mirror of
https://github.com/php/php-src.git
synced 2024-09-23 02:47:26 +00:00
db9776c53c
Make sure we also NULL out next/prev of the removed element on pop/shift. This only matter is that element is still being referenced by an iterator.
28 lines
567 B
PHP
28 lines
567 B
PHP
--TEST--
|
|
Bug #79151: heap use after free caused by spl_dllist_it_helper_move_forward
|
|
--FILE--
|
|
<?php
|
|
|
|
$a = new SplDoublyLinkedList();
|
|
$a->setIteratorMode(SplDoublyLinkedList::IT_MODE_LIFO | SplDoublyLinkedList::IT_MODE_DELETE);
|
|
$a->push(1);
|
|
$a->rewind();
|
|
$a->unshift(2);
|
|
var_dump($a->pop());
|
|
var_dump($a->next());
|
|
|
|
$a = new SplDoublyLinkedList();
|
|
$a->setIteratorMode(SplDoublyLinkedList::IT_MODE_FIFO | SplDoublyLinkedList::IT_MODE_DELETE);
|
|
$a->unshift(1);
|
|
$a->rewind();
|
|
$a->push(2);
|
|
var_dump($a->shift());
|
|
var_dump($a->next());
|
|
|
|
?>
|
|
--EXPECT--
|
|
int(1)
|
|
NULL
|
|
int(1)
|
|
NULL
|