1--TEST-- 2GH-15205: UAF when destroying stream after pcre request shutdown 3--CREDITS-- 4nicolaslegland 5--FILE-- 6<?php 7// Prime cache 8preg_replace('/pattern/', 'replace', 'subject'); 9 10class wrapper 11{ 12 public function stream_open($path, $mode, $options, &$opened_path) 13 { 14 return true; 15 } 16 17 public function stream_close() 18 { 19 echo "Close\n"; 20 preg_replace('/pattern/', 'replace', 'subject'); 21 preg_match('/(4)?(2)?\d/', '23456', $matches, PREG_OFFSET_CAPTURE | PREG_UNMATCHED_AS_NULL); 22 preg_match('/(4)?(2)?\d/', '23456', $matches, PREG_OFFSET_CAPTURE); 23 } 24 25 public $context; 26} 27 28stream_wrapper_register('wrapper', 'wrapper'); 29$handle = fopen('wrapper://', 'rb'); 30?> 31--EXPECT-- 32Close 33
