Merge branch 'PHP-8.5'

* PHP-8.5:
  Fixing memory leak in zif_openssl_seal and zif_openssl_open when fetching cipher with php_openssl_get_evp_cipher_by_name (#21967)
  Fixing memory leak in php_openssl_x509_fingerprint when getting mdtype with php_openssl_get_evp_md_by_name (#21965)
  Fixing memory leak in openssl_pkcs12_read when zout initialisation fails (#21752)

Author: ndossche

ext/openssl/openssl.c

@@ -1911,6 +1911,7 @@ PHP_FUNCTION(openssl_pkcs12_read)
 
 		zout = zend_try_array_init(zout);
 		if (!zout) {
+			sk_X509_pop_free(ca, X509_free);
 			goto cleanup;
 		}
 
@@ -4697,6 +4698,7 @@ PHP_FUNCTION(openssl_seal)
 
 	iv_len = EVP_CIPHER_iv_length(cipher);
 	if (!iv && iv_len > 0) {
+		php_openssl_release_evp_cipher(cipher);
 		zend_argument_value_error(6, "cannot be null for the chosen cipher algorithm");
 		RETURN_THROWS();
 	}
@@ -4783,6 +4785,7 @@ PHP_FUNCTION(openssl_seal)
 	efree(eks);
 	efree(eksl);
 	efree(pkeys);
+	php_openssl_release_evp_cipher(cipher);
 }
 /* }}} */
 
@@ -4859,6 +4862,7 @@ PHP_FUNCTION(openssl_open)
 	EVP_CIPHER_CTX_free(ctx);
 out_pkey:
 	EVP_PKEY_free(pkey);
+	php_openssl_release_evp_cipher(cipher);
 }
 /* }}} */
 

ext/openssl/openssl_backend_common.c

@@ -593,6 +593,7 @@ zend_string* php_openssl_x509_fingerprint(X509 *peer, const char *method, bool r
 		php_error_docref(NULL, E_WARNING, "Unknown digest algorithm");
 		return NULL;
 	} else if (!X509_digest(peer, mdtype, md, &n)) {
+		php_openssl_release_evp_md(mdtype);
 		php_openssl_store_errors();
 		php_error_docref(NULL, E_ERROR, "Could not generate signature");
 		return NULL;
@@ -606,6 +607,7 @@ zend_string* php_openssl_x509_fingerprint(X509 *peer, const char *method, bool r
 		ZSTR_VAL(ret)[n * 2] = '\0';
 	}
 
+	php_openssl_release_evp_md(mdtype);
 	return ret;
 }
 

ext/openssl/tests/openssl_pkcs12_read_array_init.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Memory leak when array initialization in openssl_pkcs12_read() fails
+--EXTENSIONS--
+openssl
+--FILE--
+<?php
+$pfx = __DIR__ . DIRECTORY_SEPARATOR . "bug74022.pfx";
+$cert_store = file_get_contents($pfx);
+
+class Typed {
+    public string $foo = "bar";
+}
+
+$typed = new Typed;
+
+try {
+    openssl_pkcs12_read($cert_store, $typed->foo, "csos");
+} catch (TypeError $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+TypeError: Cannot assign array to reference held by property Typed::$foo of type string