blob: a488037b8cf958bdda1f3bdccccb8794a4015690 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
--TEST--
Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
--FILE--
<?php
$count = 10;
class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator {
function rewind() {
echo "dummy\n";
}
function endChildren() {
global $count;
echo $this->getDepth();
if (--$count > 0) {
// Trigger use-after-free
parent::rewind();
}
}
}
$arr = array("a", array("ba", array("bba", "bbb")));
$obj = new RecursiveArrayIterator($arr);
$rit = new RecursiveArrayIteratorIterator($obj);
foreach ($rit as $k => $v) {
echo ($rit->getDepth()) . "$k=>$v\n";
}
?>
--EXPECT--
dummy
00=>a
00=>a
10=>ba
20=>bba
21=>bbb
21010=>ba
20=>bba
21=>bbb
21010=>ba
20=>bba
21=>bbb
21010=>ba
20=>bba
21=>bbb
21
|
