Potential NULL dereference in sccp.c

[Ti-Mis]

Description

Potential problem

Hi!

I was analyzing the source code and came across a potential issue in Zend/Optimizer/sccp.c.

In the following line:

if (ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) {

op2 is obtained using get_op2_value(). If opline->op2_type != IS_CONST and ssa_op->op2_use == -1, this function may return NULL.

At the same time, the SKIP_IF_TOP(op2) macro appears to check for the IS_TOP(op2) state, but does not explicitly check whether op2 is NULL. As a result, it seems possible that ct_eval_fetch_obj() could be called with op2 == NULL.

Inside ct_eval_fetch_obj(), op2 is passed to fetch_obj_prop(), where it appears to be dereferenced without a prior NULL check.

Could you please check whether it is guaranteed that op2 is always non-NULL at this point?

I would appreciate it if you could verify this scenario.

Found with SVACE

PHP Version

PHP 8.3.24

Operating System

Ubuntu 24.04

[Ti-Mis]

#23802

[ndossche]

Some opcodes have an operand nr 2 (op2) and some don't. I guess your tool got confused when it compared the code it marked against some of the other code.
The case you're looking at is ZEND_ASSIGN_OBJ_OP, but look at the definition of the VM handler of this opcode: it always has op2 defined:

php-src/Zend/zend_vm_def.h

Line 1007 in 5d24c8b

ZEND_VM_HANDLER(28, ZEND_ASSIGN_OBJ_OP, VAR|UNUSED|THIS|CV, CONST|TMP|CV, OP)

Compare that to e.g. ZEND_ASSIGN_DIM_OP, which doesn't always have op2 defined:

php-src/Zend/zend_vm_def.h

Line 1155 in 5d24c8b

ZEND_VM_HANDLER(27, ZEND_ASSIGN_DIM_OP, VAR|CV, CONST|TMP|UNUSED|NEXT|CV, OP)

(note the UNUSED in the second position)

So this is a false positive report.