1--TEST-- 2Bug #70713: Use After Free Vulnerability in array_walk()/array_walk_recursive() 3--FILE-- 4<?php 5 6class obj 7{ 8 function __tostring() 9 { 10 global $arr; 11 12 $arr = 1; 13 for ($i = 0; $i < 5; $i++) { 14 $v[$i] = 'hi'.$i; 15 } 16 17 return 'hi'; 18 } 19} 20 21$arr = array('string' => new obj); 22 23try { 24 array_walk_recursive($arr, 'settype'); 25} catch (\TypeError $e) { 26 echo $e->getMessage() . "\n"; 27} 28 29?> 30--EXPECT-- 31Iterated value is no longer an array or object 32
