From da399750015d3c182587c42dff6b88e65bfafbf2 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 11 Oct 2025 13:30:49 +0200
Subject: [PATCH] phar: Fix memory leak of argument in webPhar

Closes GH-20138.
---
 NEWS                   | 3 +++
 ext/phar/phar_object.c | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 3f5945f78f2..0905761da01 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-20081 (access to uninitialized vars in preload_load()).
     (Arnaud)
 
+- Phar:
+  . Fix memory leak of argument in webPhar. (nielsdos)
+
 - Random:
   . Fix Randomizer::__serialize() w.r.t. INDIRECTs. (nielsdos)
 
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 9f83fa991d4..abda7e5a78c 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -689,12 +689,15 @@ PHP_METHOD(Phar, webPhar)
 		rewrite_fci.retval = &retval;
 
 		if (FAILURE == zend_call_function(&rewrite_fci, &rewrite_fcc)) {
+			zval_ptr_dtor_str(&params);
 			if (!EG(exception)) {
 				zend_throw_exception_ex(phar_ce_PharException, 0, "phar error: failed to call rewrite callback");
 			}
 			goto cleanup_fail;
 		}
 
+		zval_ptr_dtor_str(&params);
+
 		if (Z_TYPE_P(rewrite_fci.retval) == IS_UNDEF || Z_TYPE(retval) == IS_UNDEF) {
 			zend_throw_exception_ex(phar_ce_PharException, 0, "phar error: rewrite callback must return a string or false");
 			goto cleanup_fail;
@@ -720,7 +723,6 @@ PHP_METHOD(Phar, webPhar)
 				zend_throw_exception_ex(phar_ce_PharException, 0, "phar error: rewrite callback must return a string or false");
 
 cleanup_fail:
-				zval_ptr_dtor(&params);
 				if (free_pathinfo) {
 					efree(path_info);
 				}