Assertion failure in ext/ldap/ldap.c:2718

[YuanchengJiang]

Description

The following code:

<?php
$magicFile = __DIR__ . DIRECTORY_SEPARATOR . 'magic';
$fusion = $magicFile;
$ldap = ldap_connect('ldap://127.0.0.1:3333');
$modification_attrib_reference_string = [
[
"attrib"  => &$fusion,
"modtype" => LDAP_MODIFY_BATCH_ADD,
"values"  => ["value1"],
],
];
try {
var_dump(ldap_modify_batch($ldap, $valid_dn, $modification_attrib_reference_string));
} catch (Throwable $e) {
}

/php-src/ext/ldap/ldap.c:2718: void zif_ldap_modify_batch(zend_execute_data *, zval *): Assertion `zval_get_type(&(*(attrib_zv))) == 6' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

Looks like it's almost exactly testing

php-src/ext/ldap/tests/ldap_modify_batch_modifications_with_references.phpt

Lines 23 to 34 in 8953348

	$modification_attrib_reference_string = [
	[
	"attrib" => &$attrib,
	"modtype" => LDAP_MODIFY_BATCH_ADD,
	"values" => ["value1"],
	],
	];
	try {
	var_dump(ldap_modify_batch($ldap, $valid_dn, $modification_attrib_reference_string));
	} catch (Throwable $e) {
	echo $e::class, ': ', $e->getMessage(), PHP_EOL;
	}

but clearly something is different because I can indeed reproduce this.

[nielsdos]

Oh right because it fails earlier due to the NUL bytes, duh...