bug70169.phpt 565 B

123456789101112131415161718192021222324252627282930
  1. --TEST--
  2. SPL: Bug #70169 Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
  3. --FILE--
  4. <?php
  5. $inner = 'i:1;';
  6. $exploit = 'a:2:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:1;R:3;}';
  7. $data = unserialize($exploit);
  8. for($i = 0; $i < 5; $i++) {
  9. $v[$i] = 'hi'.$i;
  10. }
  11. var_dump($data);
  12. ?>
  13. ===DONE===
  14. --EXPECTF--
  15. array(2) {
  16. [0]=>
  17. object(SplDoublyLinkedList)#%d (2) {
  18. ["flags":"SplDoublyLinkedList":private]=>
  19. int(1)
  20. ["dllist":"SplDoublyLinkedList":private]=>
  21. array(0) {
  22. }
  23. }
  24. [1]=>
  25. int(1)
  26. }
  27. ===DONE===