ext/ldap: fix crash in ldap_exop_sync() when $response_data is omitted

ldap_exop_sync() always takes the synchronous branch of php_ldap_exop(),
which assigns $response_data unconditionally. When the argument is not
passed, retdata is NULL and ZEND_TRY_ASSIGN_REF_STRINGL()/
ZEND_TRY_ASSIGN_REF_EMPTY_STRING() dereference it, so any successful
ldap_exop_sync($ldap, $oid) call segfaults. Guard the assignment the way
the $response_oid one already is.

Author: lacatoire

ext/ldap/ldap.c

@@ -4101,10 +4101,12 @@ static void php_ldap_exop(INTERNAL_FUNCTION_PARAMETERS, bool force_sync) {
 		}
 
 		if (lretdata) {
-			ZEND_TRY_ASSIGN_REF_STRINGL(retdata, lretdata->bv_val, lretdata->bv_len);
+			if (retdata) {
+				ZEND_TRY_ASSIGN_REF_STRINGL(retdata, lretdata->bv_val, lretdata->bv_len);
+			}
 			ldap_memfree(lretdata->bv_val);
 			ldap_memfree(lretdata);
-		} else {
+		} else if (retdata) {
 			ZEND_TRY_ASSIGN_REF_EMPTY_STRING(retdata);
 		}
 

ext/ldap/tests/ldap_exop_sync_without_response_data.phpt

@@ -0,0 +1,22 @@
+--TEST--
+ldap_exop_sync() - without the response_data argument
+--EXTENSIONS--
+ldap
+--SKIPIF--
+<?php require_once('skipifbindfailure.inc'); ?>
+--FILE--
+<?php
+require "connect.inc";
+
+$link = ldap_connect_and_bind($uri, $user, $passwd, $protocol_version);
+
+var_dump(
+    ldap_exop_sync($link, LDAP_EXOP_WHO_AM_I),
+    ldap_exop_sync($link, LDAP_EXOP_WHO_AM_I, null, null, $retdata),
+    $retdata
+);
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+string(%d) "dn:%s"