4 ms·

could you point me to some resources about the "virtual machine" you mentioned? sounds very interesting.

by uryga 10y ago

0x0 10y ago
Here's a random Google hit: http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.html http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.ht... And another, with an opcode list: https://github.com/janelia-flyem/go/blob/master/freetype-go/freetype/truetype/opcodes.go https://github.com/janelia-flyem/go/blob/master/freetype-go/... And an example font program: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM03/Chap3.html#font_program https://developer.apple.com/fonts/TrueType-Reference-Manual/... Notice the presence of "if" and "call" and "loop". Before super highres retina type displays, properly hinted fonts made all the difference. A naive vector rasterization might bulk up from a 1px to a 2px line width completely inappropriately as font size increases. A properly developed one would ensure pixel perfect rasterization at most font sizes, even in the case of very lowres pixels. The complexity of truetype is a source for many bugs, not least because some operating system interpret the font virtual machine in kernel mode. Also, it looks like the font code for a large amount of systems trace back to a common ancestor. This one is a very good read: https://googleprojectzero.blogspot.no/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.no/2015/07/one-font-vulne... "For example, most TTF engines are based on Microsoft's original implementation of the format, including Windows GDI (win32k.sys), Microsoft GDI+, Microsoft DirectWrite, Adobe Reader and Adobe Flash. Likewise, most OTF engines are based on Adobe's original implementation, including Microsoft GDI (ATMFD.DLL), Microsoft DirectWrite, Microsoft Presentation Foundation and Adobe Reader. As a direct outcome, any bugs present in the original implementation that was later branched and included in multiple products were likely propagated, and may affect various programs or operating systems. This is of course an extremely frightful scenario, with a single 0-day vulnerability (...)"

could you point me to some resources about the "virtual machine" you mentioned? sounds very interesting.

by uryga 10y ago

could you point me to some resources about the "virtual machine" you mentioned? sounds very interesting.

0x0 10y ago

Here's a random Google hit: http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.html http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.ht... And another, with an opcode list: https://github.com/janelia-flyem/go/blob/master/freetype-go/freetype/truetype/opcodes.go https://github.com/janelia-flyem/go/blob/master/freetype-go/... And an example font program: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM03/Chap3.html#font_program https://developer.apple.com/fonts/TrueType-Reference-Manual/... Notice the presence of "if" and "call" and "loop". Before super highres retina type displays, properly hinted fonts made all the difference. A naive vector rasterization might bulk up from a 1px to a 2px line width completely inappropriately as font size increases. A properly developed one would ensure pixel perfect rasterization at most font sizes, even in the case of very lowres pixels. The complexity of truetype is a source for many bugs, not least because some operating system interpret the font virtual machine in kernel mode. Also, it looks like the font code for a large amount of systems trace back to a common ancestor. This one is a very good read: https://googleprojectzero.blogspot.no/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.no/2015/07/one-font-vulne... "For example, most TTF engines are based on Microsoft's original implementation of the format, including Windows GDI (win32k.sys), Microsoft GDI+, Microsoft DirectWrite, Adobe Reader and Adobe Flash. Likewise, most OTF engines are based on Adobe's original implementation, including Microsoft GDI (ATMFD.DLL), Microsoft DirectWrite, Microsoft Presentation Foundation and Adobe Reader. As a direct outcome, any bugs present in the original implementation that was later branched and included in multiple products were likely propagated, and may affect various programs or operating systems. This is of course an extremely frightful scenario, with a single 0-day vulnerability (...)"