diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-04-23 12:43:22 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-04-23 12:43:32 +0200 |
| commit | 68892410f7540c5ce7f10fa6cbc9c4c8b747620b (patch) | |
| tree | 35e6907086fafb7770d29077a768ddbfab962d74 /ext/json/tests | |
| parent | cedee4408b21baed6376a2702d7d8d01e8d4a111 (diff) | |
| parent | 4831e150c5ada631c1480098b8a42cbf024d8899 (diff) | |
| download | php-git-68892410f7540c5ce7f10fa6cbc9c4c8b747620b.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
Diffstat (limited to 'ext/json/tests')
| -rw-r--r-- | ext/json/tests/bug77843.phpt | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/ext/json/tests/bug77843.phpt b/ext/json/tests/bug77843.phpt new file mode 100644 index 0000000000..c525285bf5 --- /dev/null +++ b/ext/json/tests/bug77843.phpt @@ -0,0 +1,25 @@ +--TEST-- +Bug #77843: Use after free with json serializer +--FILE-- +<?php + +class X implements JsonSerializable { + public $prop = "value"; + public function jsonSerialize() { + global $arr; + unset($arr[0]); + var_dump($this); + return $this; + } +} + +$arr = [new X()]; +var_dump(json_encode([&$arr])); + +?> +--EXPECT-- +object(X)#1 (1) { + ["prop"]=> + string(5) "value" +} +string(20) "[[{"prop":"value"}]]" |