From df219ccf9d6be8302eef3ab6e26fd00fbd2fef71 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Sun, 16 Jun 2024 19:45:27 +0100
Subject: [PATCH] ext/soap: Fix memory leaks when calling
 SoapFault::__construct() twice

---
 NEWS                                  |  1 +
 ext/soap/soap.c                       | 14 ++++++++++++++
 ext/soap/tests/SoapFault/gh14586.phpt | 12 ++++++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 ext/soap/tests/SoapFault/gh14586.phpt

diff --git a/NEWS b/NEWS
index db375c3b7cc..25e9351636e 100644
--- a/NEWS
+++ b/NEWS
@@ -56,6 +56,7 @@ PHP                                                                        NEWS
   . Fixed bug #69280 (SoapClient classmap doesn't support fully qualified class
     name). (nielsdos)
   . Fixed bug #76232 (SoapClient Cookie Header Semicolon). (nielsdos)
+  . Fixed memory leaks when calling SoapFault::__construct() twice. (Girgias)
 
 - Sodium:
   . Fix memory leaks in ext/sodium on failure of some functions. (nielsdos)
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index 96f307a434b..eaea09b461d 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -520,6 +520,17 @@ PHP_METHOD(SoapHeader, __construct)
 }
 /* }}} */
 
+static void soap_fault_dtor_properties(zval *obj)
+{
+	zval_ptr_dtor(Z_FAULT_STRING_P(obj));
+	zval_ptr_dtor(Z_FAULT_CODE_P(obj));
+	zval_ptr_dtor(Z_FAULT_CODENS_P(obj));
+	zval_ptr_dtor(Z_FAULT_ACTOR_P(obj));
+	zval_ptr_dtor(Z_FAULT_DETAIL_P(obj));
+	zval_ptr_dtor(Z_FAULT_NAME_P(obj));
+	zval_ptr_dtor(Z_FAULT_HEADERFAULT_P(obj));
+}
+
 /* {{{ SoapFault constructor */
 PHP_METHOD(SoapFault, __construct)
 {
@@ -539,6 +550,9 @@ PHP_METHOD(SoapFault, __construct)
 		Z_PARAM_ZVAL_OR_NULL(headerfault)
 	ZEND_PARSE_PARAMETERS_END();
 
+	/* Delete previously set properties */
+	soap_fault_dtor_properties(ZEND_THIS);
+
 	if (code_str) {
 		fault_code = ZSTR_VAL(code_str);
 		fault_code_len = ZSTR_LEN(code_str);
diff --git a/ext/soap/tests/SoapFault/gh14586.phpt b/ext/soap/tests/SoapFault/gh14586.phpt
new file mode 100644
index 00000000000..91a273da09d
--- /dev/null
+++ b/ext/soap/tests/SoapFault/gh14586.phpt
@@ -0,0 +1,12 @@
+--TEST--
+GH-14586: SoapFault::__construct() leaks memory if called twice
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+$sf = new SoapFault(null, "x");
+$sf->__construct(null, "x");
+?>
+DONE
+--EXPECT--
+DONE