1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
--TEST--
Bug #70124 (null ptr deref / seg fault in ZEND_HANDLE_EXCEPTION_SPEC_HANDLER)
--FILE--
<?php
try {
echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),$f("test"))],chr(48));
} catch (Error $e) {
var_dump($e->getMessage());
}
class A {
}
try {
echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),a::y("test"))],chr(48));
} catch (Error $e) {
var_dump($e->getMessage());
}
$a = new A;
try {
echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),$a->y("test"))],chr(48));
} catch (Error $e) {
var_dump($e->getMessage());
}
try {
echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),\bar\y("test"))],chr(48));
} catch (Error $e) {
var_dump($e->getMessage());
}
try {
echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),y("test"))],chr(48));
} catch (Error $e) {
var_dump($e->getMessage());
}
?>
--EXPECTF--
Notice: Undefined variable: f in %sbug70124.php on line %d
string(30) "Function name must be a string"
string(31) "Call to undefined method A::y()"
string(31) "Call to undefined method A::y()"
string(34) "Call to undefined function bar\y()"
string(30) "Call to undefined function y()"
|
