From e41f600365fe9f27727a62a850a4d55416ae856f Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Tue, 7 Jul 2015 21:25:28 +0800
Subject: Fixed bug #69970 (Use-after-free vulnerability in
 spl_recursive_it_move_forward_ex())

---
 NEWS                        |  4 ++++
 ext/spl/spl_iterators.c     |  8 +++++---
 ext/spl/tests/bug69970.phpt | 45 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+), 3 deletions(-)
 create mode 100644 ext/spl/tests/bug69970.phpt

diff --git a/NEWS b/NEWS
index f965742a71..963a3f1ce0 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,10 @@ PHP                                                                        NEWS
   . Fixed bug #69882 (OpenSSL error “key values mismatch” after 
     openssl_pkcs12_read with extra cert) (Tomasz Sawicki)
 
+- SPL:
+  . Fixed bug #69970 (Use-after-free vulnerability in
+    spl_recursive_it_move_forward_ex()). (Laruence)
+
 09 Jul 2015, PHP 5.6.11
 
 - Core:
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 8588c7a038..359d94d6ed 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -380,9 +380,11 @@ next_step:
 					}
 				}
 			}
-			iterator->funcs->dtor(iterator TSRMLS_CC);
-			zval_ptr_dtor(&object->iterators[object->level].zobject);
-			object->level--;
+			if (object->level > 0) {
+				iterator->funcs->dtor(iterator TSRMLS_CC);
+				zval_ptr_dtor(&object->iterators[object->level].zobject);
+				object->level--;
+			}
 		} else {
 			return; /* done completeley */
 		}
diff --git a/ext/spl/tests/bug69970.phpt b/ext/spl/tests/bug69970.phpt
new file mode 100644
index 0000000000..a488037b8c
--- /dev/null
+++ b/ext/spl/tests/bug69970.phpt
@@ -0,0 +1,45 @@
+--TEST--
+Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
+--FILE--
+<?php
+
+$count = 10;
+
+class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator {
+  function rewind() {
+    echo "dummy\n";
+  }
+  function endChildren() {
+	  global $count;
+	  echo $this->getDepth();
+	  if (--$count > 0) {
+		  // Trigger use-after-free
+		  parent::rewind();
+	  }
+  }
+}
+$arr = array("a", array("ba", array("bba", "bbb")));
+$obj = new RecursiveArrayIterator($arr);
+$rit = new RecursiveArrayIteratorIterator($obj);
+
+foreach ($rit as $k => $v) {
+  echo ($rit->getDepth()) . "$k=>$v\n";
+}
+?>
+--EXPECT--
+dummy
+00=>a
+00=>a
+10=>ba
+20=>bba
+21=>bbb
+21010=>ba
+20=>bba
+21=>bbb
+21010=>ba
+20=>bba
+21=>bbb
+21010=>ba
+20=>bba
+21=>bbb
+21
-- 
cgit v1.2.1