Description:
------------
The root cause of this bug is similar to bug #80663.
There is a problem when __destruct called in the middle of SplFixedArray resizing. There is no check that size of internal storage was changed.
In function static void spl_fixedarray_resize(spl_fixedarray *array, zend_long size) the case when size = 0 was fixed in #80663, but similar case when size < array->size was not fixed. It causes use-after-free.
The bug can be triggered locally, or remotely, for example using unserialize(), and cause code execution.

The bug exists in PHP versions from End of life 7.4.* to latest 8.2.*

Test script:
---------------
<?php
class InvalidDestructor {
    public function __destruct() {
        global $obj;
        $a = str_repeat('A', 100);
        var_dump($obj[2]);
    }
}

$obj = new SplFixedArray(5);
$obj[2] = str_repeat('B', 100);
$obj[3] = new InvalidDestructor();
$obj->setSize(2);


Expected result:
----------------
string(100) "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"

Actual result:
--------------
string(100) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"