Repository navigation
Fix memory leak in filter_var_array() when a nested element throws - #25365
Open
eyupcanakman wants to merge 1 commit into
Open
eyupcanakman wants to merge 1 commit into
eyupcanakman wants to merge 1 commit into
Conversation
php_filter_array_handler() returns on a pending exception without freeing nval, its copy of the input value, so an array value leaks. Free it before returning.
devnexen
reviewed
Nov 11, 2026
| filter | ||
| --FILE-- | ||
| <?php | ||
| function leakcheck(callable $fn): bool { |
Member
There was a problem hiding this comment.
it might be possible to simplify a tad
--- a/ext/filter/tests/filter_var_array_exception_leak.phpt
+++ b/ext/filter/tests/filter_var_array_exception_leak.phpt
@@ -4,34 +4,23 @@
filter
--FILE--
<?php
-function leakcheck(callable $fn): bool {
- $fn();
- $before = memory_get_usage();
- for ($i = 0; $i < 2000; $i++) {
- $fn();
- }
- return memory_get_usage() - $before === 0;
+try {
+ filter_var_array(['a' => ['1', 'x']], ['a' => ['filter' => FILTER_VALIDATE_INT, 'flags' => FILTER_REQUIRE_ARRAY | FILTER_THROW_ON_FAILURE]]);
+} catch (Filter\FilterFailedException $e) {
+ echo $e::class, ': ', $e->getMessage(), PHP_EOL;
}
-var_dump(leakcheck(function () {
- try {
- filter_var_array(['a' => ['1', 'x']], ['a' => ['filter' => FILTER_VALIDATE_INT, 'flags' => FILTER_REQUIRE_ARRAY | FILTER_THROW_ON_FAILURE]]);
- } catch (Filter\FilterFailedException $e) {
- }
-}));
-
-var_dump(leakcheck(function () {
- try {
- filter_var_array(['a' => ['1', 'x']], ['a' => ['filter' => FILTER_CALLBACK, 'options' => function ($value) {
- if ($value === 'x') {
- throw new Exception('callback failed');
- }
- return $value;
- }]]);
- } catch (Exception $e) {
- }
-}));
+try {
+ filter_var_array(['a' => ['1', 'x']], ['a' => ['filter' => FILTER_CALLBACK, 'options' => function ($value) {
+ if ($value === 'x') {
+ throw new Exception('callback failed');
+ }
+ return $value;
+ }]]);
+} catch (Exception $e) {
+ echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+}
?>
--EXPECT--
-bool(true)
-bool(true)
+Filter\FilterFailedException: filter validation failed: filter int not satisfied by 'x'
+Exception: callback failed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
php_filter_array_handler()filters a copy of each input value,nval, and returns as soon as an exception is pending. It never frees that copy, so an array value leaks.On a debug build the exception is followed by
=== Total 2 memory leaks detected ===.A
FILTER_CALLBACKcallback that throws on a nested element leaks the same way, and so doesfilter_input_array(), which uses the same handler. The early return came in withFILTER_THROW_ON_FAILURE, so PHP-8.4 does not have it and does not leak. GH-25349 adds the return to 8.4 with the copy already freed.