1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
--TEST--
Bug #74669: Unserialize ArrayIterator broken
--FILE--
<?php
class Container implements Iterator
{
public $container;
public $iterator;
public function __construct()
{
$this->container = new ArrayObject();
$this->iterator = $this->container->getIterator();
}
public function append($element)
{
$this->container->append($element);
}
public function current(): mixed
{
return $this->iterator->current();
}
public function next(): void
{
$this->iterator->next();
}
public function key(): mixed
{
return $this->iterator->key();
}
public function valid(): bool
{
return $this->iterator->valid();
}
public function rewind(): void
{
$this->iterator->rewind();
}
}
class SelfArray extends ArrayObject
{
public function __construct()
{
parent::__construct($this);
}
}
$container = new Container();
$container->append('test1');
$container->append('test2');
$container->valid();
$serialized = serialize($container);
unset($container);
$container = unserialize($serialized);
foreach ($container as $key => $value) {
echo $key . ' => ' . $value . PHP_EOL;
}
$arObj = new ArrayObject(['test1', 'test2']);
$serialized = serialize($container);
unset($arObj);
$arObj = unserialize($serialized);
foreach($arObj as $key => $value) {
echo $key . ' => ' . $value . PHP_EOL;
}
$payload = 'x:i:33554432;O:8:"stdClass":0:{};m:a:0:{}';
$str = 'C:11:"ArrayObject":' . strlen($payload) . ':{' . $payload . '}';
$ao = unserialize($str);
var_dump($ao['foo']);
$selfArray = new SelfArray();
$selfArray['foo'] = 'bar';
var_dump($selfArray);
$serialized = serialize($selfArray);
var_dump($serialized);
unset($selfArray);
$selfArray = unserialize($serialized);
var_dump($selfArray);
var_dump($selfArray['foo']);
?>
--EXPECTF--
0 => test1
1 => test2
0 => test1
1 => test2
Warning: Undefined array key "foo" in %s on line %d
NULL
object(SelfArray)#9 (1) {
["foo"]=>
string(3) "bar"
}
string(77) "O:9:"SelfArray":4:{i:0;i:16777216;i:1;N;i:2;a:1:{s:3:"foo";s:3:"bar";}i:3;N;}"
Deprecated: Creation of dynamic property SelfArray::$foo is deprecated in %s on line %d
object(SelfArray)#9 (1) {
["foo"]=>
string(3) "bar"
}
string(3) "bar"
|
