From 9b4682649bbe63bd13674b051f63bdad79fdf051 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 24 Jun 2026 07:34:59 -0400 Subject: [PATCH] Fix posix_getgrnam()/posix_getgrgid() crash on NULL group name php_posix_group_to_array() passed gr_name straight to add_assoc_string() with no NULL guard, so a NULL group name segfaults via zend_string_init(), while the sibling gr_passwd field right below is already guarded. glibc's files NSS backend normalizes empty fields to "", but third-party NSS modules (nss-systemd, nss-ldap, sssd and other directory backends) populate struct group directly and may leave gr_name NULL. Guard it and emit null instead, matching the existing gr_passwd handling. --- ext/posix/posix.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ext/posix/posix.c b/ext/posix/posix.c index 8578056b28da..655c522a89af 100644 --- a/ext/posix/posix.c +++ b/ext/posix/posix.c @@ -669,7 +669,11 @@ int php_posix_group_to_array(struct group *g, zval *array_group) /* {{{ */ array_init(&array_members); - add_assoc_string(array_group, "name", g->gr_name); + if (g->gr_name) { + add_assoc_string(array_group, "name", g->gr_name); + } else { + add_assoc_null(array_group, "name"); + } if (g->gr_passwd) { add_assoc_string(array_group, "passwd", g->gr_passwd); } else {