Merge branch 'PHP-5.6'

Conflicts:
	ext/spl/spl_iterators.c

2 files changed, 50 insertions, 3 deletions

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 504065e7fd..e8fe2ce101 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -390,9 +390,11 @@ next_step:
 					}
 				}
 			}
-			zend_iterator_dtor(iterator);
-			zval_ptr_dtor(&object->iterators[object->level].zobject);
-			object->level--;
+			if (object->level > 0) {
+				zend_iterator_dtor(iterator);
+				zval_ptr_dtor(&object->iterators[object->level].zobject);
+				object->level--;
+			}
 		} else {
 			return; /* done completeley */
 		}
diff --git a/ext/spl/tests/bug69970.phpt b/ext/spl/tests/bug69970.phpt
new file mode 100644
index 0000000000..a488037b8c
--- /dev/null
+++ b/ext/spl/tests/bug69970.phpt
@@ -0,0 +1,45 @@
+--TEST--
+Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
+--FILE--
+<?php
+
+$count = 10;
+
+class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator {
+  function rewind() {
+    echo "dummy\n";
+  }
+  function endChildren() {
+	  global $count;
+	  echo $this->getDepth();
+	  if (--$count > 0) {
+		  // Trigger use-after-free
+		  parent::rewind();
+	  }
+  }
+}
+$arr = array("a", array("ba", array("bba", "bbb")));
+$obj = new RecursiveArrayIterator($arr);
+$rit = new RecursiveArrayIteratorIterator($obj);
+
+foreach ($rit as $k => $v) {
+  echo ($rit->getDepth()) . "$k=>$v\n";
+}
+?>
+--EXPECT--
+dummy
+00=>a
+00=>a
+10=>ba
+20=>bba
+21=>bbb
+21010=>ba
+20=>bba
+21=>bbb
+21010=>ba
+20=>bba
+21=>bbb
+21010=>ba
+20=>bba
+21=>bbb
+21