From e71899cb2101279051a56c3cda1f7190cabd815f Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 7 Jun 2026 16:21:59 -0400 Subject: [PATCH] mbstring: Fix memory leak in mail header parsing A header field name with no value (input ending at the colon) leaves fld_name allocated but unreleased, since the cleanup blocks only fire when both fld_name and fld_val are set. Release the dangling fld_name in both the loop-body and end-of-input branches. --- ext/mbstring/mbstring.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c index faa21b11a0f7..8026b69399fd 100644 --- a/ext/mbstring/mbstring.c +++ b/ext/mbstring/mbstring.c @@ -4490,6 +4490,9 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t zend_string_release_ex(fld_name, 0); } + else if (fld_name != NULL) { + zend_string_release_ex(fld_name, 0); + } fld_name = fld_val = NULL; token = (char*)ps; @@ -4535,6 +4538,9 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t zend_string_release_ex(fld_name, 0); } + else if (fld_name != NULL) { + zend_string_release_ex(fld_name, 0); + } } return state; }