From c34def581a99f0591ee21802e21684e754f34544 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sun, 7 Jul 2024 21:53:58 +0200
Subject: [PATCH] Fix memory leak in tidy_repair_file()

When dealing with a file, we must free the contents if the function
fails. While here, also fix the error message because previously it
sounded like the filename was too long while in fact the file itself
is too large.

Closes GH-14862.
---
 NEWS                                       | 3 +++
 ext/tidy/tests/parsing_file_too_large.phpt | 7 +++++++
 ext/tidy/tidy.c                            | 7 ++++++-
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 75d98e0b536..411c5de823e 100644
--- a/NEWS
+++ b/NEWS
@@ -52,6 +52,9 @@ PHP                                                                        NEWS
   . Fix 32-bit wordwrap test failures. (orlitzky)
   . Fixed bug GH-14774 (time_sleep_until overflow). (David Carlier)
 
+- Tidy:
+  . Fix memory leak in tidy_repair_file(). (nielsdos)
+
 - Treewide:
   . Fix compatibility with libxml2 2.13.2. (nielsdos)
 
diff --git a/ext/tidy/tests/parsing_file_too_large.phpt b/ext/tidy/tests/parsing_file_too_large.phpt
index 46196c0a5fd..a0118ba9ebd 100644
--- a/ext/tidy/tests/parsing_file_too_large.phpt
+++ b/ext/tidy/tests/parsing_file_too_large.phpt
@@ -47,6 +47,12 @@ try {
 } catch (\Throwable $e) {
     echo $e::class, ': ', $e->getMessage(), PHP_EOL;
 }
+
+try {
+    tidy_repair_file($path);
+} catch (\Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+}
 ?>
 --CLEAN--
 <?php
@@ -58,3 +64,4 @@ int(0)
 ValueError: Input string is too long
 ValueError: Input string is too long
 ValueError: Input string is too long
+ValueError: tidy_repair_file(): Argument #1 ($filename) Input string is too long
diff --git a/ext/tidy/tidy.c b/ext/tidy/tidy.c
index a2e4dec90a3..38e97a71a2a 100644
--- a/ext/tidy/tidy.c
+++ b/ext/tidy/tidy.c
@@ -304,7 +304,12 @@ static void php_tidy_quick_repair(INTERNAL_FUNCTION_PARAMETERS, bool is_file)
 	}
 
 	if (ZEND_SIZE_T_UINT_OVFL(ZSTR_LEN(data))) {
-		zend_argument_value_error(1, "is too long");
+		if (is_file) {
+			zend_string_release_ex(data, false);
+			zend_argument_value_error(1, "Input string is too long");
+		} else {
+			zend_argument_value_error(1, "is too long");
+		}
 		RETURN_THROWS();
 	}