diff --git a/NEWS b/NEWS index 9beb6fddd61..58073390877 100644 --- a/NEWS +++ b/NEWS @@ -26,7 +26,7 @@ PHP NEWS non-blocking). (Nikita) - GMP: - . Fixed bug #76470 (Integer Underflow when unserializing GMP and possible + . Fixed bug #74670 (Integer Underflow when unserializing GMP and possible other classes). (Nikita) - intl: diff --git a/ext/standard/tests/strings/bug70436.phpt b/ext/standard/tests/serialize/bug70436.phpt similarity index 89% rename from ext/standard/tests/strings/bug70436.phpt rename to ext/standard/tests/serialize/bug70436.phpt index 7d6d0f18d91..8b0df73d608 100644 --- a/ext/standard/tests/strings/bug70436.phpt +++ b/ext/standard/tests/serialize/bug70436.phpt @@ -25,7 +25,7 @@ $fakezval .= "\x01"; $fakezval .= "\x00"; $fakezval .= "\x00\x00"; -$inner = 'C:3:"obj":3:{ryat'; +$inner = 'C:3:"obj":3:{rya}'; $exploit = 'a:4:{i:0;i:1;i:1;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:2;s:'.strlen($fakezval).':"'.$fakezval.'";i:3;R:5;}'; $data = unserialize($exploit); @@ -48,8 +48,6 @@ DONE --EXPECTF-- Notice: unserialize(): Error at offset 0 of 3 bytes in %sbug70436.php on line %d -Notice: unserialize(): Error at offset 16 of 17 bytes in %sbug70436.php on line %d - Notice: unserialize(): Error at offset 93 of 94 bytes in %sbug70436.php on line %d bool(false) DONE