1--TEST-- 2Bug #73092: Unserialize use-after-free when resizing object's properties hash table (2) 3--FILE-- 4<?php 5class foo { 6 public $x; 7 function __wakeup() { 8 var_dump($this->x); 9 } 10} 11 12unserialize('a:3:{i:0;O:3:"foo":1:{s:1:"x";O:12:"DateInterval":1:{i:0;i:0;}}i:1;s:263:"'.str_repeat("\06", 263).'";i:2;r:4;}}'); 13 14?> 15--EXPECTF-- 16object(DateInterval)#%d (16) { 17 ["0"]=> 18 int(0) 19 ["y"]=> 20 int(-1) 21 ["m"]=> 22 int(-1) 23 ["d"]=> 24 int(-1) 25 ["h"]=> 26 int(-1) 27 ["i"]=> 28 int(-1) 29 ["s"]=> 30 int(-1) 31 ["weekday"]=> 32 int(-1) 33 ["weekday_behavior"]=> 34 int(-1) 35 ["first_last_day_of"]=> 36 int(-1) 37 ["invert"]=> 38 int(0) 39 ["days"]=> 40 int(-1) 41 ["special_type"]=> 42 int(0) 43 ["special_amount"]=> 44 int(-1) 45 ["have_weekday_relative"]=> 46 int(0) 47 ["have_special_relative"]=> 48 int(0) 49} 50