bug69970.phpt 783 B

123456789101112131415161718192021222324252627282930313233343536373839404142434445
  1. --TEST--
  2. Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
  3. --FILE--
  4. <?php
  5. $count = 10;
  6. class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator {
  7. function rewind(): void {
  8. echo "dummy\n";
  9. }
  10. function endChildren(): void {
  11. global $count;
  12. echo $this->getDepth();
  13. if (--$count > 0) {
  14. // Trigger use-after-free
  15. parent::rewind();
  16. }
  17. }
  18. }
  19. $arr = array("a", array("ba", array("bba", "bbb")));
  20. $obj = new RecursiveArrayIterator($arr);
  21. $rit = new RecursiveArrayIteratorIterator($obj);
  22. foreach ($rit as $k => $v) {
  23. echo ($rit->getDepth()) . "$k=>$v\n";
  24. }
  25. ?>
  26. --EXPECT--
  27. dummy
  28. 00=>a
  29. 00=>a
  30. 10=>ba
  31. 20=>bba
  32. 21=>bbb
  33. 21010=>ba
  34. 20=>bba
  35. 21=>bbb
  36. 21010=>ba
  37. 20=>bba
  38. 21=>bbb
  39. 21010=>ba
  40. 20=>bba
  41. 21=>bbb
  42. 21