From 0197082b8eb9e7eac8b06af0e92c7e2f43e2afa6 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Tue, 17 Mar 2015 17:03:46 -0700
Subject: add test for bug #68976

---
 ext/standard/tests/serialize/bug68976.phpt | 37 ++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 ext/standard/tests/serialize/bug68976.phpt

diff --git a/ext/standard/tests/serialize/bug68976.phpt b/ext/standard/tests/serialize/bug68976.phpt
new file mode 100644
index 0000000000..a79a953a4a
--- /dev/null
+++ b/ext/standard/tests/serialize/bug68976.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Bug #68976 Use After Free Vulnerability in unserialize()
+--FILE--
+<?php
+class evilClass {
+	public $name;
+	function __wakeup() {
+		unset($this->name);
+	}
+}
+
+$fakezval = pack(
+    'IIII',
+    0x00100000,
+    0x00000400,
+    0x00000000,
+    0x00000006 
+);
+
+$data = unserialize('a:2:{i:0;O:9:"evilClass":1:{s:4:"name";a:2:{i:0;i:1;i:1;i:2;}}i:1;R:4;}');
+
+for($i = 0; $i < 5; $i++) {
+    $v[$i] = $fakezval.$i;
+}
+
+var_dump($data);
+?>
+===DONE===
+--EXPECTF--
+array(2) {
+  [0]=>
+  object(evilClass)#1 (0) {
+  }
+  [1]=>
+  int(1)
+}
+===DONE===
-- 
cgit v1.2.1