blob: dbcb024c2681f547b9c0f142707ef722b89bfd34 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
--TEST--
Bug #77843: Use after free with json serializer
--SKIPIF--
<?php if(!extension_loaded('json')) die('skip json extension not loaded') ?>
--FILE--
<?php
class X implements JsonSerializable {
public $prop = "value";
public function jsonSerialize() {
global $arr;
unset($arr[0]);
var_dump($this);
return $this;
}
}
$arr = [new X()];
var_dump(json_encode([&$arr]));
?>
--EXPECT--
object(X)#1 (1) {
["prop"]=>
string(5) "value"
}
string(20) "[[{"prop":"value"}]]"
|
