bug70169.phpt 543 B

12345678910111213141516171819202122232425262728
  1. --TEST--
  2. SPL: Bug #70169 Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
  3. --FILE--
  4. <?php
  5. $inner = 'i:1;';
  6. $exploit = 'a:2:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:1;R:3;}';
  7. $data = unserialize($exploit);
  8. for($i = 0; $i < 5; $i++) {
  9. $v[$i] = 'hi'.$i;
  10. }
  11. var_dump($data);
  12. ?>
  13. --EXPECTF--
  14. array(2) {
  15. [0]=>
  16. object(SplDoublyLinkedList)#%d (2) {
  17. ["flags":"SplDoublyLinkedList":private]=>
  18. int(1)
  19. ["dllist":"SplDoublyLinkedList":private]=>
  20. array(0) {
  21. }
  22. }
  23. [1]=>
  24. int(1)
  25. }