1--TEST-- 2SPL: Bug #70169 Use After Free Vulnerability in unserialize() with SplDoublyLinkedList 3--FILE-- 4<?php 5$inner = 'i:1;'; 6$exploit = 'a:2:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:1;R:3;}'; 7 8$data = unserialize($exploit); 9 10for($i = 0; $i < 5; $i++) { 11 $v[$i] = 'hi'.$i; 12} 13 14var_dump($data); 15?> 16===DONE=== 17--EXPECTF-- 18array(2) { 19 [0]=> 20 object(SplDoublyLinkedList)#%d (2) { 21 ["flags":"SplDoublyLinkedList":private]=> 22 int(1) 23 ["dllist":"SplDoublyLinkedList":private]=> 24 array(0) { 25 } 26 } 27 [1]=> 28 int(1) 29} 30===DONE=== 31
