File: bug71859.phpt

package info (click to toggle)
php8.4 8.4.16-1
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid
  • size: 211,276 kB
  • sloc: ansic: 1,176,142; php: 35,419; sh: 11,964; cpp: 7,208; pascal: 4,951; javascript: 3,091; asm: 2,817; yacc: 2,411; makefile: 696; xml: 446; python: 301; awk: 148
file content (29 lines) | stat: -rw-r--r-- 818 bytes parent folder | download | duplicates (3)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
--TEST--
Bug #71859 (zend_objects_store_call_destructors operates on realloced memory, crashing)
--FILE--
<?php
class constructs_in_destructor {
  public $a;
  public function __destruct() {
    //We are now in zend_objects_store_call_destructors
    //This causes a realloc in zend_objects_store_put
    for ($i = 0; $i < 10000; ++$i) {
      $GLOBALS["a$i"] = new stdClass;
    }
    //Returns to zend_objects_store_call_destructors, to access freed memory.
  }
}

$a = new constructs_in_destructor;
//Create cycle so destructors are ran only in zend_objects_store_call_destructors
$a->a = $a;

// Create some objects so zend_objects_store_call_destructors has something
// to do after constructs_in_destructor is destroyed.
for ($i = 0; $i < 200; ++$i) {
  $GLOBALS["b$i"] = new stdClass;
}
?>
okey
--EXPECT--
okey