From 08289b900ce1d76d85282f3bf4af8ce9f332d12f Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 12 Oct 2024 12:41:45 +0200
Subject: [PATCH] Fix GH-16389: Assertion failure in ext/ldap/ldap.c:2718

---
 ext/ldap/ldap.c             |  6 +++---
 ext/ldap/tests/gh16389.phpt | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 ext/ldap/tests/gh16389.phpt

diff --git a/ext/ldap/ldap.c b/ext/ldap/ldap.c
index 6f5830e54413d..c15a3e728096c 100644
--- a/ext/ldap/ldap.c
+++ b/ext/ldap/ldap.c
@@ -2714,11 +2714,11 @@ PHP_FUNCTION(ldap_modify_batch)
 	ZEND_HASH_FOREACH_NUM_KEY_VAL(modifications, modification_index, modification_zv) {
 		ldap_mods[modification_index] = safe_emalloc(1, sizeof(LDAPMod), 0);
 
-		zval *attrib_zv = zend_hash_str_find(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_ATTRIB, strlen(LDAP_MODIFY_BATCH_ATTRIB));
+		zval *attrib_zv = zend_hash_str_find_deref(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_ATTRIB, strlen(LDAP_MODIFY_BATCH_ATTRIB));
 		ZEND_ASSERT(Z_TYPE_P(attrib_zv) == IS_STRING);
-		zval *modtype_zv = zend_hash_str_find(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_MODTYPE, strlen(LDAP_MODIFY_BATCH_MODTYPE));
+		zval *modtype_zv = zend_hash_str_find_deref(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_MODTYPE, strlen(LDAP_MODIFY_BATCH_MODTYPE));
 		ZEND_ASSERT(Z_TYPE_P(modtype_zv) == IS_LONG);
-		zval *modification_values = zend_hash_str_find(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_VALUES, strlen(LDAP_MODIFY_BATCH_VALUES));
+		zval *modification_values = zend_hash_str_find_deref(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_VALUES, strlen(LDAP_MODIFY_BATCH_VALUES));
 		ZEND_ASSERT(modification_values == NULL || Z_TYPE_P(modification_values) == IS_ARRAY);
 
 		/* map the modification type */
diff --git a/ext/ldap/tests/gh16389.phpt b/ext/ldap/tests/gh16389.phpt
new file mode 100644
index 0000000000000..228dfd74c1469
--- /dev/null
+++ b/ext/ldap/tests/gh16389.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GH-16389 (Assertion failure in ext/ldap/ldap.c:2718)
+--EXTENSIONS--
+ldap
+--FILE--
+<?php
+$attrib = "attrib";
+$modtype = LDAP_MODIFY_BATCH_ADD;
+$values = ["value1"];
+$ldap = ldap_connect('ldap://127.0.0.1:3333');
+$modification_attrib_reference_string = [
+    [
+        "attrib"  => &$attrib,
+        "modtype" => &$modtype,
+        "values"  => &$values,
+    ],
+];
+var_dump(ldap_modify_batch($ldap, "", $modification_attrib_reference_string));
+?>
+--EXPECTF--
+Warning: ldap_modify_batch(): Batch Modify: Can't contact LDAP server in %s on line %d
+bool(false)