bug73147.phpt 299 B

123456789101112131415
  1. --TEST--
  2. Bug #73147: Use After Free in PHP7 unserialize()
  3. --EXTENSIONS--
  4. curl
  5. --FILE--
  6. <?php
  7. $poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
  8. try {
  9. var_dump(unserialize($poc));
  10. } catch(Exception $e) {
  11. echo $e->getMessage();
  12. }
  13. ?>
  14. --EXPECT--
  15. Unserialization of 'CURLFile' is not allowed