Commit 9a7c09c9639 for php.net

commit 9a7c09c9639afd333d9c01894972988fb9d58d70
Author: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date:   Sun Dec 21 23:37:02 2025 +0100

    intl: Fix leak in umsg_format_helper()

    Closes GH-20756.

diff --git a/NEWS b/NEWS
index ecdd051c5d6..b52e9b1a136 100644
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,9 @@ PHP                                                                        NEWS
 - GD:
   . Fixed bug GH-20622 (imagestring/imagestringup overflow). (David Carlier)

+- Intl:
+  . Fix leak in umsg_format_helper(). (ndossche)
+
 - LDAP:
   . Fix memory leak in ldap_set_options(). (ndossche)

diff --git a/ext/intl/msgformat/msgformat_helpers.cpp b/ext/intl/msgformat/msgformat_helpers.cpp
index fbd85b857f3..58e2a96bf23 100644
--- a/ext/intl/msgformat/msgformat_helpers.cpp
+++ b/ext/intl/msgformat/msgformat_helpers.cpp
@@ -457,6 +457,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 						char *message;
 						spprintf(&message, 0, "Invalid UTF-8 data in string argument: "
 							"'%s'", ZSTR_VAL(str));
+						zend_tmp_string_release(tmp_str);
 						intl_errors_set(&err, err.code, message, 1);
 						efree(message);
 						delete text;
diff --git a/ext/intl/tests/msgfmt_format_error4.phpt b/ext/intl/tests/msgfmt_format_error4.phpt
index 08b52d8ba42..ee84388f4a7 100644
--- a/ext/intl/tests/msgfmt_format_error4.phpt
+++ b/ext/intl/tests/msgfmt_format_error4.phpt
@@ -14,9 +14,18 @@
 var_dump($mf->format(array("foo" => 7, "\x80" => "bar")));

 var_dump($mf->format(array("foo" => "\x80")));
+
+var_dump($mf->format(array("foo" => new class {
+    function __toString(): string {
+        return str_repeat("\x80", random_int(1, 1));
+    }
+})));
 --EXPECTF--

 bool(false)


 bool(false)
+

+bool(false)