Fix GH-15661: Access null pointer in Zend/Optimizer/zend_inference.c

[nielsdos]

No description provided.

[dstogov]

Do you have a test case?

There is one more ssa_op usage in zend_may_throw_ex(). It probably should be fixed as well.

[nielsdos]

Do you have a test case?

Added now, sorry for delay, real life got busy.
The issue title may be a bit confusing, it's pointer arithmetic on a NULL pointer, not a NULL dereference.

There is one more ssa_op usage in zend_may_throw_ex(). It probably should be fixed as well.

ssa_op will only be dereferenced if the type of op1 is inferred to only be MAY_BE_OBJECT. However, that can only happen in optimization level 3, but that level will not have ssa_op == NULL at that point of execution because it uses the SSA form to infer types. At least that's how I understand it, and I couldn't trigger a bug there by testing.

[dstogov]

Should this be fixed in PHP-8.2 as well?

[nielsdos]

Should this be fixed in PHP-8.2 as well?

I think so. It applies cleanly on 8.2 and it's a minimal patch, so I'll apply it to 8.2 and up.