Fix excessive combining marks causing GPU overload and rendering corruption#294
Open
vserediuk wants to merge 1 commit intodesktop-app:masterfrom
Open
Fix excessive combining marks causing GPU overload and rendering corruption#294vserediuk wants to merge 1 commit intodesktop-app:masterfrom
vserediuk wants to merge 1 commit intodesktop-app:masterfrom
Conversation
Extend IsDiacritic() to recognize Mark_Enclosing and Mark_SpacingCombining Unicode categories, so the existing per-character combining mark limit (kMaxDiacAfterSymbol = 2) applies to all types of combining characters. Previously only Mark_NonSpacing was checked, allowing characters like U+20DD (COMBINING ENCLOSING CIRCLE) to bypass the limit and stack hundreds of times on a single base character, causing GPU overload and rendering corruption.
31cd135 to
34ea6c5
Compare
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

Fix excessive combining marks causing GPU overload and rendering corruption
Problem
Text containing a large number of Unicode combining characters (such as
⃝U+20DD COMBINING ENCLOSING CIRCLE) stacked on a single base character causes:Example of malicious text:
ы҉⃝repeated hundreds of times — a single Cyrillic letter with COMBINING CYRILLIC MILLIONS SIGN (U+0489, Mark_NonSpacing) followed by COMBINING ENCLOSING CIRCLE (U+20DD, Mark_Enclosing).Root Cause
The
IsDiacritic()function inui/text/text.cpponly checked forQChar::Mark_NonSpacingcategory. While the block parser already has a limit (kMaxDiacAfterSymbol = 2) on how many diacritics can follow a base character, the combining marks fromMark_Enclosing(e.g., U+20DD COMBINING ENCLOSING CIRCLE, U+20DE COMBINING ENCLOSING SQUARE, U+20DF COMBINING ENCLOSING DIAMOND, U+20E0 COMBINING ENCLOSING CIRCLE BACKSLASH) andMark_SpacingCombiningcategories were not recognized as diacritics and bypassed this limit entirely.Fix
Extend
IsDiacritic()to also recognizeQChar::Mark_EnclosingandQChar::Mark_SpacingCombiningUnicode categories. This ensures the existing per-character combining mark limit applies to ALL types of Unicode combining characters, preventing the stacking abuse while preserving legitimate use (the limit of 2 combining marks is sufficient for all natural scripts).Affected file
ui/text/text.cpp(indesktop-app/lib_ui)Testing
Text like
ы+ U+0489 + U+20DD repeated hundreds of times (ы...) should now: