Skip to content

Commit 119e9dd

Browse files
committed
Update bug72479.phpt UAF test
bug72479.phpt tested a UAF via unserialize() of SNMP. With NOT_SERIALIZABLE, unserialize() rejects the class entirely, preventing the UAF by construction. Update the test to verify the rejection.
1 parent a824c5b commit 119e9dd

File tree

1 file changed

+6
-22
lines changed

1 file changed

+6
-22
lines changed

ext/snmp/tests/bug72479.phpt

Lines changed: 6 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -10,28 +10,12 @@ require_once(__DIR__.'/skipif.inc');
1010
<?php
1111
$arr = [1, [1, 2, 3, 4, 5], 3, 4, 5];
1212
$poc = 'a:3:{i:1;N;i:2;O:4:"snmp":1:{s:11:"quick_print";'.serialize($arr).'}i:1;R:7;}';
13-
$out = unserialize($poc);
14-
gc_collect_cycles();
15-
$fakezval = ptr2str(1122334455);
16-
$fakezval .= ptr2str(0);
17-
$fakezval .= "\x00\x00\x00\x00";
18-
$fakezval .= "\x01";
19-
$fakezval .= "\x00";
20-
$fakezval .= "\x00\x00";
21-
for ($i = 0; $i < 5; $i++) {
22-
$v[$i] = $fakezval.$i;
23-
}
24-
var_dump($out[1]);
25-
26-
function ptr2str($ptr)
27-
{
28-
$out = '';
29-
for ($i = 0; $i < 8; $i++) {
30-
$out .= chr($ptr & 0xff);
31-
$ptr >>= 8;
32-
}
33-
return $out;
13+
try {
14+
$out = unserialize($poc);
15+
var_dump($out);
16+
} catch (Exception $e) {
17+
echo $e->getMessage() . "\n";
3418
}
3519
?>
3620
--EXPECT--
37-
int(1)
21+
Unserialization of 'SNMP' is not allowed

0 commit comments

Comments
 (0)