30 lines
524 B
PHP
30 lines
524 B
PHP
--TEST--
|
|
GH-16464: Use-after-free in SplDoublyLinkedList::offsetSet() when modifying list in destructor of overwritten object
|
|
--FILE--
|
|
<?php
|
|
|
|
class C {
|
|
public $a;
|
|
|
|
function __destruct() {
|
|
global $list;
|
|
var_dump($list->pop());
|
|
}
|
|
}
|
|
|
|
$list = new SplDoublyLinkedList;
|
|
$list->add(0, new C);
|
|
$list[0] = 42;
|
|
var_dump($list);
|
|
|
|
?>
|
|
--EXPECTF--
|
|
int(42)
|
|
object(SplDoublyLinkedList)#%d (2) {
|
|
["flags":"SplDoublyLinkedList":private]=>
|
|
int(0)
|
|
["dllist":"SplDoublyLinkedList":private]=>
|
|
array(0) {
|
|
}
|
|
}
|