Hacker News new | ask | show | jobs
by asveikau 21 days ago
Coming late to this thread, but this is reminding me that many remote execution vulnerabilities have come from font rendering code paths.

If there is a turing complete VM inside the font renderer that makes perfect sense.

I'm not sure if it's the case but at one point on Windows, font rendering happened in the kernel.
2 comments
WorldMaker 21 days ago
More than one Turing Complete VM inside the font renderer stack, at that. One of the biggest recurring CVE generators in both Windows and Macintosh was 1984's legacy of the Adobe Type 1 font format [1]. Everyone had to license it for backward compatibility with PostScript documents. It shared enough Turing completeness with PostScript despite being a subset.

Both Windows and Macintosh spent years trying to isolate type rendering from kernel operations specifically because of Adobe Type 1's legacy alone, including the fact that it was an ugly vendored 3rd party spaghetti. IIRC, both Apple and Microsoft ended up paying Adobe tons of money to rewrite their Type 1 Font Manager code from scratch rather than keep paying Adobe to write that code. (TTF and OpenType were also both somewhat direct responses to Type 1's legacy and mistakes.)

[1] https://en.wikipedia.org/wiki/PostScript_fonts

link
butvacuum 21 days ago
Microsoft began the push to move TTF rendering out of the kernel in Vista. I'm sure there are still bits here-and-there that are still kernel.

as an aside- I find the fact even microsoft's own modal dialogs don't all support DPI scaling- aka they are blurry.

link