xref: /PHP-8.3/ext/spl/tests/bug70166.phpt (revision a555cc0b)
1--TEST--
2SPL: Bug #70166 Use After Free Vulnerability in unserialize() with SPLArrayObject
3--FILE--
4<?php
5$inner = 'x:i:1;a:0:{};m:a:0:{}';
6$exploit = 'a:2:{i:0;C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}i:1;R:5;}';
7
8$data = unserialize($exploit);
9
10for($i = 0; $i < 5; $i++) {
11    $v[$i] = 'hi'.$i;
12}
13
14var_dump($data);
15?>
16--EXPECTF--
17array(2) {
18  [0]=>
19  object(ArrayObject)#%d (1) {
20    ["storage":"ArrayObject":private]=>
21    array(0) {
22    }
23  }
24  [1]=>
25  array(0) {
26  }
27}
28