[php-src] Issue #24193: Potential NULL pointer dereference in sccp_visit_instr(sccp.c)

Issue: https://github.com/php/php-src/issues/24193 Author: Ti-Mis ### Description Hi, It seemed to me that a null dereference could potentially occur [here](https://github.com/php/php-src/blob/b527e1b34ee97f4ea402e36a641509af7436759d/Zend/Optimizer/sccp.c#L1372). A NULL pointer dereference can occur in sccp_visit_instr() when processing ZEND_ASSIGN_OBJ_OP. The op2 operand is obtained from get_op2_value(), which can return NULL when opline->op2_type is not IS_CONST and ssa_op->op2_use == -1. The ZEND_ASSIGN_OBJ_OP path checks op2 before SKIP_IF_TOP(op2), but does not check it before passing it to ct_eval_fetch_obj(): if (op2) { SKIP_IF_TOP(op2); } if (ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) { When op2 is NULL, it is passed to ct_eval_fetch_obj(). The function subsequently calls fetch_obj_prop(), where Z_TYPE_P(op2) dereferences the NULL pointer. This can result in a NULL pointer dereference. Proposed solution Check that op2 is non-NULL before calling ct_eval_fetch_obj(). ### PHP Version ```plain PHP 8.3.31 (CLI) ``` ### Operating System Ubuntu 24.04