blob: 3d7d1e7af3739fc456322e067ad381f130f16409 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
--TEST--
Bug #72731: Type Confusion in Object Deserialization
--FILE--
<?php
class obj {
var $ryat;
function __wakeup() {
$this->ryat = 0x1122334455;
}
}
$poc = 'O:8:"stdClass":1:{i:0;O:3:"obj":1:{s:4:"ryat";R:1;}}';
var_dump(unserialize($poc));
?>
--EXPECT--
int(73588229205)
|