1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Files
archived-php-src/ext/standard/tests/array/gh16649/array_splice_with_replacement.phpt
Alexandre Daubois c8774f9e61 Fix GH-16649: Avoid UAF when using array_splice
Closes GH-19399
2025-08-13 14:15:34 +02:00

24 lines
550 B
PHP

--TEST--
GH-16649: array_splice with replacement array when destructor modifies array
--FILE--
<?php
class C {
function __destruct() {
global $arr;
$arr["modified"] = "by_destructor";
}
}
$arr = ["a", new C, "b"];
$replacement = ["replacement1", "replacement2"];
try {
array_splice($arr, 1, 1, $replacement);
echo "ERROR: Should have thrown exception\n";
} catch (Error $e) {
echo "Exception caught: " . $e->getMessage() . "\n";
}
?>
--EXPECT--
Exception caught: Array was modified during array_splice operation