[GIT-PULLS] [php-src] PR #23339: ext/ldap: fix crash in ldap_exop_sync() when $response_data is omitted

[email protected] (lacatoire)
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/23339
Author: lacatoire

`ldap_exop_sync()` passes `force_sync = true` to `php_ldap_exop()`, so the block that writes back `$response_data` is always entered regardless of whether the argument was supplied. When it is omitted, `retdata` is `NULL`, and both `ZEND_TRY_ASSIGN_REF_STRINGL` and `ZEND_TRY_ASSIGN_REF_EMPTY_STRING` dereference it — `ZEND_ASSERT(Z_ISREF_P(zv))` in debug builds, a NULL dereference crash in release.

`ldap_exop()` is not affected: there `retdata != NULL` is what selects the branch in the first place.

The fix mirrors the existing `if (retoid)` guard a few lines above. `ldap_memfree()` is still called unconditionally so there is no memory leak.

```php
ldap_exop_sync($ld, LDAP_EXOP_WHO_AM_I);  // segfault before, bool(true) after
```

Reproduced on PHP 8.4.22 (exit code 139). Present since `ldap_exop_sync()` was introduced in PHP 8.3.0.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.