Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure

nielsdos · nielsdos · commit a7f7e169d672 · 2024-12-23T14:22:18.000+01:00
The success path frees tmp_str, but the error path does not. Closes GH-17243.
diff --git a/NEWS b/NEWS
@@ -24,6 +24,7 @@ PHP                                                                        NEWS
 
 - FFI:
   . Fixed bug #79075 (FFI header parser chokes on comments). (nielsdos)
+  . Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure. (nielsdos)
 
 - Filter:
   . Fixed bug GH-16944 (Fix filtering special IPv4 and IPv6 ranges, by using
diff --git a/ext/ffi/ffi.c b/ext/ffi/ffi.c
@@ -807,6 +807,7 @@ static zend_always_inline zend_result zend_ffi_zval_to_cdata(void *ptr, zend_ffi
 			if (ZSTR_LEN(str) == 1) {
 				*(char*)ptr = ZSTR_VAL(str)[0];
 			} else {
+				zend_tmp_string_release(tmp_str);
 				zend_ffi_assign_incompatible(value, type);
 				return FAILURE;
 			}

Original file line number	Diff line number	Diff line change
`@@ -807,6 +807,7 @@ static zend_always_inline zend_result zend_ffi_zval_to_cdata(void *ptr, zend_ffi`
`807`	`807`	`if (ZSTR_LEN(str) == 1) {`
`808`	`808`	`(char)ptr = ZSTR_VAL(str)[0];`
`809`	`809`	`} else {`
	`810`	`+ zend_tmp_string_release(tmp_str);`
`810`	`811`	`zend_ffi_assign_incompatible(value, type);`
`811`	`812`	`return FAILURE;`
`812`	`813`	`}`