[php-src] PR #23339: ext/ldap: fix crash in ldap_exop_sync() when $response_data is omitted
| From: | lacatoire | Date: | Mon, 17 Aug 2026 20:46:34 +0000 |
| Subject: | [php-src] PR #23339: ext/ldap: fix crash in ldap_exop_sync() when $response_data is omitted | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37955@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23339
Author: lacatoire
ldap_exop_sync() passes force_sync = true to php_ldap_exop(),
so the block that writes back $response_data is always entered regardless of whether
the argument was supplied. When it is omitted, retdata is NULL, and both
ZEND_TRY_ASSIGN_REF_STRINGL and ZEND_TRY_ASSIGN_REF_EMPTY_STRING
dereference it — ZEND_ASSERT(Z_ISREF_P(zv)) in debug builds, a NULL dereference crash
in release.
ldap_exop() is not affected: there retdata != NULL is what selects the
branch in the first place.
The fix mirrors the existing if (retoid) guard a few lines above.
ldap_memfree() is still called unconditionally so there is no memory leak.
```php
ldap_exop_sync($ld, LDAP_EXOP_WHO_AM_I); // segfault before, bool(true) after
```
Reproduced on PHP 8.4.22 (exit code 139). Present since ldap_exop_sync() was introduced
in PHP 8.3.0.