memory audit fixes

[rlerdorf]

Memory safety audit fixing 6 issues found via code review and verified with valgrind (USE_ZEND_ALLOC=0):

1. Double free in destructor (oauth.c) — headers_in and headers_out freed twice in so_object_free_storage(). Removed duplicate frees.

2. Dangling pointers in multipart storage (oauth.c) — multipart_files[] and multipart_params[] stored raw Z_STRVAL_P() / ZSTR_VAL() pointers without copying. Now uses estrdup() with proper per-element efree() in cleanup.

3. Invalid free of shifted multipart pointers (oauth.c) — make_req_curl() mutated stored multipart_params[i] pointers with ++ (to skip leading @), then cleanup called efree() on the shifted (non-base) pointer. Now uses local param_name variable for the @ chomp instead of mutating stored pointers.

4. Multipart cleanup unreachable on exception (oauth.c) — Added multipart array cleanup to so_object_free_storage() as a safety net for exception paths.

5. Memory leak in provider auth header parsing (provider.c) — estrndup() result never freed after ZVAL_STRINGL copied it. s_auth_header zend_string leaked on all paths. Fixed both, plus proper cleanup on FAILURE return.

6. Memory leak in provider callback registration (provider.c) — cb and cb->fcall_info leaked on invalid callback type.

[Copilot]

Pull request overview

Memory-safety focused changes in the PHP OAuth extension to fix leaks/double-frees identified during audit/valgrind runs, primarily around provider auth header parsing, callback registration error paths, and multipart request bookkeeping.

Changes:

• Fix leaked temporary buffers / zvals in oauth_provider_parse_auth_header() and add cleanup on failure paths.
• Fix callback registration allocation leaks on invalid callback type.
• Make multipart key/value storage own its strings (estrdup) and add cleanup in both request teardown and object destructor; remove duplicate smart_string frees.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
provider.c	Adds missing frees/dtors in auth header parsing and frees callback allocations on invalid type.
oauth.c	Removes duplicate header frees; duplicates multipart strings and frees multipart allocations after curl and in object destructor.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.