[php-src] Issue #24121: Possible dereference of NULL pointer at `ext/standard/var.c`

From: Date: Sun, 04 Oct 2026 17:51:18 +0000
Subject: [php-src] Issue #24121: Possible dereference of NULL pointer at `ext/standard/var.c`
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-252903@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/24121 Author: M0T1VaTeD ### Description ## Description At ext/standard/var.c:1010 macros ZEND_HASH_FOREACH_KEY_VAL_IND initiates a cycle, in every iteration of which pointer key is provided. At ext/standard/var.c:1016 there is a check if(!key), which implies, that key pointer is not guaranteed to not be a NULL. However, right before this check, at ext/standard/var.c:1011 we [dereference](https://github.com/php/php-src/blob/master/ext/standard/var.c#L1011) key pointer by calling zend_string_equals_literal(key, MAGIC_MEMBER) without any additional check. ## Possible solution Adjusting a condition may prevent any unexpected behaviors: ``` if (key && incomplete_class && zend_string_equals_literal(key, MAGIC_MEMBER)) { incomplete_class = false; continue; } ``` Found by Linux Verification Center (https://portal.linuxtesting.ru/) using SVACE. Author D. Meliksetyan. ### PHP Version ```plain 8.3.31 (found with static analysis) ``` ### Operating System N/A

« previous php.bugs (#252903) next »