[php-src] PHP-8.5: Fix IntlGregorianCalendar double-free of an adopted TimeZone (#23321)

Author: Ilia Alshanetsky (iliaal)
Committer: Weilin Du (LamentXU123)
Date: 2026-08-18T02:40:56+08:00

Commit: https://github.com/php/php-src/commit/850aa02c143e3b6e91ac231d9c3e4bcea0239325
Raw diff: https://github.com/php/php-src/commit/850aa02c143e3b6e91ac231d9c3e4bcea0239325.diff

Fix IntlGregorianCalendar double-free of an adopted TimeZone (#23321)

The timezone-and-locale IntlGregorianCalendar constructor passes the TimeZone
to an adopting ICU constructor. On failure, PHP deleted that zone again after
the calendar destructor had already freed it.

Closes #23321

Changed paths:
  M  NEWS
  M  ext/intl/calendar/gregoriancalendar_methods.cpp


Diff:

diff --git a/NEWS b/NEWS
index 338409dd70c5..8f462c66a26b 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed a use-after-free when cloning a DOMNameSpaceNode after
     DOMDocument::xinclude(). (iliaal)
 
+- Intl:
+  . Fixed a double-free when IntlGregorianCalendar construction fails after
+    the ICU constructor adopts the TimeZone. (iliaal)
+
 - Opcache:
   . Fixed opcache.protect_memory race under ZTS. (realFlowControl)
 
diff --git a/ext/intl/calendar/gregoriancalendar_methods.cpp b/ext/intl/calendar/gregoriancalendar_methods.cpp
index 0b36e621ef7f..0725cb4582fd 100644
--- a/ext/intl/calendar/gregoriancalendar_methods.cpp
+++ b/ext/intl/calendar/gregoriancalendar_methods.cpp
@@ -168,7 +168,6 @@ static void _php_intlgregcal_constructor_body(
 			if (gcal) {
 				delete gcal;
 			}
-			delete tz;
 			if (!is_constructor) {
 				zval_ptr_dtor(return_value);
 				RETVAL_NULL();