Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
  Fixed GH-17398: bcmul memory leak (#17615)

NEWS

@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.5
 
+- BCMath:
+  . Fixed bug GH-17398 (bcmul memory leak). (SakiTakamachi)
+
 - DOM:
   . Fixed bug GH-17609 (Typo in error message: Dom\NO_DEFAULT_NS instead of
     Dom\HTML_NO_DEFAULT_NS). (nielsdos)

ext/bcmath/bcmath.c

@@ -109,9 +109,9 @@ static PHP_GINIT_FUNCTION(bcmath)
 /* {{{ PHP_GSHUTDOWN_FUNCTION */
 static PHP_GSHUTDOWN_FUNCTION(bcmath)
 {
-	_bc_free_num_ex(&bcmath_globals->_zero_, 1);
-	_bc_free_num_ex(&bcmath_globals->_one_, 1);
-	_bc_free_num_ex(&bcmath_globals->_two_, 1);
+	bc_force_free_number(&bcmath_globals->_zero_);
+	bc_force_free_number(&bcmath_globals->_one_);
+	bc_force_free_number(&bcmath_globals->_two_);
 	bcmath_globals->arena = NULL;
 	bcmath_globals->arena_offset = 0;
 }

ext/bcmath/libbcmath/src/bcmath.h

@@ -83,6 +83,8 @@ typedef struct bc_struct {
 
 void bc_init_numbers(void);
 
+void bc_force_free_number(bc_num *num);
+
 bc_num _bc_new_num_ex(size_t length, size_t scale, bool persistent);
 
 bc_num _bc_new_num_nonzeroed_ex(size_t length, size_t scale, bool persistent);

ext/bcmath/libbcmath/src/init.c

@@ -97,6 +97,13 @@ void bc_init_numbers(void)
 	BCG(_two_)->n_value[0] = 2;
 }
 
+void bc_force_free_number(bc_num *num)
+{
+	pefree((*num)->n_ptr, 1);
+	pefree(*num, 1);
+	*num = NULL;
+}
+
 
 /* Initialize a number NUM by making it a copy of zero. */
 void bc_init_num(bc_num *num)

ext/bcmath/tests/gh17398.phpt

@@ -0,0 +1,10 @@
+--TEST--
+GH-17398 (bcmul memory leak)
+--EXTENSIONS--
+bcmath
+--FILE--
+<?php
+bcmul('0', '0', 2147483647);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of %d bytes exhausted%s(tried to allocate %d bytes) in %s on line %d