Tweet crashes Mac Twitter client

The offending tweet content:<p><pre><code> ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ </code></pre> Edit: I've narrowed it down to the following byte sequence. I can't seem to remove any of the characters without it no longer crashing:<p><pre><code> 00000000 d9 88 d2 88 cd a5 cd a8 cd aa cd af 20 d2 88 d2 |............ ...| 00000010 88 d2 88 |...| 00000013 </code></pre> Hixie's unicode decoder says this is:<p><pre><code> U+0648 ARABIC LETTER WAW character (&#38;#x0648;) U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#38;#x0488;) U+0365 COMBINING LATIN SMALL LETTER I character (&#38;#x0365;) U+0368 COMBINING LATIN SMALL LETTER C character (&#38;#x0368;) U+036A COMBINING LATIN SMALL LETTER H character (&#38;#x036A;) U+036F COMBINING LATIN SMALL LETTER X character (&#38;#x036F;) U+0020 SPACE character U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#38;#x0488;) U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#38;#x0488;) U+0488 COMBINING CYRILLIC HUNDRED THOUSANDS SIGN character (&#38;#x0488;)</code></pre>

This is the tweet in html character entity form:<p><pre><code> &#38;#1607;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#875;&#38;#876;&#38;#873;&#38;#878;&#38;#872;&#38;#874;&#38;#879;&#38;#869;&#38;#869;&#38;#875;&#38;#874;&#38;#871;&#38;#867;&#38;#879;&#38;#874;&#38;#872;&#38;#867;&#38;#869;&#38;#876;&#38;#874;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#874;&#38;#869;&#38;#872;&#38;#874;&#38;#875;&#38;#876;&#38;#877;&#38;#878;&#38;#879;&#38;#869;&#38;#868;&#38;#867;&#38;#869;&#38;#872;&#38;#874;&#38;#871;&#38;#867;&#38;#879;&#38;#876;&#38;#874;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#1160;&#38;#874;&#38;#872;&#38;#874;&#38;#875;&#38;#876;&#38;#873;&#38;#878;&#38;#879;&#38;#869;&#38;#872;&#38;#867;&#38;#869;&#38;#875;&#38;#874;&#38;#871;&#38;#867;&#38;#879;&#38;#869;&#38;#876;&#38;#874;</code></pre>

And unfollowing only solves the problem until someone in your stream retweets it.<p>So I retweeted it.

Rendering any typeable character(s) should never crash any engine... ever. That said, unicode seems to be the last frontier for the non-viral spread of glitches.<p>I'm somewhat reminded of this : <a href="http://stackoverflow.com/a/1732454" rel="nofollow">http://stackoverflow.com/a/1732454</a>

It also crashes Chrome's current tab on OSX: <a href="http://imgur.com/vRn6Qid" rel="nofollow">http://imgur.com/vRn6Qid</a>

For at least one application, the crash is in:<p><pre><code> 0 libvDSP.dylib ? + 117458 1 com.apple.CoreText TRun::TRun(TRun const&#38;, CFRange, TRun::SubrangingStyle) + 850 2 com.apple.CoreText CTGlyphRun::CloneRange(CTRun const*, CFRange, TRun::SubrangingStyle) + 142 3 com.apple.CoreText TLine::SetLevelRange(CFRange, unsigned char, bool) + 162 4 com.apple.CoreText TLine::SetTrailingWhitespaceLevel(unsigned char) + 70 5 com.apple.CoreText TRunReorder::ReorderRuns(TBidiLevelsProvider const&#38;, TLine&#38;) + 122 6 com.apple.CoreText TTypesetter::FinishLineFill(TLine&#38;, double, double) const + 142 7 com.apple.CoreText CTTypesetterCreateLine + 131 </code></pre> I'm not familar enough with CoreText internals to guess what's going wrong, though. :)

Is it simply zalgo text? <a href="http://eeemo.net/" rel="nofollow">http://eeemo.net/</a>

Is this a mountain lion issue or does this affect lion and SL as well?

Does anyone else see something funky at the top most comments?

Ok, I narrowed down what kills Chrome.<p>minimalist example:<p><pre><code> data:text/html;charset=utf-8,&#60;p style='font-family: "Times New Roman";'&#62;%D9%88%20%D2%88%D2%88%D2%88 </code></pre> It seems to be a problem with utf-8 vs. unicode + Times New Roman.<p>tested on: Chrome 24.0.1312.57 | OS x 10.8.2<p>Edit: also works with other fonts for example Arial

Crashes Chrome on Mac (only the tab, not the whole process). Of course retweeted it!

I'm sure they'll have a bugfix release out soon to fix this.<p>Nah, just kidding.

Retweeted, of course.

Really interesting, played around with it locally and it just kill two random neighboring tabs, while not effecting others.<p>Chrome 24.0.1312.57 | OS x 10.8.2

No crash on either Chrome or Firefox on Arch Linux.

Yeah my twitter client is crashing now when I switch to another account that's already logged in.

This twitter account and tweet displays fine on TweetBot for iOS, but causes lag when scrolling.

How do you type this on a Mac?

This is crashing nightly webkit as well, so it is likely an issue there.

Crashing for me too .. can't open Twitter.app ...<p>OS X 10.8.2 (12C60)

It also crashes Sublime Edit when pasted.

firefox 18.0.2 on osx seems to survive...

correct me if i'm wrong, but somebody is working right now to use this bug in some piece of malicious code...

Aaaand i locked myself out of twitter.

No crash on Chromium with Arch Linux

Doesn't crash Tweetbot or Safari.

Also crashes Tweetbot on the Mac

Doesn't crash Safari on 10.8.2

&#60;p class="js-tweet-text tweet-text "&#62;ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ&#60;/p&#62;<p>Cool.<p>.<p>.<p>Edit: Apparently it is only the unicode<p>&#62;ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ&#62;ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ&#62;ه҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͫͬͩͮͨͪͯͥͥͫͪͧͣͯͪͨͣͥͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͥͨͪͫͬͭͮͯͥͤͣͥͨͪͧͣͯͬͪ ҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈҈ͪͨͪͫͬͩͮͯͥͨͣͥͫͪͧͣͯͥͬͪ<p>.<p>.<p>.<p>How is this possible?

should it be considered as a new form of attack ? utf attack , or utf malware ( that's a question ).