1--TEST-- 2Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()) 3--FILE-- 4<?php 5 6$count = 10; 7 8class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator { 9 function rewind(): void { 10 echo "dummy\n"; 11 } 12 function endChildren(): void { 13 global $count; 14 echo $this->getDepth(); 15 if (--$count > 0) { 16 // Trigger use-after-free 17 parent::rewind(); 18 } 19 } 20} 21$arr = array("a", array("ba", array("bba", "bbb"))); 22$obj = new RecursiveArrayIterator($arr); 23$rit = new RecursiveArrayIteratorIterator($obj); 24 25foreach ($rit as $k => $v) { 26 echo ($rit->getDepth()) . "$k=>$v\n"; 27} 28?> 29--EXPECT-- 30dummy 3100=>a 3200=>a 3310=>ba 3420=>bba 3521=>bbb 3621010=>ba 3720=>bba 3821=>bbb 3921010=>ba 4020=>bba 4121=>bbb 4221010=>ba 4320=>bba 4421=>bbb 4521 46
