From: Michael Wallner <mike@php.net>
Date: Mon, 12 Sep 2016 06:54:16 +0000 (+0200)
Subject: Merge branch 'v2.6.x'
X-Git-Tag: RELEASE_3_1_0_RC1~31
X-Git-Url: https://git.m6w6.name/?p=m6w6%2Fext-http;a=commitdiff_plain;h=0869caece2853a07711676bad8f032fa89ed82e9;hp=b3831bc5f19cf32880ea19341c3527f0e9553517

Merge branch 'v2.6.x'
---

diff --git a/tests/bug73055.phpt b/tests/bug73055.phpt
new file mode 100644
index 0000000..04201c7
--- /dev/null
+++ b/tests/bug73055.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #73055 (Type confusion vulnerability in merge_param())
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+
+echo "Test\n";
+
+try {
+	echo new http\QueryString("[[[[[[[[[[[[[[[[[[[[[[[[[[[]]]][[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[&%C0[]E[=&2[&%C0[]E[16706[*[");
+} catch (Exception $e) {
+	echo $e;
+}
+?>
+
+===DONE===
+--EXPECTF--
+Test
+%r(exception ')?%rhttp\Exception\BadQueryStringException%r(' with message '|: )%rhttp\QueryString::__construct(): Max input nesting level of %d exceeded%r'?%r in %sbug73055.php:%d
+Stack trace:
+#0 %sbug73055.php(%d): http\QueryString->__construct('[[[[[[[[[[[[[[[...')
+#1 {main}
+===DONE===