libphutil: removing bytes from a PhutilRope does not work as intended

Disclosed: 2015-12-16 21:01:12 By fnqgpc To phabricator
Unknown
Vulnerability Details
Mongoose. This is a bug in libphutil, it doesn't seem to affect phabricator because the bytes are always removed one buffer at a time. I imagine this could cause security issues in applications made with libphutil as a framework, if they use PhutilRope directly. This is how it goes: $rope = new PhutilRope(); $rope->append("aaa"); $rope->append("bbb"); $rope->append("ccc"); $rope->append("rrrrddddddddd"); $rope->removeBytesFromHead(4); echo $rope->getAsString(); should output "bbcccrrrrddddddddd" but will instead output "ddddddddd".
Actions
View on HackerOne
Report Stats
  • Report ID: 105657
  • State: Closed
  • Substate: resolved
Share this report