bug70713.phpt 506 B

12345678910111213141516171819202122232425262728293031
  1. --TEST--
  2. Bug #70713: Use After Free Vulnerability in array_walk()/array_walk_recursive()
  3. --FILE--
  4. <?php
  5. class obj
  6. {
  7. function __tostring()
  8. {
  9. global $arr;
  10. $arr = 1;
  11. for ($i = 0; $i < 5; $i++) {
  12. $v[$i] = 'hi'.$i;
  13. }
  14. return 'hi';
  15. }
  16. }
  17. $arr = array('string' => new obj);
  18. try {
  19. array_walk_recursive($arr, 'settype');
  20. } catch (\TypeError $e) {
  21. echo $e->getMessage() . "\n";
  22. }
  23. ?>
  24. --EXPECT--
  25. Iterated value is no longer an array or object