blob: bd1f94ecef4c31a25c5e7b2c5ec52816aa5cf3bd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
--TEST--
Bug #70211 (php 7 ZEND_HASH_IF_FULL_DO_RESIZE use after free)
--SKIPIF--
<?php require 'skipif.inc'; ?>
--FILE--
<?php
$addr = 0x4141414141414141;
function ptr2str($ptr)
{
$out = "";
for ($i=0; $i<8; $i++) {
$out .= chr($ptr & 0xff);
$ptr >>= 8;
}
return $out;
}
$sf = new SoapFault('1', 'string', 'detail', 'header','line', str_repeat("A",232).ptr2str($addr));
$ob = unserialize("a:3:{i:0;".serialize($sf).'i:1;R:12;i:2;R:10;}');
var_dump($ob[1]);
?>
--EXPECT--
string(6) "detail"
|
