12345678910111213141516171819202122232425262728 |
- --TEST--
- SPL: Bug #70169 Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
- --FILE--
- <?php
- $inner = 'i:1;';
- $exploit = 'a:2:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:1;R:3;}';
- $data = unserialize($exploit);
- for($i = 0; $i < 5; $i++) {
- $v[$i] = 'hi'.$i;
- }
- var_dump($data);
- ?>
- --EXPECTF--
- array(2) {
- [0]=>
- object(SplDoublyLinkedList)#%d (2) {
- ["flags":"SplDoublyLinkedList":private]=>
- int(1)
- ["dllist":"SplDoublyLinkedList":private]=>
- array(0) {
- }
- }
- [1]=>
- int(1)
- }
|