Tweet crashes Mac Twitter client

Tweet crashes Mac Twitter client(jwz.org)

93 points by kikibobo69 13 years ago | 57 comments

mmastrac 13 years ago |

The offending tweet content:

      ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ

Edit: I've narrowed it down to the following byte sequence. I can't seem to remove any of the characters without it no longer crashing:

    00000000  d9 88 d2 88 cd a5 cd a8  cd aa cd af 20 d2 88 d2  |............ ...|
    00000010  88 d2 88                                          |...|
    00000013

Hixie's unicode decoder says this is:

    U+0648 ARABIC LETTER WAW character (&#x0648;)
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)
    U+0365 COMBINING LATIN SMALL LETTER I character (&#x0365;)
    U+0368 COMBINING LATIN SMALL LETTER C character (&#x0368;)
    U+036A COMBINING LATIN SMALL LETTER H character (&#x036A;)
    U+036F COMBINING LATIN SMALL LETTER X character (&#x036F;)
    U+0020 SPACE character
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)
    U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#x0488;)

spdy 13 years ago | |

Interesting on chrome Version 24.0.1312.57 the tab crashes when i try to view the tweet but not here.

Can someone explain what is happening and why the tweet is affecting the tab and this post does not?

In the end both just render unicode characters. And it looks like only Firefox is able to display it correctly on OSX 10.8.

DouweM 13 years ago | | |

Chrome uses OS X's CoreText for rendering the tab titles, but uses its own text rendering engine for the site body. CoreText is the one that crashes on that unicode.

spydum 13 years ago | |

Wow that renders all sorts of glitchy on iPad/safari

a_p 13 years ago |

This is the tweet in html character entity form:

  &#1607;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#875;&#876;&#873;&#878;&#872;&#874;&#879;&#869;&#869;&#875;&#874;&#871;&#867;&#879;&#874;&#872;&#867;&#869;&#876;&#874;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#874;&#869;&#872;&#874;&#875;&#876;&#877;&#878;&#879;&#869;&#868;&#867;&#869;&#872;&#874;&#871;&#867;&#879;&#876;&#874;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#1160;&#874;&#872;&#874;&#875;&#876;&#873;&#878;&#879;&#869;&#872;&#867;&#869;&#875;&#874;&#871;&#867;&#879;&#869;&#876;&#874;

Groxx 13 years ago | |

Would you mind indenting that two spaces so it shows up

  like this

rather than breaking the page layout?

bsg75 13 years ago |

And unfollowing only solves the problem until someone in your stream retweets it.

So I retweeted it.

eksith 13 years ago |

Rendering any typeable character(s) should never crash any engine... ever. That said, unicode seems to be the last frontier for the non-viral spread of glitches.

I'm somewhat reminded of this : http://stackoverflow.com/a/1732454

signed0 13 years ago |

It also crashes Chrome's current tab on OSX: http://imgur.com/vRn6Qid

_delirium 13 years ago | |

Weird, not for me. No crash with Chrome 24.0.1312.57 on OSX 10.6.8.

signed0 13 years ago | | |

I'm using 24.0.1312.57 on OSX 10.8.2. Perhaps it is a Lion/Mountain Lion thing.

Rayne 13 years ago | | |

Not for me either with the same version. It doesn't even render, but it doesn't crash.

shurcooL 13 years ago | |

It does for me too. But not the neighbour tabs. Also 24.0.1312.57 on OS X 10.8.2.

duskwuff 13 years ago |

For at least one application, the crash is in:

    0   libvDSP.dylib                 	? + 117458
    1   com.apple.CoreText            	TRun::TRun(TRun const&, CFRange, TRun::SubrangingStyle) + 850
    2   com.apple.CoreText            	CTGlyphRun::CloneRange(CTRun const*, CFRange, TRun::SubrangingStyle) + 142
    3   com.apple.CoreText            	TLine::SetLevelRange(CFRange, unsigned char, bool) + 162
    4   com.apple.CoreText            	TLine::SetTrailingWhitespaceLevel(unsigned char) + 70
    5   com.apple.CoreText            	TRunReorder::ReorderRuns(TBidiLevelsProvider const&, TLine&) + 122
    6   com.apple.CoreText            	TTypesetter::FinishLineFill(TLine&, double, double) const + 142
    7   com.apple.CoreText            	CTTypesetterCreateLine + 131

I'm not familar enough with CoreText internals to guess what's going wrong, though. :)

ihsw 13 years ago |

Is it simply zalgo text? http://eeemo.net/

niggler 13 years ago |

Is this a mountain lion issue or does this affect lion and SL as well?

_delirium 13 years ago | |

Not seeing any crashes on 10.6.x ("Snow Lion") here.

Zirro 13 years ago | | |

It's "Snow Leopard". Apple isn't running low enough on cats to have to resort to mythological ones just yet ;-)

general_failure 13 years ago |

Does anyone else see something funky at the top most comments?

emiliobumachar 13 years ago | |

I do. Some justaposition of random chars. I'm on an iPad, what's your machine?

kawsper 13 years ago | | |

I see it on my Macbook in Chrome running on Mountain Lion.

dade_ 13 years ago | |

Yes, looks like this: http://s20.postimage.org/6athqkm3h/image.jpg

Interesting bug.

zmarn 13 years ago |

Ok, I narrowed down what kills Chrome.

minimalist example:

  data:text/html;charset=utf-8,<p style='font-family: "Times New Roman";'>%D9%88%20%D2%88%D2%88%D2%88

It seems to be a problem with utf-8 vs. unicode + Times New Roman.

tested on: Chrome 24.0.1312.57 | OS x 10.8.2

Edit: also works with other fonts for example Arial

alpb 13 years ago |

Crashes Chrome on Mac (only the tab, not the whole process). Of course retweeted it!

lukeman 13 years ago |

I'm sure they'll have a bugfix release out soon to fix this.

Nah, just kidding.

ExtraJ 13 years ago |

Retweeted, of course.

zmarn 13 years ago |

Really interesting, played around with it locally and it just kill two random neighboring tabs, while not effecting others.

Chrome 24.0.1312.57 | OS x 10.8.2

renanbirck 13 years ago |

No crash on either Chrome or Firefox on Arch Linux.

webbruce 13 years ago |

Yeah my twitter client is crashing now when I switch to another account that's already logged in.

ihuman 13 years ago |

This twitter account and tweet displays fine on TweetBot for iOS, but causes lag when scrolling.

itistoday2 13 years ago |

How do you type this on a Mac?

myhf 13 years ago | |

You could turn on "Unicode Hex Input" in System Preferences > Language & Text > Input Sources and type in the unicode characters one at a time.

cleverjake 13 years ago |

This is crashing nightly webkit as well, so it is likely an issue there.

zemanel 13 years ago |

Crashing for me too .. can't open Twitter.app ...

OS X 10.8.2 (12C60)

Void_ 13 years ago |

It also crashes Sublime Edit when pasted.

younata 13 years ago |

firefox 18.0.2 on osx seems to survive...

shardling 13 years ago | |

Though it does do unholy things to the tab/window title... :)

sebastianavina 13 years ago |

correct me if i'm wrong, but somebody is working right now to use this bug in some piece of malicious code...

keikun17 13 years ago |

Aaaand i locked myself out of twitter.

Systemic33 13 years ago |

No crash on Chromium with Arch Linux

eridius 13 years ago |

Doesn't crash Tweetbot or Safari.

cicloid 13 years ago |

Also crashes Tweetbot on the Mac

objclxt 13 years ago | |

If it's a CoreText bug, which is sounds like it is, it's going to impact any iOS or OS X app that uses Core Text for rendering. That's pretty much everyone.

eunice 13 years ago |

Doesn't crash Safari on 10.8.2

youngerdryas 13 years ago |

<p class="js-tweet-text tweet-text ">ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ</p>

Cool.

Edit: Apparently it is only the unicode

>ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ>ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ>ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ

How is this possible?

dade_ 13 years ago | |

Your post corrupts the rendering of this page on my iPad (4 iOS 6).

http://s20.postimage.org/6athqkm3h/image.jpg

youngerdryas 13 years ago | | |

I know I see the same on Windows and OSX. Apparently it has something to do with Unicode scripts.

http://en.wikipedia.org/wiki/Script_(Unicode)

Edit: It is slightly different looking on Win7.

camus 13 years ago |

should it be considered as a new form of attack ? utf attack , or utf malware ( that's a question ).

ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ

U+0648 ARABIC LETTER WAW character (و) U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (҈) U+0365 COMBINING LATIN SMALL LETTER I character (ͥ) U+0368 COMBINING LATIN SMALL LETTER C character (ͨ) U+036A COMBINING LATIN SMALL LETTER H character (ͪ) U+036F COMBINING LATIN SMALL LETTER X character (ͯ) U+0020 SPACE character U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (҈) U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (҈) U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (҈)

ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ

0 libvDSP.dylib ? + 117458 1 com.apple.CoreText TRun::TRun(TRun const&, CFRange, TRun::SubrangingStyle) + 850 2 com.apple.CoreText CTGlyphRun::CloneRange(CTRun const*, CFRange, TRun::SubrangingStyle) + 142 3 com.apple.CoreText TLine::SetLevelRange(CFRange, unsigned char, bool) + 162 4 com.apple.CoreText TLine::SetTrailingWhitespaceLevel(unsigned char) + 70 5 com.apple.CoreText TRunReorder::ReorderRuns(TBidiLevelsProvider const&, TLine&) + 122 6 com.apple.CoreText TTypesetter::FinishLineFill(TLine&, double, double) const + 142 7 com.apple.CoreText CTTypesetterCreateLine + 131