1--TEST--
2Bug #70513: GMP Deserialization Type Confusion Vulnerability
3--EXTENSIONS--
4gmp
5--FILE--
6<?php
7
8class obj
9{
10    var $ryat;
11
12    function __wakeup()
13    {
14        $this->ryat = 1;
15    }
16}
17
18$obj = new stdClass;
19$obj->aa = 1;
20$obj->bb = 2;
21
22$inner = 's:1:"1";a:3:{s:2:"aa";s:2:"hi";s:2:"bb";s:2:"hi";i:0;O:3:"obj":1:{s:4:"ryat";R:2;}}';
23$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';
24$x = unserialize($exploit);
25var_dump($x);
26var_dump($obj);
27
28?>
29--EXPECT--
30array(1) {
31  [0]=>
32  int(1)
33}
34object(stdClass)#1 (2) {
35  ["aa"]=>
36  int(1)
37  ["bb"]=>
38  int(2)
39}
40