mirror of
https://github.com/php/php-src.git
synced 2026-03-24 08:12:21 +01:00
2d6684091f
We address the `::setSize(0)` case by setting `array->element = NULL` and `array->size = 0` before we destroy the elements. Co-authored-by: Tyson Andre <tyson.andre@uwaterloo.ca> Closes GH-7503.
16 lines
300 B
PHP
16 lines
300 B
PHP
--TEST--
|
|
Bug #80663 (Recursive SplFixedArray::setSize() may cause double-free)
|
|
--FILE--
|
|
<?php
|
|
class InvalidDestructor {
|
|
public function __destruct() {
|
|
$GLOBALS['obj']->setSize(0);
|
|
}
|
|
}
|
|
|
|
$obj = new SplFixedArray(1000);
|
|
$obj[0] = new InvalidDestructor();
|
|
$obj->setSize(0);
|
|
?>
|
|
--EXPECT--
|