1--TEST-- 2SPL: Bug #70166 Use After Free Vulnerability in unserialize() with SPLArrayObject 3--FILE-- 4<?php 5$inner = 'x:i:1;a:0:{};m:a:0:{}'; 6$exploit = 'a:2:{i:0;C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}i:1;R:5;}'; 7 8$data = unserialize($exploit); 9 10for($i = 0; $i < 5; $i++) { 11 $v[$i] = 'hi'.$i; 12} 13 14var_dump($data); 15?> 16--EXPECTF-- 17array(2) { 18 [0]=> 19 object(ArrayObject)#%d (1) { 20 ["storage":"ArrayObject":private]=> 21 array(0) { 22 } 23 } 24 [1]=> 25 array(0) { 26 } 27} 28
