From 405704c009d5cc1ef14ad2445a99d553f32ae1e0 Mon Sep 17 00:00:00 2001 From: Vibe Nuage Agent Date: Mon, 3 Aug 2026 23:17:16 +0000 Subject: [PATCH] fix: Prevent double-free and memory leaks in validate function - Fix double-free bug where field_name was released twice - Fix memory leak where field_name was not released when field_value is NULL and stop_first_error is false - Fix memory leak where field_name was not released on exception from validate_field_value - Fix memory leak where field_name was not released when valid_value is NULL and stop_first_error is false - Ensure field_name is released in all code paths before returning or continuing This prevents use-after-free errors and memory leaks in the validation logic. Co-authored-by: matapatos --- src/validate_function.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/validate_function.c b/src/validate_function.c index 0b58e71..5d0b8bd 100644 --- a/src/validate_function.c +++ b/src/validate_function.c @@ -176,25 +176,27 @@ ZEND_FUNCTION(validate) if (field_value == NULL) { add_field_error(&errors, field_name, "required field", sizeof("required field") - 1); if (properties.stop_first_error) { - av_throw_validation_exception(&errors); - if (is_to_release_field_name) zend_string_release(field_name); + av_throw_validation_exception(&errors); zval_ptr_dtor(&configs_obj); zval_ptr_dtor(&errors); RETURN_THROWS(); } + // Release field_name when field_value is NULL and we're continuing + if (is_to_release_field_name) zend_string_release(field_name); + continue; } - if (is_to_release_field_name) zend_string_release(field_name); - zval *valid_value = validate_field_value(field_value, prop_info, &errors); if (UNEXPECTED(EG(exception))) { + if (is_to_release_field_name) zend_string_release(field_name); zval_ptr_dtor(&configs_obj); zval_ptr_dtor(&errors); RETURN_THROWS(); } if (valid_value == NULL) { + if (is_to_release_field_name) zend_string_release(field_name); if (!properties.stop_first_error) continue; av_throw_validation_exception(&errors);