From 07f468f4c84b5872f679fb38a149de8217bfc94d Mon Sep 17 00:00:00 2001 From: Sjoerd Langkemper Date: Sun, 26 Jul 2026 19:17:10 +0000 Subject: [PATCH] ext/curl: fix mem leak when duphandle fails in curl_clone_obj Move init_curl_handle so that we don't leak memory if curl_easy_duphandle fails within curl_clone_obj. init_curl_handle allocates things, and curl_free_obj frees that again. But curl_free_obj does nothing if ch->cp is not set. In curl_clone_obj, do the allocation only once we have a valid cp, so that curl_free_obj actually deallocates the memory again. If curl_easy_duphandle fails we have not allocated anything and nothing is cleaned up. --- ext/curl/interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/curl/interface.c b/ext/curl/interface.c index 7fc1c77e9a9a..3d1a22c3821a 100644 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@ -441,7 +441,6 @@ static zend_object *curl_clone_obj(zend_object *object) { clone_object = curl_create_object(curl_ce); clone_ch = curl_from_obj(clone_object); - init_curl_handle(clone_ch); ch = curl_from_obj(object); cp = curl_easy_duphandle(ch->cp); @@ -450,6 +449,7 @@ static zend_object *curl_clone_obj(zend_object *object) { return &clone_ch->std; } + init_curl_handle(clone_ch); clone_ch->cp = cp; _php_setup_easy_copy_handlers(clone_ch, ch);