3 ms·

A well made digital font file is a lot more than pictures or even vectors of letters. There's a whole bunch of hinting and even a virtual machine with opcodes f

by 0x0 10y ago

A well made digital font file is a lot more than pictures or even vectors of letters. There's a whole bunch of hinting and even a virtual machine with opcodes for tweaking how letters appear at particular pixel sizes and in combination with surrounding letters. A well made font file really is a compiled software program with built-in assets that someone sat down and developed and debugged, not unlike a full game or an app.

uryga 10y ago
could you point me to some resources about the "virtual machine" you mentioned? sounds very interesting.
- 0x0 10y ago
  Here's a random Google hit: http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.html http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.ht... And another, with an opcode list: https://github.com/janelia-flyem/go/blob/master/freetype-go/freetype/truetype/opcodes.go https://github.com/janelia-flyem/go/blob/master/freetype-go/... And an example font program: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM03/Chap3.html#font_program https://developer.apple.com/fonts/TrueType-Reference-Manual/... Notice the presence of "if" and "call" and "loop". Before super highres retina type displays, properly hinted fonts made all the difference. A naive vector rasterization might bulk up from a 1px to a 2px line width completely inappropriately as font size increases. A properly developed one would ensure pixel perfect rasterization at most font sizes, even in the case of very lowres pixels. The complexity of truetype is a source for many bugs, not least because some operating system interpret the font virtual machine in kernel mode. Also, it looks like the font code for a large amount of systems trace back to a common ancestor. This one is a very good read: https://googleprojectzero.blogspot.no/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.no/2015/07/one-font-vulne... "For example, most TTF engines are based on Microsoft's original implementation of the format, including Windows GDI (win32k.sys), Microsoft GDI+, Microsoft DirectWrite, Adobe Reader and Adobe Flash. Likewise, most OTF engines are based on Adobe's original implementation, including Microsoft GDI (ATMFD.DLL), Microsoft DirectWrite, Microsoft Presentation Foundation and Adobe Reader. As a direct outcome, any bugs present in the original implementation that was later branched and included in multiple products were likely propagated, and may affect various programs or operating systems. This is of course an extremely frightful scenario, with a single 0-day vulnerability (...)"

by 0x0 10y ago

uryga 10y ago

could you point me to some resources about the "virtual machine" you mentioned? sounds very interesting.

0x0 10y ago
Here's a random Google hit: http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.html http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.ht... And another, with an opcode list: https://github.com/janelia-flyem/go/blob/master/freetype-go/freetype/truetype/opcodes.go https://github.com/janelia-flyem/go/blob/master/freetype-go/... And an example font program: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM03/Chap3.html#font_program https://developer.apple.com/fonts/TrueType-Reference-Manual/... Notice the presence of "if" and "call" and "loop". Before super highres retina type displays, properly hinted fonts made all the difference. A naive vector rasterization might bulk up from a 1px to a 2px line width completely inappropriately as font size increases. A properly developed one would ensure pixel perfect rasterization at most font sizes, even in the case of very lowres pixels. The complexity of truetype is a source for many bugs, not least because some operating system interpret the font virtual machine in kernel mode. Also, it looks like the font code for a large amount of systems trace back to a common ancestor. This one is a very good read: https://googleprojectzero.blogspot.no/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.no/2015/07/one-font-vulne... "For example, most TTF engines are based on Microsoft's original implementation of the format, including Windows GDI (win32k.sys), Microsoft GDI+, Microsoft DirectWrite, Adobe Reader and Adobe Flash. Likewise, most OTF engines are based on Adobe's original implementation, including Microsoft GDI (ATMFD.DLL), Microsoft DirectWrite, Microsoft Presentation Foundation and Adobe Reader. As a direct outcome, any bugs present in the original implementation that was later branched and included in multiple products were likely propagated, and may affect various programs or operating systems. This is of course an extremely frightful scenario, with a single 0-day vulnerability (...)"