Apple Macs, iThings, smart watches choke on tiny Indian delicacy

Watch out for text bomb that crashes apps and devices over and over and...

Apple last month fixed a flaw in macOS and iOS that allowed a text message to crash its chat software (CVE-2018-4100) – and now it has the opportunity to do so again.

Various macOS, iOS, and watchOS apps that rely on Apples's text-rending code can be crashed when sent a message containing a symbol composed of characters used in the Indian language Telugu.

A post on Monday to Open Radar – a community bug reporting site set up to maintain copies of bugs submitted to Apple's private Radar bug tracking system because Apple prefers secrecy to public discussion of flaws – describes how to take down apps running on devices from the fruit-themed biz.

"Try to insert 'జ్ఞ‌ా' this symbol in any system text renderer like TextField, Label, TextView [and it always crashes]," iOS developer Igor Bulyga explains in his post.

The symbol represents a combination of Telugu letters and signs, specifically the letter "ja," the sign "virama," the letter "nya," a zero-width non-joiner and the vowel sign "aa."

Trying to open a message with this symbol in iMessage or other apps that rely on Apple's UIKit framework for text rendering, like Facebook Messenger, Twitter, and WhatsApp, will cause a crash. Don't what ever you do try to create a filesystem folder using that symbol.

If a message with the offending symbol gets surfaced as a notification on an iPhone lock screen and opened, reports suggest that will take down Springboard, the iOS app managing the home screen.

Restarting may not help because if the software tries to render the offending character again, the crash will repeat. A potential fix would be to delete the message by logging into the appropriate app on another device (without opening the message) before rebooting.

Bulyga created sample Swift code, for the Swift Playgrounds app, to demonstrate the problem.

import UIKit
import PlaygroundSupport

  class MyViewController : UIViewController {
    override func loadView() {
        let view = UIView()
        view.backgroundColor = .white

  let label = UILabel()
        label.frame = CGRect(x: 150, y: 200, width: 200, height: 20)
        label.text = "జ్ఞ‌ా"
        label.textColor = .black

  view.addSubview(label)
        self.view = view
    }
}

// Present the view controller in the Live View window
PlaygroundPage.current.liveView = MyViewController()

According to Bulyga, Apple marked his submission in its Radar bug reporter as a duplicate, indicating that the company is aware of the issue and is presumably planning a fix.

Apple did not respond to a request for comment, but the word is that the latest beta version of the next iOS release does not have this problem. ®

Bootnote

Only this week was ex-Windows boss Steve "one-man wrecking crew" Sinofsky praising Apple for its "breathtaking and unprecedented ... quality."

4/ Few companies have done so much for so long with such a high level of consistency. This all goes back to the bet on the NeXT code base and move to Intel for Mac OS plus the iPod, which began the journey to where we are today.

— 🧘🏻‍♂️Steven Sinofsky ॐ (@stevesi) February 12, 2018

That aged well.