[php-src] master: Merge branch 'PHP-8.5'

Author: Weilin Du (LamentXU123)
Date: 2026-07-27T17:44:59+08:00

Commit: https://github.com/php/php-src/commit/993433ad966893efb9ae2faf29471dc95fbf14ec
Raw diff: https://github.com/php/php-src/commit/993433ad966893efb9ae2faf29471dc95fbf14ec.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  Fix leak when cURL PREREQFUNCTION returns a type other than int (#22726)

Changed paths:
  M  ext/curl/interface.c
  M  ext/curl/tests/curl_setopt_CURLOPT_PREREQFUNCTION.phpt


Diff:

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index d5d20d825652..85496ee1ab06 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -723,6 +723,7 @@ static int curl_prereqfunction(void *clientp, char *conn_primary_ip, char *conn_
 				zend_value_error("The CURLOPT_PREREQFUNCTION callback must return either CURL_PREREQFUNC_OK or CURL_PREREQFUNC_ABORT");
 			}
 		} else {
+			zval_ptr_dtor(&retval);
 			zend_type_error("The CURLOPT_PREREQFUNCTION callback must return either CURL_PREREQFUNC_OK or CURL_PREREQFUNC_ABORT");
 		}
 	}
diff --git a/ext/curl/tests/curl_setopt_CURLOPT_PREREQFUNCTION.phpt b/ext/curl/tests/curl_setopt_CURLOPT_PREREQFUNCTION.phpt
index 58d01df2a886..39a1d1e3caa8 100644
--- a/ext/curl/tests/curl_setopt_CURLOPT_PREREQFUNCTION.phpt
+++ b/ext/curl/tests/curl_setopt_CURLOPT_PREREQFUNCTION.phpt
@@ -78,7 +78,7 @@ try {
 
 echo "\nTesting with invalid type\n";
 curl_setopt($ch, CURLOPT_PREREQFUNCTION, function() use ($port) {
-	return 'this should be an integer';
+	return ['this should be an integer' => random_bytes(64)];
 });
 try {
     curl_exec($ch);