From 80b731659a0a7d5ae2650e8cc10fbe2d6713707a Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Sat, 8 Nov 2025 17:39:42 +0100
Subject: [PATCH] Fix memory leak in array_diff() with custom type checks

Closes GH-20428.
---
 NEWS                                               |  3 +++
 ext/standard/array.c                               |  1 +
 .../array/array_diff_leak_custom_type_checks.phpt  | 14 ++++++++++++++
 3 files changed, 18 insertions(+)
 create mode 100644 ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt

diff --git a/NEWS b/NEWS
index ad480774cc5..ba45d98c377 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-20329 (opcache.file_cache broken with full interned string
     buffer). (Arnaud)
 
+- Standard:
+  . Fix memory leak in array_diff() with custom type checks. (ndossche)
+
 - Tidy:
   . Fixed bug GH-20374 (PHP with tidy and custom-tags). (ndossche)
 
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4896ac44a72..37c80e0989c 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -5762,6 +5762,7 @@ PHP_FUNCTION(array_diff)
 
 		for (i = 1; i < argc; i++) {
 			if (Z_TYPE(args[i]) != IS_ARRAY) {
+				zend_tmp_string_release(tmp_search_str);
 				zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
 				RETURN_THROWS();
 			}
diff --git a/ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt b/ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt
new file mode 100644
index 00000000000..77aef0ccc08
--- /dev/null
+++ b/ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt
@@ -0,0 +1,14 @@
+--TEST--
+array_diff() memory leak with custom type checks
+--FILE--
+<?php
+
+try {
+    array_diff([123], 'x');
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+array_diff(): Argument #2 must be of type array, string given