Google has transitioned its Chrome browser to the Skrifa library, written in Rust and providing capabilities for processing OpenType fonts. Skrifa implements a subset of the FreeType font engine's functionalities necessary for the 2D Skia library used in Chrome and Chromium. To free the Skia library from its dependence on the FreeType engine, a new font backend based on Skrifa has been created.
In Chrome 128, the Rust-based backend was included in experimental mode for rarely used font formats such as CFF2 and color fonts. Starting with the release of Chrome 133, the new backend is utilized for all web fonts in builds for Linux, Android, and ChromeOS platforms. On Windows and macOS, the new engine is currently used as a fallback, applied when the system does not support the font format that the browser is attempting to render.
The Skrifa code was developed by Google engineers as part of the Fontations toolkit and is open under the MIT and Apache 2.0 licenses. Approximately 700 unit tests have been prepared to verify the correctness of Skrifa's functionality. The library supports decoding glyphs in glyf, CFF, CFF2, COLRv0, COLRv1, EBDT, CBDT, and sbix formats, as well as variable fonts in glyf, CFF2, and COLRv1 formats, and font hinting for glyf, CFF, and CFF2 formats.
In addition to the Skrifa library, which provides an API for accessing font metadata and loading glyph outlines, the Fontations toolkit includes low-level libraries for reading, parsing, modifying, and creating font data in OpenType format. Fontations is part of the Oxidize project, created to translate utilities and libraries for working with text and fonts from components in Python (fonttools, fontmake, nanoemoji) and C++ (HarfBuzz, FreeType) to new implementations written in Rust.
The development of components in Rust began due to the insufficient effectiveness of error detection through fuzzing testing, as font formats are too complex to cover all possible combinations. For instance, last week a critical vulnerability was discovered in FreeType that allows code execution when processing specially crafted fonts due to a buffer overflow. In addition to the FreeType engine, security issues can also arise from dependencies used within it, such as bzip2, libpng, and zlib.
Using Rust has significantly reduced the likelihood of memory-related issues, improved code quality, decreased the time spent fixing security problems, and accelerated enhancements related to font capabilities in Chrome. According to statistics from Google and Microsoft, around 70% of dangerous vulnerabilities are caused by memory issues that can be avoided by using Rust without unsafe blocks.
For example, using Rust would have prevented previously identified issues in FreeType's code related to accessing freed memory areas, buffer overflows, accessing arrays without index checking, integer overflows, improper use of uninitialized memory areas, and type casting errors.
Source: opennet.ru
