1--TEST-- 2Bug #70211 (php 7 ZEND_HASH_IF_FULL_DO_RESIZE use after free) 3--FILE-- 4<?php 5 6$addr = 0x4141414141414141; 7 8function ptr2str($ptr) 9{ 10 $out = ""; 11 for ($i=0; $i<8; $i++) { 12 $out .= chr($ptr & 0xff); 13 $ptr >>= 8; 14 } 15 return $out; 16} 17 18$sf = new SoapFault('1', 'string', 'detail', 'header','line', str_repeat("A",232).ptr2str($addr)); 19$ob = unserialize("a:3:{i:0;".serialize($sf).'i:1;r:12;i:2;r:10;}'); 20 21var_dump($ob[1]); 22?> 23--EXPECT-- 24string(6) "detail" 25