From c161bb0c18f6012795cc7763ac06733b29ae64b0 Mon Sep 17 00:00:00 2001
From: SakiTakamachi <saki@sakiot.com>
Date: Fri, 27 Jun 2025 20:34:09 +0900
Subject: [PATCH] Fix GH-18873 - Free column->descid appropriately (#18957)

fixes #18873
closes #18957
---
 NEWS                        |  4 ++++
 ext/oci8/oci8.c             |  8 ++------
 ext/oci8/tests/gh18873.phpt | 38 +++++++++++++++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 6 deletions(-)
 create mode 100644 ext/oci8/tests/gh18873.phpt

diff --git a/NEWS b/NEWS
index 08be236abbd..814c4692f3d 100644
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,10 @@ PHP                                                                        NEWS
 - MbString:
   . Fixed bug GH-18901 (integer overflow mb_split). (nielsdos)
 
+- OCI8:
+  . Fixed bug GH-18873 (OCI_RETURN_LOBS flag causes oci8 to leak memory).
+    (Saki Takamachi)
+
 - Opcache:
   . Fixed bug GH-18639 (Internal class aliases can break preloading + JIT).
     (nielsdos)
diff --git a/ext/oci8/oci8.c b/ext/oci8/oci8.c
index 01cb1c8ad92..b13843e8666 100644
--- a/ext/oci8/oci8.c
+++ b/ext/oci8/oci8.c
@@ -573,12 +573,8 @@ void php_oci_column_hash_dtor(zval *data)
 		zend_list_close(column->stmtid);
 	}
 
-	if (column->descid) {
-		if (GC_REFCOUNT(column->descid) == 1)
-			zend_list_close(column->descid);
-		else {
-			GC_DELREF(column->descid);
-		}
+	if (column->descid && !GC_DELREF(column->descid)) {
+		zend_list_free(column->descid);
 	}
 
 	if (column->data) {
diff --git a/ext/oci8/tests/gh18873.phpt b/ext/oci8/tests/gh18873.phpt
new file mode 100644
index 00000000000..acd88facb57
--- /dev/null
+++ b/ext/oci8/tests/gh18873.phpt
@@ -0,0 +1,38 @@
+--TEST--
+GH-18873 (OCI_RETURN_LOBS flag causes oci8 to leak memory)
+--EXTENSIONS--
+oci8
+--SKIPIF--
+<?php
+require_once 'skipifconnectfailure.inc';
+if (getenv("USE_ZEND_ALLOC") === "0") die("skip requires ZendMM");
+?>
+--FILE--
+<?php
+require __DIR__.'/connect.inc';
+
+$expectedStr = str_repeat('a', 1_001);
+$sql = 'select concat(TO_CLOB(\'' . str_repeat('a', 1_000) . '\'), TO_CLOB(\'a\')) AS "v" from "DUAL"';
+
+$memUsages = array_flip(range(0, 100 - 1));
+foreach (array_keys($memUsages) as $k) {
+    $stid = oci_parse($c, $sql);
+    oci_execute($stid);
+    $row = oci_fetch_array($stid, \OCI_ASSOC | \OCI_RETURN_LOBS);
+    $res = $row['v'];
+
+    $memUsages[$k] = memory_get_usage();
+}
+
+$memUsages = array_slice($memUsages, 1, null, true);
+$memUsages = array_unique($memUsages);
+
+if (count($memUsages) !== 1) {
+    var_dump($memUsages);
+    throw new \Exception('memory leak detected');
+}
+
+echo "Done!\n";
+?>
+--EXPECT--
+Done!