mbstring: Fix memory leak in mail header parsing

A header field name with no value (input ending at the colon) leaves
fld_name allocated but unreleased, since the cleanup blocks only fire
when both fld_name and fld_val are set. Release the dangling fld_name in
both the loop-body and end-of-input branches.

Author: iliaal

ext/mbstring/mbstring.c

@@ -4453,6 +4453,9 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t
 
 								zend_string_release_ex(fld_name, 0);
 							}
+							else if (fld_name != NULL) {
+								zend_string_release_ex(fld_name, 0);
+							}
 
 							fld_name = fld_val = NULL;
 							token = (char*)ps;
@@ -4498,6 +4501,9 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t
 
 			zend_string_release_ex(fld_name, 0);
 		}
+		else if (fld_name != NULL) {
+			zend_string_release_ex(fld_name, 0);
+		}
 	}
 	return state;
 }