xref: /PHP-8.3/ext/spl/tests/bug81992.phpt (revision b71c6b2c) 
1--TEST--
2Bug #81992 (SplFixedArray::setSize() causes use-after-free)
3--FILE--
4<?php
5class InvalidDestructor {
6    public function __destruct() {
7        global $obj;
8        var_dump($obj[0]);
9        try {
10            var_dump($obj[2]);
11        } catch (Throwable $e) {
12            echo $e->getMessage(), "\n";
13        }
14        try {
15            var_dump($obj[4]);
16        } catch (Throwable $e) {
17            echo $e->getMessage(), "\n";
18        }
19    }
20}
21
22$obj = new SplFixedArray(5);
23$obj[0] = str_repeat("A", 10);
24$obj[2] = str_repeat('B', 10);
25$obj[3] = new InvalidDestructor();
26$obj[4] = str_repeat('C', 10);
27$obj->setSize(2);
28?>
29--EXPECT--
30string(10) "AAAAAAAAAA"
31Index invalid or out of range
32Index invalid or out of range
33