[php-src] Issue #22490: Null pointer dereference in zend_hash_index_find_ptr

[email protected] (iany0) Sat, 27 Jun 2026 17:24:49 +0000
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22490
Author: iany0

### Description

The following code:

```php
<?(0|>0instanceof	u)->g??=(0)[0]([d()]instanceof	u)[(0)];
```

Resulted in this output:

```plain
Running LLVMFuzzerInitialize ...
continue...
AddressSanitizer:DEADLYSIGNAL
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
The signal is caused by a READ memory access.
Hint: address points to the zero page.

SUMMARY: AddressSanitizer: SEGV Zend/zend_hash.h:946:3 in zend_hash_index_find_ptr
```

This reproduces with `php-fuzz-parser` built with ASAN.


### Commit

```plain
5ff2a95341a692a86646292317d61c63c96d5ca4
```

### PHP Version

```plain
PHP 8.6.0-dev
```

### Operating System

_No response_