1--TEST-- 2Bug #70219 Use after free vulnerability in session deserializer 3--XFAIL-- 4Unfinished merge, needs fix. 5--FILE-- 6<?php 7class obj implements Serializable { 8 var $data; 9 function serialize() { 10 return serialize($this->data); 11 } 12 function unserialize($data) { 13 session_start(); 14 session_decode($data); 15 } 16} 17 18$inner = 'ryat|a:1:{i:0;a:1:{i:1;'; 19$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}'; 20 21$data = unserialize($exploit); 22 23for ($i = 0; $i < 5; $i++) { 24 $v[$i] = 'hi'.$i; 25} 26 27var_dump($data); 28?> 29--EXPECTF-- 30Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d 31array(2) { 32 [0]=> 33 object(obj)#%d (1) { 34 ["data"]=> 35 NULL 36 } 37 [1]=> 38 &array(1) { 39 ["data"]=> 40 NULL 41 } 42} 43