# Null dereference on malformed input

Lookup, stack pop, or allocation result used without a null check on the malformed-input path

_Area: Memory corruption and native code. Seen in 5 disclosed reports; 3 confirmed bounties, median $800, range $500-$8,000; latest 2026-10-15. Updated 2026-10-23._

## How it works
Code assumes a helper that fetches or builds a value always succeeds. On malformed input that helper returns NULL (or an empty/absent entry), and the caller dereferences it anyway. The broken assumption is "this lookup/stack-top/allocation cannot fail here." It can, because the input controls whether the value exists.

## Where it shows up
- A helper like a stack-top or lookup function that can return null, called and immediately dereferenced [E2](https://bugbountylibrary.com/r/h1%3A161198.md).
- A global "current target" pointer set to NULL on a fallback path, then consumed by opcodes that assume non-null [E1](https://bugbountylibrary.com/r/h1%3A183405.md).
- Unchecked slice/borrow impls (`[0..size]`) reached before a downstream length check [E3](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md).
- Internal functions (e.g. array concat) receiving a NULL receiver from odd grammar paths [E4](https://bugbountylibrary.com/r/h1%3A214681.md).
- Newer code paths guarded implicitly by macros while older paths are not [E2](https://bugbountylibrary.com/r/h1%3A161198.md).

## How to review
For each helper that can return null/empty, list every call site and confirm a null check precedes the first dereference. For a global pointer, enumerate every path that can leave it NULL and every consumer. For buffers, confirm no borrow/index happens before the length validation. The invariant: no dereference of a possibly-null value on any input-reachable path, including error and fallback paths.

## Variants seen
- VM target pointer NULL after failed singleton-class creation [E1](https://bugbountylibrary.com/r/h1%3A183405.md).
- Stack-top returns null entry on malformed XML, dereferenced unchecked [E2](https://bugbountylibrary.com/r/h1%3A161198.md).
- Unchecked slice borrow before length check in a verifier [E3](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md).
- NULL array passed to concat from splat/multiple-assignment syntax [E4](https://bugbountylibrary.com/r/h1%3A214681.md).

## Impact and severity
All four crash the process: interpreter segfaults [E1](https://bugbountylibrary.com/r/h1%3A183405.md)[E4](https://bugbountylibrary.com/r/h1%3A214681.md), PHP interpreter crash [E2](https://bugbountylibrary.com/r/h1%3A161198.md), verifier panic [E3](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md). Severity is denial of service; worse where the crashing component is a sandbox or verifier service, since a crash can take down shared infrastructure. Malformed input reachable from untrusted sources made each worse.

## Why fixes fail
E2 notes the 5.x path lacks the guard that 7.x macros provide implicitly, so a fix in one branch leaves the other exposed; check all version paths.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A183405.md
- E2: https://bugbountylibrary.com/r/h1%3A161198.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md
- E4: https://bugbountylibrary.com/r/h1%3A214681.md