From 3cd491e19a27986f4f5fa10302beb35ffd550993 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 16 Aug 2026 12:36:22 -0400 Subject: [PATCH] Fix IntlGregorianCalendar double-free of an adopted TimeZone GregorianCalendar(TimeZone*, ...) adopts the zone in the constructor. On U_FAILURE the calendar destructor already deletes that zone, so the extra delete tz is a double free. 8.5 and master carry the same delete, ahead of the unique_ptr destroying the calendar rather than after it. --- NEWS | 4 ++++ ext/intl/calendar/gregoriancalendar_methods.cpp | 1 - 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 338409dd70c5..8f462c66a26b 100644 --- a/NEWS +++ b/NEWS @@ -10,6 +10,10 @@ PHP NEWS . Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude(). (iliaal) +- Intl: + . Fixed a double-free when IntlGregorianCalendar construction fails after + the ICU constructor adopts the TimeZone. (iliaal) + - Opcache: . Fixed opcache.protect_memory race under ZTS. (realFlowControl) diff --git a/ext/intl/calendar/gregoriancalendar_methods.cpp b/ext/intl/calendar/gregoriancalendar_methods.cpp index 0b36e621ef7f..0725cb4582fd 100644 --- a/ext/intl/calendar/gregoriancalendar_methods.cpp +++ b/ext/intl/calendar/gregoriancalendar_methods.cpp @@ -168,7 +168,6 @@ static void _php_intlgregcal_constructor_body( if (gcal) { delete gcal; } - delete tz; if (!is_constructor) { zval_ptr_dtor(return_value); RETVAL_NULL();