From 87003249c8a6089a34986e81287b3a95fff38a94 Mon Sep 17 00:00:00 2001 From: Mi Date: Sun, 20 Sep 2026 19:19:26 +0300 Subject: [PATCH] Fix Potential DAN sccp.c Fix: Deref After Null (Potential problem) Problem: if (ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) { op2 is obtained from get_op2_value(). Under certain conditions, when opline->op2_type != IS_CONST and ssa_op->op2_use == -1, get_op2_value() may return NULL. The subsequent SKIP_IF_TOP(op2) check appears to handle IS_TOP(op2), but does not explicitly check whether op2 is NULL. As a result, it seems possible for ct_eval_fetch_obj() to be called with a NULL op2. Inside ct_eval_fetch_obj(), op2 is subsequently passed to fetch_obj_prop(), where it may be dereferenced without a NULL check. Solution :The issue can be fixed by adding a check for the op2 variable. Signed-off-by: t.mishin@fobos-nt.ru Signed-off-by: crystarm@altlinux.org --- Zend/Optimizer/sccp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Zend/Optimizer/sccp.c b/Zend/Optimizer/sccp.c index 72ba6d98888e..ece8407d455f 100644 --- a/Zend/Optimizer/sccp.c +++ b/Zend/Optimizer/sccp.c @@ -1346,7 +1346,7 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o SKIP_IF_TOP(data); - if (ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) { + if (op2 && ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) { if (IS_BOT(data)) { dup_partial_object(&zv, op1); ct_eval_del_obj_prop(&zv, op2);