From b529c7709434383bc415661f141ecfe8abed2cf2 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sun, 12 Oct 2025 23:59:19 +0200
Subject: [PATCH] phar: Fix more alias memory leaks

Closes GH-20154.
---
 NEWS           | 3 ++-
 ext/phar/zip.c | 4 +---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/NEWS b/NEWS
index a1e87ca9c50..f322a7e0876 100644
--- a/NEWS
+++ b/NEWS
@@ -28,7 +28,8 @@ PHP                                                                        NEWS
 - Phar:
   . Fix memory leak of argument in webPhar. (nielsdos)
   . Fix memory leak when setAlias() fails. (nielsdos)
-  . Fix memory leak in phar_parse_zipfile() error handling. (nielsdos)
+  . Fix a bunch of memory leaks in phar_parse_zipfile() error handling.
+    (nielsdos)
   . Fix file descriptor/memory leak when opening central fp fails. (nielsdos)
 
 - Random:
diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index c188d6513ab..f1d0edd5bdf 100644
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -314,6 +314,7 @@ foundit:
 	entry.fp_type = PHAR_FP;
 	entry.is_persistent = mydata->is_persistent;
 #define PHAR_ZIP_FAIL(errmsg) \
+			efree(actual_alias); \
 			zend_hash_destroy(&mydata->manifest); \
 			HT_INVALIDATE(&mydata->manifest); \
 			zend_hash_destroy(&mydata->mounted_dirs); \
@@ -619,7 +620,6 @@ foundit:
 				}
 
 				if (!entry.uncompressed_filesize) {
-					efree(actual_alias);
 					php_stream_filter_remove(filter, 1);
 					pefree(entry.filename, entry.is_persistent);
 					PHAR_ZIP_FAIL("unable to read in alias, truncated");
@@ -653,7 +653,6 @@ foundit:
 				}
 
 				if (!entry.uncompressed_filesize) {
-					efree(actual_alias);
 					php_stream_filter_remove(filter, 1);
 					pefree(entry.filename, entry.is_persistent);
 					PHAR_ZIP_FAIL("unable to read in alias, truncated");
@@ -677,7 +676,6 @@ foundit:
 				}
 
 				if (!entry.uncompressed_filesize) {
-					efree(actual_alias);
 					pefree(entry.filename, entry.is_persistent);
 					PHAR_ZIP_FAIL("unable to read in alias, truncated");
 				}