HexBrain

Phabricator · Report #105657

libphutil: removing bytes from a PhutilRope does not work as intended

Validstatus
16 Dec 2015disclosed

How it was found

Mongoose. This is a bug in libphutil, it doesn't seem to affect phabricator because the bytes are always removed one buffer at a time. I imagine this could cause security issues in applications made with libphutil as a framework, if they use PhutilRope directly. This is how it goes:

$rope = new PhutilRope();
$rope->append("aaa");
$rope->append("bbb");
$rope->append("ccc");
$rope->append("rrrrddddddddd");
$rope->removeBytesFromHead(4);

echo $rope->getAsString();

should output "bbcccrrrrddddddddd" but will instead output "ddddddddd".

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original