File: bug72731.phpt

package info (click to toggle)
php8.4 8.4.16-1
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid
  • size: 211,276 kB
  • sloc: ansic: 1,176,142; php: 35,419; sh: 11,964; cpp: 7,208; pascal: 4,951; javascript: 3,091; asm: 2,817; yacc: 2,411; makefile: 696; xml: 446; python: 301; awk: 148
file content (18 lines) | stat: -rw-r--r-- 300 bytes parent folder | download | duplicates (3) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
 
--TEST--
Bug #72731: Type Confusion in Object Deserialization
--FILE--
<?php

class obj {
    var $ryat;
    function __wakeup() {
        $this->ryat = 0x1122334455;
    }
}

$poc = 'O:8:"stdClass":1:{i:0;O:3:"obj":1:{s:4:"ryat";R:1;}}';
var_dump(unserialize($poc));

?>
--EXPECTF--
%s(73588229205)