Fix OSS-Fuzz #69765: Yield reference to nullsafe chain

You cannot return or yield a reference to a nullsafe chain. This was
checked already in zend_compile_return but not yet in
zend_compile_yield.

Closes GH-14716.

Author: ndossche

NEWS

@@ -8,6 +8,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-14626 (Fix is_zend_ptr() for huge blocks). (Arnaud)
   . Fixed bug GH-14590 (Memory leak in FPM test gh13563-conf-bool-env.phpt.
     (nielsdos)
+  . Fixed OSS-Fuzz #69765. (nielsdos)
 
 - Dom:
   . Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)

Zend/tests/oss-fuzz-69765.phpt

@@ -0,0 +1,10 @@
+--TEST--
+OSS-Fuzz #69765: yield reference to nullsafe chain
+--FILE--
+<?php
+function &test($object) {
+    yield $object->y?->y;
+}
+?>
+--EXPECTF--
+Fatal error: Cannot take reference of a nullsafe chain in %s on line %d

Zend/zend_compile.c

@@ -9329,6 +9329,10 @@ static void zend_compile_yield(znode *result, zend_ast *ast) /* {{{ */
 
 	if (value_ast) {
 		if (returns_by_ref && zend_is_variable(value_ast)) {
+			if (zend_ast_is_short_circuited(value_ast)) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot take reference of a nullsafe chain");
+			}
+
 			zend_compile_var(&value_node, value_ast, BP_VAR_W, 1);
 		} else {
 			zend_compile_expr(&value_node, value_ast);