[php-src] Issue #22208: NULL-dereference in `zend_ini_bool_literal()` for non-existent INIs (PHP 8.6)

[email protected] (TimWolla) Tue, 2 Jun 2026 09:06:37 +0000
Newsgroups php.bugs
Message-ID <h8LdRS6x1MMVd3xxq4c53QhyQXW9WpAtqW4QL0LKwdU@main.internal.php.net>
Issue: https://github.com/php/php-src/issues/22208
Author: TimWolla

### Description

The following code:

```php
zend_ini_bool_literal("foo.bar");
```

Resulted in this output:
```
==261505==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x5f6a28ea3b2d bp 0x7ffd029ba6d0 sp 0x7ffd029ba620 T0)
==261505==The signal is caused by a READ memory access.
==261505==Hint: address points to the zero page.
    #0 0x5f6a28ea3b2d in zend_ini_parse_bool php-src/Zend/zend_ini.c:564:6
    #1 0x5f6a29170595 in do_cli php-src/sapi/cli/php_cli.c:947:5
    #2 0x5f6a2916bf72 in main php-src/sapi/cli/php_cli.c:1371:18
    #3 0x79207e62a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #4 0x79207e62a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #5 0x5f6a24e03464 in _start (php-src/sapi/cli/php+0x2403464) (BuildId: 68af09040147df10bc018a327f06f70858e79a7f)
```

But I expected this output instead:
```
false
```

This is a regression from the old `INI_BOOL()` which safely returned `false` for non-existent INIs and also inconsistent with `zend_ini_long_literal()` which safely returns `0` without crashing.

The macro was introduced in #21146.

### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: Jun  2 2026 11:01:01) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce
```

### Operating System

_No response_