diff --git a/ext/ldap/ldap.c b/ext/ldap/ldap.c index 3fea267d14f..35e4e4321c4 100644 --- a/ext/ldap/ldap.c +++ b/ext/ldap/ldap.c @@ -1480,6 +1480,11 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope) ret = 0; goto cleanup; } + if (!zend_array_is_list(Z_ARRVAL_P(link))) { + zend_argument_value_error(1, "must be a list"); + ret = 0; + goto cleanup; + } if (base_dn_ht) { nbases = zend_hash_num_elements(base_dn_ht); diff --git a/ext/ldap/tests/gh16101.phpt b/ext/ldap/tests/gh16101.phpt new file mode 100644 index 00000000000..1e9d5733437 --- /dev/null +++ b/ext/ldap/tests/gh16101.phpt @@ -0,0 +1,25 @@ +--TEST-- +Bug GH-16101: Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list +--EXTENSIONS-- +ldap +--FILE-- + $ldap, + "world" => $ldap, +]; +try { + var_dump(ldap_list($ldaps_dict, $valid_dn, $valid_filter)); +} catch (Throwable $e) { + echo $e::class, ': ', $e->getMessage(), PHP_EOL; +} + +?> +--EXPECT-- +ValueError: ldap_list(): Argument #1 ($ldap) must be a list