[php-src] Issue #24530: Latent memory leak in ext/ffi:zend_ffi_make_pointer_type() when validate_vla fails

Issue: https://github.com/php/php-src/issues/24530 Author: matyapiro31 ### Description ## Summary zend_ffi_make_pointer_type() in ext/ffi/ffi.c allocates type via pemalloc() (line 6358) *before* calling zend_ffi_validate_vla(). If validation fails the function calls zend_ffi_cleanup_dcl(dcl) and LONGJMP() without freeing type, leaking sizeof(zend_ffi_type) bytes. ## Impact Currently **unreachable** in practice. make_pointer_type is only called from the pointer grammar rule, which runs before array_or_function_declarators; thus dcl->type never carries ZEND_FFI_ATTR_VLA at that point and validate_vla always succeeds. However the pattern is inconsistent with the sibling functions zend_ffi_make_array_type() and zend_ffi_make_func_type(), which both pemalloc *after* all validation. A future refactor could accidentally make the failure path reachable. ## Fix Either add a pefree before LONGJMP: ```c if (zend_ffi_validate_vla(ZEND_FFI_TYPE(dcl->type)) == FAILURE) { pefree(type, FFI_G(persistent)); // add this zend_ffi_cleanup_dcl(dcl); LONGJMP(FFI_G(bailout), FAILURE); } ### PHP Version ```plain PHP 8.5.12 (cli) (built: Oct 21 2026 22:48:15) (NTS) Copyright (c) The PHP Group Zend Engine v4.5.12, Copyright (c) Zend Technologies with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies ``` ### Operating System Windows 11 26H2