xref: /PHP-8.3/ext/spl/tests/bug81992b.phpt (revision b71c6b2c)
1--TEST--
2Bug #81992 (SplFixedArray::setSize() causes use-after-free) - setSize variation
3--FILE--
4<?php
5class InvalidDestructor {
6    public function __construct(
7        private int $desiredSize,
8        private SplFixedArray $obj,
9    ) {}
10
11    public function __destruct() {
12        echo "In destructor\n";
13        $this->obj->setSize($this->desiredSize);
14        echo "Destroyed, size is now still ", $this->obj->getSize(), "\n";
15    }
16}
17
18class DestructorLogger {
19    public function __construct(private int $id) {}
20
21    public function __destruct() {
22        echo "Destroyed the logger with id ", $this->id, "\n";
23    }
24}
25
26function test(int $desiredSize) {
27    $obj = new SplFixedArray(5);
28    $obj[0] = str_repeat("A", 10);
29    $obj[1] = new DestructorLogger(1);
30    $obj[2] = str_repeat('B', 10);
31    $obj[3] = new InvalidDestructor($desiredSize, $obj);
32    $obj[4] = new DestructorLogger(4);
33    $obj->setSize(2);
34    echo "Size is now ", $obj->getSize(), "\n";
35    echo "Done\n";
36}
37
38echo "--- Smaller size test ---\n";
39test(1);
40echo "--- Equal size test ---\n";
41test(2);
42echo "--- Larger size test ---\n";
43test(10);
44?>
45--EXPECT--
46--- Smaller size test ---
47In destructor
48Destroyed, size is now still 2
49Destroyed the logger with id 4
50Destroyed the logger with id 1
51Size is now 1
52Done
53--- Equal size test ---
54In destructor
55Destroyed, size is now still 2
56Destroyed the logger with id 4
57Size is now 2
58Done
59Destroyed the logger with id 1
60--- Larger size test ---
61In destructor
62Destroyed, size is now still 2
63Destroyed the logger with id 4
64Size is now 10
65Done
66Destroyed the logger with id 1
67