_ZendTestClass::test() segfaults on named parameter

[YuanchengJiang]

Description

The following code:

<?php
$a = new _ZendTestClass();
$fusion = $a;
var_dump($fusion->test('a', 'b', c: 'c'));

Resulted in this output:

/php-src/Zend/zend_execute.c:5308:40: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/Zend/zend_execute.c:5308:40

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[cmb69]

Possible fix:

 Zend/zend_execute.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index b0c4908d10..c66cc68731 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -5306,6 +5306,9 @@ static zend_always_inline uint32_t zend_get_arg_offset_by_name(
 	} else {
 		for (uint32_t i = 0; i < num_args; i++) {
 			zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
+			if (arg_info == NULL) {
+				return (uint32_t) -1;
+			}
 			size_t len = strlen(arg_info->name);
 			if (zend_string_equals_cstr(arg_name, arg_info->name, len)) {
 				*cache_slot = fbc;

That might only cure the symptoms, although the output doesn't look bad:

Fatal error: Uncaught Error: Unknown named parameter $c in C:\php-sdk\phpdev\vs17\x64\gh16266.php:4

[ndossche]

@cmb69 that's UB because you're doing address computations on NULL. This shouldn't be NULL in the first place.