[php-src] PR #23802: Fix Potential DAN sccp.c

Pull Request: https://github.com/php/php-src/pull/23802 Author: Ti-Mis Fix: Deref After Null (Potential problem) Problem: if (ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) { op2 is obtained from get_op2_value(). Under certain conditions, when opline->op2_type != IS_CONST and ssa_op->op2_use == -1, get_op2_value() may return NULL. The subsequent SKIP_IF_TOP(op2) check appears to handle IS_TOP(op2), but does not explicitly check whether op2 is NULL. As a result, it seems possible for ct_eval_fetch_obj() to be called with a NULL op2. Inside ct_eval_fetch_obj(), op2 is subsequently passed to fetch_obj_prop(), where it may be dereferenced without a NULL check. Solution :The issue can be fixed by adding a check for the op2 variable. Signed-off-by: t.mishin@fobos-nt.ru Signed-off-by: crystarm@altlinux.org