Fix phpGH-16389: Assertion failure in ext/ldap/ldap.c:2718 (php#16392)

Author: ndossche

ext/ldap/ldap.c

@@ -2714,11 +2714,11 @@ PHP_FUNCTION(ldap_modify_batch)
 	ZEND_HASH_FOREACH_NUM_KEY_VAL(modifications, modification_index, modification_zv) {
 		ldap_mods[modification_index] = safe_emalloc(1, sizeof(LDAPMod), 0);
 
-		zval *attrib_zv = zend_hash_str_find(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_ATTRIB, strlen(LDAP_MODIFY_BATCH_ATTRIB));
+		zval *attrib_zv = zend_hash_str_find_deref(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_ATTRIB, strlen(LDAP_MODIFY_BATCH_ATTRIB));
 		ZEND_ASSERT(Z_TYPE_P(attrib_zv) == IS_STRING);
-		zval *modtype_zv = zend_hash_str_find(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_MODTYPE, strlen(LDAP_MODIFY_BATCH_MODTYPE));
+		zval *modtype_zv = zend_hash_str_find_deref(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_MODTYPE, strlen(LDAP_MODIFY_BATCH_MODTYPE));
 		ZEND_ASSERT(Z_TYPE_P(modtype_zv) == IS_LONG);
-		zval *modification_values = zend_hash_str_find(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_VALUES, strlen(LDAP_MODIFY_BATCH_VALUES));
+		zval *modification_values = zend_hash_str_find_deref(Z_ARRVAL_P(modification_zv), LDAP_MODIFY_BATCH_VALUES, strlen(LDAP_MODIFY_BATCH_VALUES));
 		ZEND_ASSERT(modification_values == NULL || Z_TYPE_P(modification_values) == IS_ARRAY);
 
 		/* map the modification type */

ext/ldap/tests/gh16389.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-16389 (Assertion failure in ext/ldap/ldap.c:2718)
+--EXTENSIONS--
+ldap
+--FILE--
+<?php
+$attrib = "attrib";
+$modtype = LDAP_MODIFY_BATCH_ADD;
+$values = ["value1"];
+$ldap = ldap_connect('ldap://127.0.0.1:3333');
+$modification_attrib_reference_string = [
+    [
+        "attrib"  => &$attrib,
+        "modtype" => &$modtype,
+        "values"  => &$values,
+    ],
+];
+var_dump(ldap_modify_batch($ldap, "", $modification_attrib_reference_string));
+?>
+--EXPECTF--
+Warning: ldap_modify_batch(): Batch Modify: Can't contact LDAP server in %s on line %d
+bool(false)