xref: /PHP-7.1/ext/spl/tests/bug70169.phpt (revision 863bf294)
1--TEST--
2SPL: Bug #70169	Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
3--FILE--
4<?php
5$inner = 'i:1;';
6$exploit = 'a:2:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:1;R:3;}';
7
8$data = unserialize($exploit);
9
10for($i = 0; $i < 5; $i++) {
11    $v[$i] = 'hi'.$i;
12}
13
14var_dump($data);
15?>
16===DONE===
17--EXPECTF--
18array(2) {
19  [0]=>
20  object(SplDoublyLinkedList)#%d (2) {
21    ["flags":"SplDoublyLinkedList":private]=>
22    int(1)
23    ["dllist":"SplDoublyLinkedList":private]=>
24    array(0) {
25    }
26  }
27  [1]=>
28  int(1)
29}
30===DONE===
31