Commit b309533729f for php

commit b309533729f82df48ca1e9a96ddefb6c911f31ac
Author: Gina Peter Banyard <girgias@php.net>
Date:   Sat Oct 24 16:37:18 2026 +0100

    dba: fix GH-24641 (NULL dereferencement with ndbm backend)

    Return FAILURE in DBA_OPEN_FUNC(ndbm) if dbm_open() returns a NULL pointer.

    Closes GH-24641
    Closes GH-24652

diff --git a/NEWS b/NEWS
index fb54e6dd3e6..38476ae6311 100644
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-24350 (MINIT reads a stale external tz database after an
     in-process module restart). (Lazizbek Ergashev)

+- DBA:
+  . Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value,
+    NULL deref on first use after a failed open). (Girgias)
+
 - DOM:
   . Fixed bug GH-23352 (UAF reading an attribute value node retained across
     DOMDocument::adoptNode()). (David Carlier)
diff --git a/ext/dba/dba_ndbm.c b/ext/dba/dba_ndbm.c
index 40ae304cb7d..58e4893ec2d 100644
--- a/ext/dba/dba_ndbm.c
+++ b/ext/dba/dba_ndbm.c
@@ -53,6 +53,9 @@ DBA_OPEN_FUNC(ndbm)
 	}

 	dbf = dbm_open(ZSTR_VAL(info->path), gmode, filemode);
+	if (dbf == NULL) {
+		return FAILURE;
+	}

 	pinfo->dbf = dbf;
 	return SUCCESS;
diff --git a/ext/dba/tests/gh24641.phpt b/ext/dba/tests/gh24641.phpt
new file mode 100644
index 00000000000..e7479b64333
--- /dev/null
+++ b/ext/dba/tests/gh24641.phpt
@@ -0,0 +1,30 @@
+--TEST--
+GH-24641 (ndbm backend never checks dbm_open() return value, NULL deref on first use after a failed open)
+--EXTENSIONS--
+dba
+--FILE--
+<?php
+
+file_put_contents(__DIR__ . '/gh24641', 'not a valid ndbm/gdbm database, just plain text');
+
+foreach (dba_handlers() as $handler) {
+	/* Suppress warnings */
+	$db = @dba_open(__DIR__ . '/gh24641', 'r', $handler);
+	/* Expected as this file is not a proper db file */
+	if ($db === false) {
+		continue;
+	}
+	/* Some drivers just don't care */
+    dba_firstkey($db); // SEGV
+    dba_close($db);
+}
+
+?>
+DONE
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh24641');
+@unlink(__DIR__ . '/gh24641-lock');
+?>
+--EXPECT--
+DONE