blob: c525285bf5abd89d177b3aa3146af0ee6c4b9930 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
--TEST--
Bug #77843: Use after free with json serializer
--FILE--
<?php
class X implements JsonSerializable {
public $prop = "value";
public function jsonSerialize() {
global $arr;
unset($arr[0]);
var_dump($this);
return $this;
}
}
$arr = [new X()];
var_dump(json_encode([&$arr]));
?>
--EXPECT--
object(X)#1 (1) {
["prop"]=>
string(5) "value"
}
string(20) "[[{"prop":"value"}]]"
|
