[GIT-PULLS] [php-src] PR #22788: Free unbound arguments when partial application construction throws

[email protected] (iliaal) Fri, 17 Jul 2026 14:41:57 +0000
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22788
Author: iliaal

The ZEND_CALLABLE_CONVERT_PARTIAL handler relies on zp_bind() to move each pre-bound argument into the partial closure and never frees positional arguments itself. When construction throws before an argument is moved, either a NULL op_array (argument count error, unknown default value, forbidden dynamic call) or a bound-argument type error, the unmoved arguments were owned by nobody and leaked. A try/catch loop over a failing partial with refcounted arguments leaks within the request until memory_limit. Free the arguments that were not moved at each throwing path.

Reproducer, definitely-lost blocks under valgrind before the fix, clean after:

php -r 'function f(int $a, $b, $c){} for ($i=0;$i<200;$i++){ try { f([1], new stdClass, ?); } catch (\Throwable $e) {} }'