xref: /PHP-7.4/ext/spl/tests/bug70166.phpt (revision 7381b6ac)
1--TEST--
2SPL: Bug #70166 Use After Free Vulnerability in unserialize() with SPLArrayObject
3--FILE--
4<?php
5$inner = 'x:i:1;a:0:{};m:a:0:{}';
6$exploit = 'a:2:{i:0;C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}i:1;R:5;}';
7
8$data = unserialize($exploit);
9
10for($i = 0; $i < 5; $i++) {
11    $v[$i] = 'hi'.$i;
12}
13
14var_dump($data);
15?>
16===DONE===
17--EXPECTF--
18array(2) {
19  [0]=>
20  object(ArrayObject)#%d (1) {
21    ["storage":"ArrayObject":private]=>
22    array(0) {
23    }
24  }
25  [1]=>
26  array(0) {
27  }
28}
29===DONE===
30