Commit d9d991928f0 for php.net

commit d9d991928f03c493de524ae19608e7f10373ee6e
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Fri May 30 21:03:41 2025 +0200

    Fix memory leak when curl_slist_append() fails

    If curl_slist_append() returns NULL, then the original pointer is lost
    and not freed.

    Closes GH-18711.

diff --git a/NEWS b/NEWS
index 3b3900afff9..4088849616b 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed GH-18695 (zend_ast_export() - float number is not preserved).
     (Oleg Efimov)

+- Curl:
+  . Fix memory leak when setting a list via curl_setopt fails. (nielsdos)
+
 - Date:
   . Fix leaks with multiple calls to DatePeriod iterator current(). (nielsdos)

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 1a270a1c32c..61d830e8abf 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -2220,12 +2220,14 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
 			ZEND_HASH_FOREACH_VAL(ph, current) {
 				ZVAL_DEREF(current);
 				val = zval_get_tmp_string(current, &tmp_val);
-				slist = curl_slist_append(slist, ZSTR_VAL(val));
+				struct curl_slist *new_slist = curl_slist_append(slist, ZSTR_VAL(val));
 				zend_tmp_string_release(tmp_val);
-				if (!slist) {
+				if (!new_slist) {
+					curl_slist_free_all(slist);
 					php_error_docref(NULL, E_WARNING, "Could not build curl_slist");
 					return FAILURE;
 				}
+				slist = new_slist;
 			} ZEND_HASH_FOREACH_END();

 			if (slist) {