[php-src] PHP-8.5: ext/curl: fix mem leak when duphandle fails in curl_clone_obj (#22899)

Author: Sjoerd Langkemper (Sjord)
Committer: Weilin Du (LamentXU123)
Date: 2026-07-27T22:36:09+08:00

Commit: https://github.com/php/php-src/commit/3163ac7038c0be38f63c7e4274b336faf6d7fbad
Raw diff: https://github.com/php/php-src/commit/3163ac7038c0be38f63c7e4274b336faf6d7fbad.diff

ext/curl: fix mem leak when duphandle fails in curl_clone_obj (#22899)

Move init_curl_handle() so that memory is not leaked if
curl_easy_duphandle() fails within curl_clone_obj().

init_curl_handle() allocates state that curl_free_obj() later frees, but
curl_free_obj() does nothing if ch->cp is not set. In curl_clone_obj(), defer
that allocation until a valid copied handle exists so failed duplication leaves
nothing to clean up.

Closes #22899

Changed paths:
  M  ext/curl/interface.c


Diff:

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 4e4da5503bbb..9eb05a7cfbb4 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -441,7 +441,6 @@ static zend_object *curl_clone_obj(zend_object *object) {
 
 	clone_object = curl_create_object(curl_ce);
 	clone_ch = curl_from_obj(clone_object);
-	init_curl_handle(clone_ch);
 
 	ch = curl_from_obj(object);
 	cp = curl_easy_duphandle(ch->cp);
@@ -450,6 +449,7 @@ static zend_object *curl_clone_obj(zend_object *object) {
 		return &clone_ch->std;
 	}
 
+	init_curl_handle(clone_ch);
 	clone_ch->cp = cp;
 	_php_setup_easy_copy_handlers(clone_ch, ch);