CoreText exploit analyzed

CoreText exploit analyzed

An analysis has been conducted on the recently-uncovered CoreText exploit, to determine exactly how it worked. The expolit crashed apps when malicious text messages and emails were opened on iOS devices and Macs. The exploit had to do with negative-length strings, according to The Register

Apple's CoreText rendering system uses signed integers to pass around array indexes and string lengths. A negative length, -1, is passed unchecked to a library function which uses it as an unsigned long integer to set the bounds of an array. This causes the library to attempt to read beyond the end of an array and into unallocated memory, triggering a fatal exception.

Apple is rumored to have fixed this exploit in both Mavericks and iOS 7. In the meantime, iOS 6 and Mountain Lion users affected by this issue can use the workaround from our own Nick Arnott.

Any of you been bitten by this bug?

Source: The Register

Have something to say about this story? Leave a comment! Need help with something else? Ask in our forums!

Joseph Keller

News Writer for Mobile Nations. Fascinated by the ways that technology connects us.

More Posts



← Previously

Imagining iPhone 5S and iPhone 5C: LTE, Bluetooth, 802.11ac Wi-Fi, and no NFC

Next up →

Sony Cyber-shot 'lens cameras,' iOS app available later this month

Reader comments

CoreText exploit analyzed


It's just a shame Apple take so long to fix a bug like that. Even Jailbroken iOS got a solution, looks like Apple isn't caring too much about this.

While it would be nice to see a patch for iOS 6 and OS X 10.8, it's worth noting that the jailbreak solution is a workaround to prevent the crash, not a fix of the original bug. The jailbreak developer is also afforded the luxury of being able to quickly release updates for his workaround as he improves it and minimal testing is done. While a fix from Apple would require a lot more work to try and ensure that they fix it and fix it properly on the first shot. I'm not saying they shouldn't have fixed it by now, just that you can't point to the jailbreak workaround and treat is as an equivalent to Apple patching a low-level system bug.