Free the hooked property value when json_encode() sees an exception

php_json_encode_array() reads a hooked property into a local zval and
bails out when an exception is pending. The get hook can publish its
return value into that zval and then throw while its frame is freed,
for example from the destructor of one of its locals, so the bailout
leaks the value until request shutdown. Destroy it on the way out, the
way the other failure exit already does.

Closes GH-22919

Author: iliaal

ext/json/json_encoder.c

@@ -287,6 +287,7 @@ static zend_result php_json_encode_array(smart_str *buf, zval *val, int options,
 						if (EG(exception)) {
 							PHP_JSON_HASH_UNPROTECT_RECURSION(recursion_rc);
 							zend_release_properties(prop_ht);
+							zval_ptr_dtor(&tmp);
 							return FAILURE;
 						}
 					}

ext/json/tests/json_encode_hooked_property_throwing_getter.phpt

@@ -0,0 +1,44 @@
+--TEST--
+json_encode() releases the hooked property value when the get hook throws
+--FILE--
+<?php
+
+class Value
+{
+    public function __destruct()
+    {
+        echo "Value::__destruct\n";
+    }
+}
+
+class ThrowOnFree
+{
+    public function __destruct()
+    {
+        throw new Exception('thrown while freeing the get hook frame');
+    }
+}
+
+class Container
+{
+    public $hooked {
+        get {
+            $local = new ThrowOnFree();
+            return new Value();
+        }
+    }
+}
+
+try {
+    json_encode(new Container());
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+echo "done\n";
+
+?>
+--EXPECT--
+Value::__destruct
+Exception: thrown while freeing the get hook frame
+done