[php-src] Issue #24121: Possible dereference of NULL pointer at `ext/standard/var.c`
| From: | M0T1VaTeD | Date: | Sun, 04 Oct 2026 17:51:18 +0000 |
| Subject: | [php-src] Issue #24121: Possible dereference of NULL pointer at `ext/standard/var.c` | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-252903@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24121
Author: M0T1VaTeD
### Description
## Description
At
ext/standard/var.c:1010 macros ZEND_HASH_FOREACH_KEY_VAL_IND initiates a cycle, in
every iteration of which pointer key is provided.
At ext/standard/var.c:1016 there is a check if(!key), which implies, that
key pointer is not guaranteed to not be a NULL. However, right before this check, at
ext/standard/var.c:1011 we
[dereference](https://github.com/php/php-src/blob/master/ext/standard/var.c#L1011) key
pointer by calling zend_string_equals_literal(key, MAGIC_MEMBER) without any additional
check.
## Possible solution
Adjusting a condition may prevent any unexpected behaviors:
```
if (key && incomplete_class && zend_string_equals_literal(key, MAGIC_MEMBER)) {
incomplete_class = false;
continue;
}
```
Found by Linux Verification Center (https://portal.linuxtesting.ru/) using SVACE.
Author D. Meliksetyan.
### PHP Version
```plain
8.3.31 (found with static analysis)
```
### Operating System
N/A