Commit 61a1b9afd6d for php.net

commit 61a1b9afd6d13dea806289c45ee95d6611560499
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Sun Jun 7 16:21:59 2026 -0400

    mbstring: Fix memory leak in mail header parsing

    A header field name with no value (input ending at the colon) leaves
    fld_name allocated but unreleased, since the cleanup blocks only fire
    when both fld_name and fld_val are set. Release the dangling fld_name in
    both the loop-body and end-of-input branches.

    Closes GH-22254

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index e90b43f156a..c3394e79f02 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4444,12 +4444,14 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t
 								fld_val = zend_string_init(token, token_pos, 0);
 							}

-							if (fld_name != NULL && fld_val != NULL) {
-								zval val;
-								zend_str_tolower(ZSTR_VAL(fld_name), ZSTR_LEN(fld_name));
-								ZVAL_STR(&val, fld_val);
+							if (fld_name != NULL) {
+								if (fld_val != NULL) {
+									zval val;
+									zend_str_tolower(ZSTR_VAL(fld_name), ZSTR_LEN(fld_name));
+									ZVAL_STR(&val, fld_val);

-								zend_hash_update(ht, fld_name, &val);
+									zend_hash_update(ht, fld_name, &val);
+								}

 								zend_string_release_ex(fld_name, 0);
 							}
@@ -4490,11 +4492,13 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t
 		if(token && token_pos > 0) {
 			fld_val = zend_string_init(token, token_pos, 0);
 		}
-		if (fld_name != NULL && fld_val != NULL) {
-			zval val;
-			zend_str_tolower(ZSTR_VAL(fld_name), ZSTR_LEN(fld_name));
-			ZVAL_STR(&val, fld_val);
-			zend_hash_update(ht, fld_name, &val);
+		if (fld_name != NULL) {
+			if (fld_val != NULL) {
+				zval val;
+				zend_str_tolower(ZSTR_VAL(fld_name), ZSTR_LEN(fld_name));
+				ZVAL_STR(&val, fld_val);
+				zend_hash_update(ht, fld_name, &val);
+			}

 			zend_string_release_ex(fld_name, 0);
 		}