[GIT-PULLS] [php-src] PR #23339: ext/ldap: fix crash in ldap_exop_sync() when $response_data is omitted
[email protected] (lacatoire)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23339 Author: lacatoire `ldap_exop_sync()` passes `force_sync = true` to `php_ldap_exop()`, so the block that writes back `$response_data` is always entered regardless of whether the argument was supplied. When it is omitted, `retdata` is `NULL`, and both `ZEND_TRY_ASSIGN_REF_STRINGL` and `ZEND_TRY_ASSIGN_REF_EMPTY_STRING` dereference it — `ZEND_ASSERT(Z_ISREF_P(zv))` in debug builds, a NULL dereference crash in release. `ldap_exop()` is not affected: there `retdata != NULL` is what selects the branch in the first place. The fix mirrors the existing `if (retoid)` guard a few lines above. `ldap_memfree()` is still called unconditionally so there is no memory leak. ```php ldap_exop_sync($ld, LDAP_EXOP_WHO_AM_I); // segfault before, bool(true) after ``` Reproduced on PHP 8.4.22 (exit code 139). Present since `ldap_exop_sync()` was introduced in PHP 8.3.0.