#869;&#872;&#867;&#869;&#875;&#874;&#871;&#867;&#879;&#869;&#876;&#874;

Groxxvor 13 Jahren

Would you mind indenting that two spaces so it shows up

  like this

rather than breaking the page layout?

bsg75vor 13 Jahren

And unfollowing only solves the problem until someone in your stream retweets it.

So I retweeted it.

eksithvor 13 Jahren

Rendering any typeable character(s) should never crash any engine... ever. That said, unicode seems to be the last frontier for the non-viral spread of glitches.

I'm somewhat reminded of this : http://stackoverflow.com/a/1732454

signed0vor 13 Jahren

It also crashes Chrome's current tab on OSX: http://imgur.com/vRn6Qid

_deliriumvor 13 Jahren

Weird, not for me. No crash with Chrome 24.0.1312.57 on OSX 10.6.8.

signed0vor 13 Jahren

I'm using 24.0.1312.57 on OSX 10.8.2. Perhaps it is a Lion/Mountain Lion thing.

Raynevor 13 Jahren

I'm using Mountain Lion as well, and no crashes.

csmattrydervor 13 Jahren

Windows 7 - Google Chrome 24.0.1312.57m

It's a little laggy, but it's rendering okay. Might be an OSX-localised issue.

mitchtyvor 13 Jahren

Maybe depends upon language settings?

Raynevor 13 Jahren

Not for me either with the same version. It doesn't even render, but it doesn't crash.

shurcooLvor 13 Jahren

It does for me too. But not the neighbour tabs. Also 24.0.1312.57 on OS X 10.8.2.

duskwuffvor 13 Jahren

For at least one application, the crash is in:

    0   libvDSP.dylib                 	? + 117458
    1   com.apple.CoreText            	TRun::TRun(TRun const&, CFRange, TRun::SubrangingStyle) + 850
    2   com.apple.CoreText            	CTGlyphRun::CloneRange(CTRun const*, CFRange, TRun::SubrangingStyle) + 142
    3   com.apple.CoreText            	TLine::SetLevelRange(CFRange, unsigned char, bool) + 162
    4   com.apple.CoreText            	TLine::SetTrailingWhitespaceLevel(unsigned char) + 70
    5   com.apple.CoreText            	TRunReorder::ReorderRuns(TBidiLevelsProvider const&, TLine&) + 122
    6   com.apple.CoreText            	TTypesetter::FinishLineFill(TLine&, double, double) const + 142
    7   com.apple.CoreText            	CTTypesetterCreateLine + 131

I'm not familar enough with CoreText internals to guess what's going wrong, though. :)

ihswvor 13 Jahren

Is it simply zalgo text? http://eeemo.net/

nigglervor 13 Jahren

Is this a mountain lion issue or does this affect lion and SL as well?

_deliriumvor 13 Jahren

Not seeing any crashes on 10.6.x ("Snow Lion") here.

Zirrovor 13 Jahren

It's "Snow Leopard". Apple isn't running low enough on cats to have to resort to mythological ones just yet ;-)

_deliriumvor 13 Jahren

Hah, you are of course correct. I can never keep the order of OSX cats straight, so I had to look up which one 10.6.x was. But then I typed it out wrong even after doing so!

nigglervor 13 Jahren

Unfortunately SL,L,ML doesn't suffice because Leopard (10.5) is also L :/

Though it should be noted that there is no other version that starts with 'S' ...

general_failurevor 13 Jahren

Does anyone else see something funky at the top most comments?

emiliobumacharvor 13 Jahren

I do. Some justaposition of random chars. I'm on an iPad, what's your machine?

kawspervor 13 Jahren

I see it on my Macbook in Chrome running on Mountain Lion.

dade_vor 13 Jahren

Yes, looks like this: http://s20.postimage.org/6athqkm3h/image.jpg

Interesting bug.

zmarnvor 13 Jahren

Ok, I narrowed down what kills Chrome.

minimalist example:

  data:text/html;charset=utf-8,<p style='font-family: "Times New Roman";'>%D9%88%20%D2%88%D2%88%D2%88

It seems to be a problem with utf-8 vs. unicode + Times New Roman.

tested on: Chrome 24.0.1312.57 | OS x 10.8.2

Edit: also works with other fonts for example Arial

alpbvor 13 Jahren

Crashes Chrome on Mac (only the tab, not the whole process). Of course retweeted it!

lukemanvor 13 Jahren

I'm sure they'll have a bugfix release out soon to fix this.

Nah, just kidding.

ExtraJvor 13 Jahren

Retweeted, of course.

zmarnvor 13 Jahren

Really interesting, played around with it locally and it just kill two random neighboring tabs, while not effecting others.

Chrome 24.0.1312.57 | OS x 10.8.2

renanbirckvor 13 Jahren

No crash on either Chrome or Firefox on Arch Linux.

webbrucevor 13 Jahren

Yeah my twitter client is crashing now when I switch to another account that's already logged in.

ihumanvor 13 Jahren

This twitter account and tweet displays fine on TweetBot for iOS, but causes lag when scrolling.

itistoday2vor 13 Jahren

How do you type this on a Mac?

myhfvor 13 Jahren

You could turn on "Unicode Hex Input" in System Preferences > Language & Text > Input Sources and type in the unicode characters one at a time.

cleverjakevor 13 Jahren

This is crashing nightly webkit as well, so it is likely an issue there.

zemanelvor 13 Jahren

Crashing for me too .. can't open Twitter.app ...

OS X 10.8.2 (12C60)

Void_vor 13 Jahren

It also crashes Sublime Edit when pasted.

younatavor 13 Jahren

firefox 18.0.2 on osx seems to survive...

shardlingvor 13 Jahren

Though it does do unholy things to the tab/window title... :)

sebastianavinavor 13 Jahren

correct me if i'm wrong, but somebody is working right now to use this bug in some piece of malicious code...

keikun17vor 13 Jahren

Aaaand i locked myself out of twitter.

Systemic33vor 13 Jahren

No crash on Chromium with Arch Linux

eridiusvor 13 Jahren

Doesn't crash Tweetbot or Safari.

cicloidvor 13 Jahren

Also crashes Tweetbot on the Mac

objclxtvor 13 Jahren

If it's a CoreText bug, which is sounds like it is, it's going to impact any iOS or OS X app that uses Core Text for rendering. That's pretty much everyone.

eunicevor 13 Jahren

Doesn't crash Safari on 10.8.2

[deleted]vor 13 Jahren

youngerdryasvor 13 Jahren

<p class="js-tweet-text tweet-text ">ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ</p>

Cool.

.

.

Edit: Apparently it is only the unicode

>ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ>ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ>ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ

.

.

.

How is this possible?

dade_vor 13 Jahren

Your post corrupts the rendering of this page on my iPad (4 iOS 6).

http://s20.postimage.org/6athqkm3h/image.jpg

youngerdryasvor 13 Jahren

I know I see the same on Windows and OSX. Apparently it has something to do with Unicode scripts.

http://en.wikipedia.org/wiki/Script_(Unicode)

Edit: It is slightly different looking on Win7.

[deleted]vor 13 Jahren

camusvor 13 Jahren

should it be considered as a new form of attack ? utf attack , or utf malware ( that's a question ).