mirror of
https://github.com/php/php-src.git
synced 2024-12-18 06:21:41 +08:00
28 lines
459 B
Plaintext
28 lines
459 B
Plaintext
|
--TEST--
|
||
|
|
is_callable() with trampoline should not caused UAF
|
||
|
|
--FILE--
|
||
|
|
<?php
|
||
|
|
|
||
|
|
class B {}
|
||
|
|
class A extends B {
|
||
|
|
public function bar($func) {
|
||
|
|
var_dump(is_callable(array('parent', 'foo')));
|
||
|
|
}
|
||
|
|
|
||
|
|
public function __call($func, $args) {
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
class X {
|
||
|
|
public static function __callStatic($func, $args) {
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
$a = new A();
|
||
|
|
// Extra X::foo() wrapper to force use of allocated trampoline.
|
||
|
|
X::foo($a->bar('foo'));
|
||
|
|
|
||
|
|
?>
|
||
|
|
--EXPECT--
|
||
|
|
bool(false)
|