Possible dereference of NULL pointer at `ext/standard/var.c`

[M0T1VaTeD]

Description

At ext/standard/var.c:1010 macros ZEND_HASH_FOREACH_KEY_VAL_IND initiates a cycle, in every iteration of which pointer key is provided.

At ext/standard/var.c:1016 there is a check if(!key), which implies, that key pointer is not guaranteed to not be a NULL. However, right before this check, at ext/standard/var.c:1011 we dereference key pointer by calling zend_string_equals_literal(key, MAGIC_MEMBER) without any additional check.

Possible solution

Adjusting a condition may prevent any unexpected behaviors:

if (key && incomplete_class && zend_string_equals_literal(key, MAGIC_MEMBER)) {
				incomplete_class = false;
				continue;
			}

Found by Linux Verification Center (https://portal.linuxtesting.ru/) using SVACE.
Author D. Meliksetyan.

PHP Version

8.3.31 (found with static analysis)

Operating System

N/A

[M0T1VaTeD]

#24122

[devnexen]

Hi and thanks for your report, however what the static analysis missed is when incomplete_class is true the hashtable is then a property table and key is then a (proper) zend_string.