xref: /PHP-8.3/ext/spl/tests/bug69970.phpt (revision b3e08881)
1--TEST--
2Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
3--FILE--
4<?php
5
6$count = 10;
7
8class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator {
9  function rewind(): void {
10    echo "dummy\n";
11  }
12  function endChildren(): void {
13      global $count;
14      echo $this->getDepth();
15      if (--$count > 0) {
16          // Trigger use-after-free
17          parent::rewind();
18      }
19  }
20}
21$arr = array("a", array("ba", array("bba", "bbb")));
22$obj = new RecursiveArrayIterator($arr);
23$rit = new RecursiveArrayIteratorIterator($obj);
24
25foreach ($rit as $k => $v) {
26  echo ($rit->getDepth()) . "$k=>$v\n";
27}
28?>
29--EXPECT--
30dummy
3100=>a
3200=>a
3310=>ba
3420=>bba
3521=>bbb
3621010=>ba
3720=>bba
3821=>bbb
3921010=>ba
4020=>bba
4121=>bbb
4221010=>ba
4320=>bba
4421=>bbb
4521
46