Commit 4fd56dc469f for php

commit 4fd56dc469fd6496af9c3216390b0baae7d0b2cd
Author: berce <75228263+bercedev@users.noreply.github.com>
Date:   Thu Oct 22 00:38:51 2026 +0300

    Fix GH-24508: HTTP wrapper leaks dechunk filter when header parsing fails

    The dechunk filter created for Transfer-Encoding: chunked is only appended to the stream's read filters when a stream comes back. When a later header line fails to parse, the stream is closed and the filter was never freed. Free it when there is no stream to own it.

    Closes GH-24513.

diff --git a/NEWS b/NEWS
index 599891f3b59..db88846f75f 100644
--- a/NEWS
+++ b/NEWS
@@ -125,6 +125,10 @@ PHP                                                                        NEWS
   . Don't share the unserialize() context with enum autoloaders.
     (Nicolas Grekas)

+- Streams:
+  . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
+    parsing fails after Transfer-Encoding). (bercedev)
+
 - Tidy:
   . Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and
     tidy::repairFile() rejecting null for $encoding. (lacatoire)
diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
index 687c2f70d4a..4085a01a955 100644
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -1259,6 +1259,8 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper,
 		if (stream->writepos > stream->readpos) {
 			php_stream_notify_progress_increment(context, stream->writepos - stream->readpos, 0);
 		}
+	} else if (header_info.transfer_encoding) {
+		php_stream_filter_free(header_info.transfer_encoding);
 	}

 	return stream;
diff --git a/ext/standard/tests/http/gh24508.phpt b/ext/standard/tests/http/gh24508.phpt
new file mode 100644
index 00000000000..33f31f47474
--- /dev/null
+++ b/ext/standard/tests/http/gh24508.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-24508 (HTTP wrapper leaks the dechunk filter when header parsing fails after Transfer-Encoding)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif(); ?>
+--FILE--
+<?php
+require 'server.inc';
+
+['pid' => $pid, 'uri' => $uri] = http_server([
+    "data://text/plain,HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nBrokenHeaderNoColon\r\n\r\n",
+]);
+
+var_dump(@file_get_contents($uri));
+
+http_server_kill($pid);
+?>
+--EXPECT--
+bool(false)