com php-src: add test for bug #68976: ext/standard/tests/serialize/bug68976.phpt

Commit: 8b14d3052ffcffa17d6e2be652f20e18f8f562ad Author: Stanislav Malyshev <stas@php.net> Tue, 17 Mar 2015 17:03:46 -0700 Parents: 646572d6d3847d68124b03936719f60936b49a38 Branches: PHP-5.4 PHP-5.5 PHP-5.6 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=8b14d3052ffcffa17d6e2be652f20e18f8f562ad Log: add test for bug #68976 Bugs: https://bugs.php.net/68976 Changed paths: A ext/standard/tests/serialize/bug68976.phpt Diff: diff --git a/ext/standard/tests/serialize/bug68976.phpt b/ext/standard/tests/serialize/bug68976.phpt new file mode 100644 index 0000000..a79a953 --- /dev/null +++ b/ext/standard/tests/serialize/bug68976.phpt @@ -0,0 +1,37 @@ +--TEST-- +Bug #68976 Use After Free Vulnerability in unserialize() +--FILE-- +<?php +class evilClass { + public $name; + function __wakeup() { + unset($this->name); + } +} + +$fakezval = pack( + 'IIII', + 0x00100000, + 0x00000400, + 0x00000000, + 0x00000006 +); + +$data = unserialize('a:2:{i:0;O:9:"evilClass":1:{s:4:"name";a:2:{i:0;i:1;i:1;i:2;}}i:1;R:4;}'); + +for($i = 0; $i < 5; $i++) { + $v[$i] = $fakezval.$i; +} + +var_dump($data); +?> +===DONE=== +--EXPECTF-- +array(2) { + [0]=> + object(evilClass)#1 (0) { + } + [1]=> + int(1) +} +===DONE===