blob: 2410864410ab457ff5d89de059d8508a3f0ffb7f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
--TEST--
is_callable() with trampoline should not caused UAF
--FILE--
<?php
class B {}
class A extends B {
public function bar($func) {
var_dump(is_callable(array('parent', 'foo')));
}
public function __call($func, $args) {
}
}
class X {
public static function __callStatic($func, $args) {
}
}
$a = new A();
// Extra X::foo() wrapper to force use of allocated trampoline.
X::foo($a->bar('foo'));
?>
--EXPECT--
bool(false)
|
