3 ms·

Font rendering is incredibly complex, perhaps one of the most complex things in computer software. It already required execution of a virtual machine: > TrueT

Font rendering is incredibly complex, perhaps one of the most complex things in computer software. It already required execution of a virtual machine: > TrueType systems include a virtual machine that executes programs inside the font, processing the "hints" of the glyphs, in TrueType called “instructions”. These distort the control points which define the outline, with the intention that the rasterizer produce fewer undesirable features on the glyph. Now it just _also_ requires potential execution of arbitrary WASM code, too.

tadfisher 3y ago
There have been numerous CVEs in various text-rendering engines for just this reason, and that's because TTF was invented before it became common to render arbitrary fonts downloaded from the Internet. A new format with a well-defined WASM interface would be a welcome development; bonus points for a TTF-to-$newFormat conversion tool.
cmyr 3y ago
Hinting might be a red herring here: these font formats are unsafe almost by design, since they consistently rely on a pattern of reading a value out of a chunk of memory and then treating that value as a pointer offset where additional values are read. The proposed WASM shaping implementation would be a replacement for traditional OpenType layout[1] which is already turing complete[2]), and in this sense using WASM is significantly safer than the alternative. Your comment suggests that "execution of arbitrary WASM code" is something that we should be scared of, but the entire point of WASM is that it allows for safe/isolated compilation of arbitrary code. [1] https://simoncozens.github.io/fonts-and-layout/features.html https://simoncozens.github.io/fonts-and-layout/features.html [2] https://litherum.blogspot.com/2019/03/addition-font.html https://litherum.blogspot.com/2019/03/addition-font.html
- slimsag 3y ago
  I did not suggest "execution of arbitrary WASM code" is something that we should be scared of - I stated the facts, and you inferred something I did not write. > The proposed WASM shaping implementation would be a replacement for traditional OpenType layout It's not a proposal AFAIK, it's already implemented today in the harfbuzz codebase. I also do not think it is a 'replacement' for the traditional system, I doubt anyone will disable the ability to render the entire ecosystem of fonts out there which have not been updated to use WASM - so it seems likely it's just another point of complexity added to font rendering in general.

tadfisher 3y ago

There have been numerous CVEs in various text-rendering engines for just this reason, and that's because TTF was invented before it became common to render arbitrary fonts downloaded from the Internet. A new format with a well-defined WASM interface would be a welcome development; bonus points for a TTF-to-$newFormat conversion tool.

cmyr 3y ago

Hinting might be a red herring here: these font formats are unsafe almost by design, since they consistently rely on a pattern of reading a value out of a chunk of memory and then treating that value as a pointer offset where additional values are read. The proposed WASM shaping implementation would be a replacement for traditional OpenType layout[1] which is already turing complete[2]), and in this sense using WASM is significantly safer than the alternative. Your comment suggests that "execution of arbitrary WASM code" is something that we should be scared of, but the entire point of WASM is that it allows for safe/isolated compilation of arbitrary code. [1] https://simoncozens.github.io/fonts-and-layout/features.html https://simoncozens.github.io/fonts-and-layout/features.html [2] https://litherum.blogspot.com/2019/03/addition-font.html https://litherum.blogspot.com/2019/03/addition-font.html

slimsag 3y ago
I did not suggest "execution of arbitrary WASM code" is something that we should be scared of - I stated the facts, and you inferred something I did not write. > The proposed WASM shaping implementation would be a replacement for traditional OpenType layout It's not a proposal AFAIK, it's already implemented today in the harfbuzz codebase. I also do not think it is a 'replacement' for the traditional system, I doubt anyone will disable the ability to render the entire ecosystem of fonts out there which have not been updated to use WASM - so it seems likely it's just another point of complexity added to font rendering in general.