1--TEST-- 2Bug #70713: Use After Free Vulnerability in array_walk()/array_walk_recursive() 3--FILE-- 4<?php 5 6class obj 7{ 8 function __tostring() 9 { 10 global $arr; 11 12 $arr = 1; 13 for ($i = 0; $i < 5; $i++) { 14 $v[$i] = 'hi'.$i; 15 } 16 17 return 'hi'; 18 } 19} 20 21$arr = array('string' => new obj); 22array_walk_recursive($arr, 'settype'); 23 24?> 25--EXPECTF-- 26Warning: array_walk_recursive(): Iterated value is no longer an array or object in %s on line %d 27
