Fixed bug #79434

Author: nikic

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.18
 
+- Core:
+  . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference
+    on !CS constant). (Nikita)
+
 - MBString:
   . Fixed bug #79441 (Segfault in mb_chr() if internal encoding is unsupported).
     (Girgias)

Zend/tests/case_insensitive_constant_deprecation.phpt

@@ -9,6 +9,7 @@ namespace {
 
     var_dump(FOO); // Ok
     var_dump(foo); // Deprecated
+    var_dump(\foo); // Deprecated
 
     var_dump(NS\FOO); // Ok
     var_dump(ns\FOO); // Ok
@@ -72,10 +73,13 @@ int(42)
 
 Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 8
 int(42)
+
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 9
+int(42)
 int(24)
 int(24)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 12
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 13
 int(24)
 bool(true)
 bool(true)
@@ -84,24 +88,24 @@ bool(true)
 bool(true)
 int(42)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 21
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 22
 int(42)
 int(24)
 int(24)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 24
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 25
 int(24)
 int(24)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 29
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 30
 int(24)
 int(24)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 34
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 35
 int(24)
 int(42)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 39
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 40
 int(42)
 bool(true)
 bool(true)
@@ -110,18 +114,18 @@ bool(true)
 bool(true)
 int(42)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 48
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 49
 int(42)
 int(24)
 int(24)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 51
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 52
 int(24)
 int(42)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 55
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 56
 int(42)
 int(43)
 
-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 59
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 60
 int(43)

Zend/zend_execute.c

@@ -3364,11 +3364,15 @@ static zend_always_inline int _zend_quick_get_constant(
 				is_deprecated = !zend_string_equals(c->name, Z_STR_P(access_key));
 			} else {
 check_short_name:
-				ns_sep = zend_memrchr(ZSTR_VAL(c->name), '\\', ZSTR_LEN(c->name));
-				ZEND_ASSERT(ns_sep);
 				/* Namespaces are always case-insensitive. Only compare shortname. */
-				shortname_offset = ns_sep - ZSTR_VAL(c->name) + 1;
-				shortname_len = ZSTR_LEN(c->name) - shortname_offset;
+				ns_sep = zend_memrchr(ZSTR_VAL(c->name), '\\', ZSTR_LEN(c->name));
+				if (ns_sep) {
+					shortname_offset = ns_sep - ZSTR_VAL(c->name) + 1;
+					shortname_len = ZSTR_LEN(c->name) - shortname_offset;
+				} else {
+					shortname_offset = 0;
+					shortname_len = ZSTR_LEN(c->name);
+				}
 
 				is_deprecated = memcmp(ZSTR_VAL(c->name) + shortname_offset, Z_STRVAL_P(orig_key - 1) + shortname_offset, shortname_len) != 0;
 			}