Fix GH-18873 - Free column->descid appropriately (#18957)

fixes #18873
closes #18957

NEWS

@@ -22,6 +22,10 @@ PHP                                                                        NEWS
 - MbString:
   . Fixed bug GH-18901 (integer overflow mb_split). (nielsdos)
 
+- OCI8:
+  . Fixed bug GH-18873 (OCI_RETURN_LOBS flag causes oci8 to leak memory).
+    (Saki Takamachi)
+
 - Opcache:
   . Fixed bug GH-18639 (Internal class aliases can break preloading + JIT).
     (nielsdos)

ext/oci8/oci8.c

@@ -573,12 +573,8 @@ void php_oci_column_hash_dtor(zval *data)
 		zend_list_close(column->stmtid);
 	}
 
-	if (column->descid) {
-		if (GC_REFCOUNT(column->descid) == 1)
-			zend_list_close(column->descid);
-		else {
-			GC_DELREF(column->descid);
-		}
+	if (column->descid && !GC_DELREF(column->descid)) {
+		zend_list_free(column->descid);
 	}
 
 	if (column->data) {

ext/oci8/tests/gh18873.phpt

@@ -0,0 +1,38 @@
+--TEST--
+GH-18873 (OCI_RETURN_LOBS flag causes oci8 to leak memory)
+--EXTENSIONS--
+oci8
+--SKIPIF--
+<?php
+require_once 'skipifconnectfailure.inc';
+if (getenv("USE_ZEND_ALLOC") === "0") die("skip requires ZendMM");
+?>
+--FILE--
+<?php
+require __DIR__.'/connect.inc';
+
+$expectedStr = str_repeat('a', 1_001);
+$sql = 'select concat(TO_CLOB(\'' . str_repeat('a', 1_000) . '\'), TO_CLOB(\'a\')) AS "v" from "DUAL"';
+
+$memUsages = array_flip(range(0, 100 - 1));
+foreach (array_keys($memUsages) as $k) {
+    $stid = oci_parse($c, $sql);
+    oci_execute($stid);
+    $row = oci_fetch_array($stid, \OCI_ASSOC | \OCI_RETURN_LOBS);
+    $res = $row['v'];
+
+    $memUsages[$k] = memory_get_usage();
+}
+
+$memUsages = array_slice($memUsages, 1, null, true);
+$memUsages = array_unique($memUsages);
+
+if (count($memUsages) !== 1) {
+    var_dump($memUsages);
+    throw new \Exception('memory leak detected');
+}
+
+echo "Done!\n";
+?>
+--EXPECT--
+Done!