From 482ae71fda1bca652d9d22cfbbcc3c4decf10960 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 31 Oct 2022 12:20:28 +0300
Subject: [PATCH] Fix memory leak

---
 .../dnf_types/dnf_intersection_and_eval.phpt           |  9 +++++++++
 Zend/zend_opcode.c                                     | 10 ++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 Zend/tests/type_declarations/dnf_types/dnf_intersection_and_eval.phpt

diff --git a/Zend/tests/type_declarations/dnf_types/dnf_intersection_and_eval.phpt b/Zend/tests/type_declarations/dnf_types/dnf_intersection_and_eval.phpt
new file mode 100644
index 00000000000..80f1920779b
--- /dev/null
+++ b/Zend/tests/type_declarations/dnf_types/dnf_intersection_and_eval.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Union and intersection type leaks
+--FILE--
+<?php
+eval('abstract class y {function y(): (y&yy)|t {}}');
+?>
+DONE
+--EXPECTF--
+DONE
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index 8d998d03786..6d42379b202 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -110,9 +110,15 @@ ZEND_API void destroy_zend_function(zend_function *function)
 
 ZEND_API void zend_type_release(zend_type type, bool persistent) {
 	if (ZEND_TYPE_HAS_LIST(type)) {
-		zend_type *list_type;
+		zend_type *list_type, *sublist_type;
 		ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(type), list_type) {
-			if (ZEND_TYPE_HAS_NAME(*list_type)) {
+			if (ZEND_TYPE_HAS_LIST(*list_type)) {
+				ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(*list_type), sublist_type) {
+					if (ZEND_TYPE_HAS_NAME(*sublist_type)) {
+						zend_string_release(ZEND_TYPE_NAME(*sublist_type));
+					}
+				} ZEND_TYPE_LIST_FOREACH_END();
+			} else if (ZEND_TYPE_HAS_NAME(*list_type)) {
 				zend_string_release(ZEND_TYPE_NAME(*list_type));
 			}
 		} ZEND_TYPE_LIST_FOREACH_END();