From 018c0b3d1460843a4e7bb0842dffd759a7ef5791 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Mon, 16 Sep 2024 20:23:52 +0200
Subject: [PATCH] Fix GH-15908 and GH-15026: leak / assertion failure in
 streams.c

This was first reported as a leak in GH-15026, but was mistakingly
believed to be a false positive. Then an assertion was added and it got
triggered in GH-15908. This fixes the leak. Upon merging into master the
assertion should be removed as well.

Closes GH-15924.
---
 NEWS                                    |  4 +++
 ext/standard/tests/streams/gh15908.phpt | 38 +++++++++++++++++++++++++
 main/streams/streams.c                  |  3 ++
 3 files changed, 45 insertions(+)
 create mode 100644 ext/standard/tests/streams/gh15908.phpt

diff --git a/NEWS b/NEWS
index 9c279d90968..12dbbc7d3ae 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-15613 (overflow on unpack call hex string repeater).
     (David Carlier)
 
+- Streams:
+  . Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
+    (nielsdos)
+
 - XML:
   . Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after
     exception). (nielsdos)
diff --git a/ext/standard/tests/streams/gh15908.phpt b/ext/standard/tests/streams/gh15908.phpt
new file mode 100644
index 00000000000..31714b20530
--- /dev/null
+++ b/ext/standard/tests/streams/gh15908.phpt
@@ -0,0 +1,38 @@
+--TEST--
+GH-15908 (leak / assertion failure in streams.c)
+--CREDITS--
+YuanchengJiang
+LuMingYinDetect
+--FILE--
+<?php
+class TestStream {
+    public $context;
+    private $s = 0;
+    function stream_open($path, $mode, $options, &$opened_path) {
+        return true;
+    }
+    function stream_read($count) {
+        echo "Read done\n";
+        if ($this->s++ == 0)
+            return "a\nbb\ncc";
+        return "";
+    }
+    function stream_eof() {
+        return $this->s >= 2;
+    }
+}
+touch(__DIR__."/gh15908.tmp");
+stream_wrapper_register("test", "TestStream");
+$f = fopen("test://", "r");
+try {
+    file_put_contents(__DIR__."/gh15908.tmp", $f, FILE_USE_INCLUDE_PATH, $f);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__."/gh15908.tmp");
+?>
+--EXPECT--
+file_put_contents(): supplied resource is not a valid Stream-Context resource
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 33f8b7e7a80..e22d9e51d59 100644
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -2175,6 +2175,9 @@ PHPAPI php_stream *_php_stream_open_wrapper_ex(const char *path, const char *mod
 			options &= ~USE_PATH;
 		}
 		if (EG(exception)) {
+			if (resolved_path) {
+				zend_string_release_ex(resolved_path, false);
+			}
 			return NULL;
 		}
 	}