php-src/Zend/tests/magic_get_destroy_object.phpt
Nikita Popov 6381a16f3f Avoid use after free in internal prop type verification
This issue only applies to debug builds: read_property can free
the object, but we'd try to check the object handlers afterwards.
Rewrite the check in a way that only accessed the object before
the read_property call.

Fixes oss-fuzz #38297.
2021-09-09 15:30:32 +02:00

15 lines
190 B
PHP

--TEST--
Destroy object in magic __get()
--FILE--
<?php
class Test {
function __get($name) {
$GLOBALS["x"] = null;
}
}
$x = new Test;
var_dump($x->prop);
?>
--EXPECT--
NULL