Fix null-pointer deref in if stmt printing

Fixes OSS-Fuzz #17721.

diff --git a/Zend/tests/assert/expect_015.phpt b/Zend/tests/assert/expect_015.phpt
index 1679640851b1414f401e2362d37e16074e03f5b1..72f13ff83f15f4383423a4b24427786b62cd761e 100644 (file)
--- a/Zend/tests/assert/expect_015.phpt
+++ b/Zend/tests/assert/expect_015.phpt
@@ -140,6 +140,7 @@ assert(0 && ($a = function () {
     if ($a) {
     } elseif ($b) {
     }
+    if ($a); else;
 }));
 
 ?>
@@ -292,4 +293,7 @@ Warning: assert(): assert(0 && ($a = function () {
     if ($a) {
     } elseif ($b) {
     }
+    if ($a) {
+    } else {
+    }
 })) failed in %sexpect_015.php on line %d

diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index 6e3447eb732f7493c9ea2a5011b8b09d67151ba9..bad1471ac4a14fe134ea24b12ebce26a506cfe6a 100644 (file)
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -894,7 +894,7 @@ tail_call:
                } else {
                        zend_ast_export_indent(str, indent);
                        smart_str_appends(str, "} else ");
-                       if (ast->child[1]->kind == ZEND_AST_IF) {
+                       if (ast->child[1] && ast->child[1]->kind == ZEND_AST_IF) {
                                list = (zend_ast_list*)ast->child[1];
                                goto tail_call;
                        } else {