Phabricator · Report #105657
libphutil: removing bytes from a PhutilRope does not work as intended
Validstatus
16 Dec 2015disclosed
How it was found
Mongoose. This is a bug in libphutil, it doesn't seem to affect phabricator because the bytes are always removed one buffer at a time. I imagine this could cause security issues in applications made with libphutil as a framework, if they use PhutilRope directly. This is how it goes:
$rope = new PhutilRope();
$rope->append("aaa");
$rope->append("bbb");
$rope->append("ccc");
$rope->append("rrrrddddddddd");
$rope->removeBytesFromHead(4);
echo $rope->getAsString();
should output "bbcccrrrrddddddddd" but will instead output "ddddddddd".