stdlib: token_get_all() null byte after $ — literal dollar (#13896)

ext/tokenizer/LanguageScanner.php

@@ -433,6 +433,14 @@ private function scanVariable(): void
 
             return;
         }
+        // php-src zend_language_scanner.l: bare '$' when not followed by a variable label start.
+        if ($this->pos >= $this->len || !$this->isLabelStart($this->source[$this->pos])) {
+            $this->pos = $start;
+            $this->pushChar('$');
+            ++$this->pos;
+
+            return;
+        }
         while ($this->pos < $this->len && $this->isLabelContinue($this->source[$this->pos])) {
             ++$this->pos;
         }

test/compliance/cases/stdlib/token_get_all_null_byte.phpt

@@ -0,0 +1,12 @@
+--TEST--
+stdlib token_get_all() null byte after $ — literal dollar + T_BAD_CHARACTER (#13896, ext/tokenizer/tokenizer.c)
+--FILE--
+<?php
+$src = "<?php \$\0 = 1;";
+$tokens = token_get_all($src);
+echo ($tokens[1] === '$' ? 'dollar' : 'bad_dollar'), "\n";
+echo (is_array($tokens[2]) && T_BAD_CHARACTER === $tokens[2][0] ? 'bad_char' : 'bad_bad_char'), "\n";
+?>
+--EXPECT--
+dollar
+bad_char

test/repro/maintainer_gap_token_get_all_null_byte.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+$src = "<?php \$\0 = 1;";
+$tokens = token_get_all($src);
+
+if (!isset($tokens[1]) || '$' !== $tokens[1]) {
+    $got = isset($tokens[1]) && is_array($tokens[1])
+        ? 'T_' . ($tokens[1][0] ?? '?')
+        : var_export($tokens[1] ?? null, true);
+    fwrite(STDERR, "second token: expected literal '\$', got {$got}\n");
+    exit(1);
+}
+
+if (!isset($tokens[2]) || !is_array($tokens[2]) || T_BAD_CHARACTER !== $tokens[2][0]) {
+    fwrite(STDERR, "third token: expected T_BAD_CHARACTER\n");
+    exit(1);
+}
+
+echo "ok\n";

test/unit/VmTokenizerNativeTest.php

@@ -67,6 +67,24 @@ public function test_token_name_for_echo(): void
         self::assertSame('T_ECHO', $frame->returnVar->toString());
     }
 
+    public function test_issue_13896_null_byte_after_dollar(): void
+    {
+        $src = "<?php \$\0 = 1;";
+        $tokens = LanguageScanner::tokenize($src);
+        self::assertSame('$', $tokens[1]);
+        self::assertTrue(\is_array($tokens[2]));
+        self::assertSame(TokenConstantsData::nameToId()['T_BAD_CHARACTER'], $tokens[2][0]);
+    }
+
+    public function test_bare_dollar_before_number_is_literal(): void
+    {
+        $tokens = LanguageScanner::tokenize('<?php $123;');
+        self::assertSame('$', $tokens[1]);
+        self::assertTrue(\is_array($tokens[2]));
+        self::assertSame(TokenConstantsData::nameToId()['T_LNUMBER'], $tokens[2][0]);
+        self::assertSame('123', $tokens[2][1]);
+    }
+
     public function test_vm_token_get_all_issue_repro(): void
     {
         $runtime = new Runtime();