diff options
-rw-r--r-- | ext/spl/spl_iterators.c | 8 | ||||
-rw-r--r-- | ext/spl/tests/bug69970.phpt | 45 |
2 files changed, 50 insertions, 3 deletions
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c index 504065e7fd..e8fe2ce101 100644 --- a/ext/spl/spl_iterators.c +++ b/ext/spl/spl_iterators.c @@ -390,9 +390,11 @@ next_step: } } } - zend_iterator_dtor(iterator); - zval_ptr_dtor(&object->iterators[object->level].zobject); - object->level--; + if (object->level > 0) { + zend_iterator_dtor(iterator); + zval_ptr_dtor(&object->iterators[object->level].zobject); + object->level--; + } } else { return; /* done completeley */ } diff --git a/ext/spl/tests/bug69970.phpt b/ext/spl/tests/bug69970.phpt new file mode 100644 index 0000000000..a488037b8c --- /dev/null +++ b/ext/spl/tests/bug69970.phpt @@ -0,0 +1,45 @@ +--TEST-- +Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()) +--FILE-- +<?php + +$count = 10; + +class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator { + function rewind() { + echo "dummy\n"; + } + function endChildren() { + global $count; + echo $this->getDepth(); + if (--$count > 0) { + // Trigger use-after-free + parent::rewind(); + } + } +} +$arr = array("a", array("ba", array("bba", "bbb"))); +$obj = new RecursiveArrayIterator($arr); +$rit = new RecursiveArrayIteratorIterator($obj); + +foreach ($rit as $k => $v) { + echo ($rit->getDepth()) . "$k=>$v\n"; +} +?> +--EXPECT-- +dummy +00=>a +00=>a +10=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21 |