From a44e3f442f3e52d35e4e8606785b52433fc78f37 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 24 May 2025 16:19:53 +0200
Subject: [PATCH] Fix memory leaks in php_http.c when call_user_function()
 fails

retval can be refcounted but is not destroyed.

Closes GH-18638.
---
 NEWS                | 3 +++
 ext/soap/php_http.c | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/NEWS b/NEWS
index fc7e534d604..c533ad33e49 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,9 @@ PHP                                                                        NEWS
   . Fix memory leak when calloc() fails in php_readline_completion_cb().
     (nielsdos)
 
+- Soap:
+  . Fix memory leaks in php_http.c when call_user_function() fails. (nielsdos)
+
 05 Jun 2025, PHP 8.3.22
 
 - Core:
diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
index 00aa54c83ef..c908bb4d8ff 100644
--- a/ext/soap/php_http.c
+++ b/ext/soap/php_http.c
@@ -416,6 +416,7 @@ int make_http_soap_request(zval        *this_ptr,
 			} else {
 				zval_ptr_dtor(&params[0]);
 				zval_ptr_dtor(&func);
+				zval_ptr_dtor(&retval);
 				if (request != buf) {
 					zend_string_release_ex(request, 0);
 				}
@@ -1314,6 +1315,7 @@ try_again:
 		} else {
 			zval_ptr_dtor(&params[0]);
 			zval_ptr_dtor(&func);
+			zval_ptr_dtor(&retval);
 			efree(content_encoding);
 			zend_string_release_ex(http_headers, 0);
 			zend_string_release_ex(http_body, 0);