mirror of
https://github.com/php/php-src.git
synced 2026-04-25 08:58:28 +02:00
Jeremy Mikola
858d0c0916
The deprecation message was originally introduced in 3e6b447 (#6494).
I first encountered this notice when testing the MongoDB extension
with PHP 8.1, which produced many duplicate messages that provided
no detail about the particular class that needed to be fixed.
Closes GH-7346.
54 lines
1.1 KiB
PHP
54 lines
1.1 KiB
PHP
--TEST--
|
|
Bug #70172 - Use After Free Vulnerability in unserialize()
|
|
--FILE--
|
|
<?php
|
|
class obj implements Serializable {
|
|
var $data;
|
|
function serialize() {
|
|
return serialize($this->data);
|
|
}
|
|
function unserialize($data) {
|
|
$this->data = unserialize($data);
|
|
}
|
|
}
|
|
|
|
$fakezval = ptr2str(1122334455);
|
|
$fakezval .= ptr2str(0);
|
|
$fakezval .= "\x00\x00\x00\x00";
|
|
$fakezval .= "\x01";
|
|
$fakezval .= "\x00";
|
|
$fakezval .= "\x00\x00";
|
|
|
|
$inner = 'R:2;';
|
|
$exploit = 'a:2:{i:0;i:1;i:1;C:3:"obj":'.strlen($inner).':{'.$inner.'}}';
|
|
|
|
$data = unserialize($exploit);
|
|
|
|
for ($i = 0; $i < 5; $i++) {
|
|
$v[$i] = $fakezval.$i;
|
|
}
|
|
|
|
var_dump($data);
|
|
|
|
function ptr2str($ptr)
|
|
{
|
|
$out = '';
|
|
for ($i = 0; $i < 8; $i++) {
|
|
$out .= chr($ptr & 0xff);
|
|
$ptr >>= 8;
|
|
}
|
|
return $out;
|
|
}
|
|
?>
|
|
--EXPECTF--
|
|
Deprecated: %s implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary) in %s on line %d
|
|
array(2) {
|
|
[0]=>
|
|
int(1)
|
|
[1]=>
|
|
object(obj)#%d (1) {
|
|
["data"]=>
|
|
int(1)
|
|
}
|
|
}
|