Test: /ext/standard/tests/strings/bug72433.phpt - Version 7.0.22-dev        

Security #72433 Use After Free Vulnerability in PHP's GC algorithm and unserialize
Submitted: 2016-06-16 14:37:18 Modified: 2016-06-23 12:51:05
From: 3v0n1d3 Assigned: dmitry
Status: Closed Package: *General Issues
PHP Version: 5.5.36 OS: *

There are 2 different diffs reported by users for this test.

Count Diff
1 (50%)
011+ array(3) {
012+ [0]=>
013+ *RECURSION*
014+ [1]=>
015+ *RECURSION*
016+ [2]=>
017+ *RECURSION*
018+ }
011- *RECURSION*
023- *RECURSION*
030+ array(3) {
031+ [0]=>
032+ *RECURSION*
033+ [1]=>
034+ *RECURSION*
035+ [2]=>
036+ *RECURSION*
037+ }
031- *RECURSION*
032- [1]=>
033- *RECURSION*
045+ array(3) {
046+ [0]=>
047+ *RECURSION*
048+ [1]=>
049+ *RECURSION*
050+ [2]=>
051+ *RECURSION*
052+ }
053+ [1]=>
054+ array(3) {
055+ [0]=>
056+ *RECURSION*
057+ [1]=>
058+ *RECURSION*
059+ [2]=>
060+ *RECURSION*
061+ }
067+ [Fri Jun 30 12:04:13 2017] Script: %s/bug72433.php'
068+ /home/travis/build/php/php-src/Zend/zend_API.c(1059) : Freeing 0x7F9D7CE598A0 (56 bytes), %s/bug72433.php
069+ [Fri Jun 30 12:04:13 2017] Script: %s/bug72433.php'
070+ /home/travis/build/php/php-src/Zend/zend_hash.c(140) : Freeing 0x7F9D7CE60A00 (288 bytes), %s/bug72433.php
071+ [Fri Jun 30 12:04:13 2017] Script: %s/bug72433.php'
072+ /home/travis/build/php/php-src/ext/spl/spl_array.c(176) : Freeing 0x7F9D7CE721E0 (120 bytes), %s/bug72433.php
073+ /home/travis/build/php/php-src/Zend/zend_alloc.c(2516) : Actual location (location was relayed)
074+ === Total 3 memory leaks detected ===
1 (50%)
011+ array(3) {
012+ [0]=>
013+ *RECURSION*
014+ [1]=>
015+ *RECURSION*
016+ [2]=>
017+ *RECURSION*
018+ }
011- *RECURSION*
023- *RECURSION*
030+ array(3) {
031+ [0]=>
032+ *RECURSION*
033+ [1]=>
034+ *RECURSION*
035+ [2]=>
036+ *RECURSION*
037+ }
031- *RECURSION*
032- [1]=>
033- *RECURSION*
045+ array(3) {
046+ [0]=>
047+ *RECURSION*
048+ [1]=>
049+ *RECURSION*
050+ [2]=>
051+ *RECURSION*
052+ }
053+ [1]=>
054+ array(3) {
055+ [0]=>
056+ *RECURSION*
057+ [1]=>
058+ *RECURSION*
059+ [2]=>
060+ *RECURSION*
061+ }