[php-src] master: Fix Calendar::createInstance double-free of the adopted TimeZone (#23320)

Author: Ilia Alshanetsky (iliaal) Committer: GitHub (web-flow) Pusher: iliaal Date: 2026-10-05T07:09:26-04:00 Commit: https://github.com/php/php-src/commit/42704147d6d05a9acdd0f076aa9be61516cdd66c Raw diff: https://github.com/php/php-src/commit/42704147d6d05a9acdd0f076aa9be61516cdd66c.diff Fix Calendar::createInstance double-free of the adopted TimeZone (#23320) ICU 57+ Calendar::createInstance wraps the TimeZone in a LocalPointer and deletes it when the calendar cannot be created. PHP deleted the same pointer again on that failure. Drop the extra delete in createInstance and fromDateTime. Changed paths: M NEWS M ext/intl/calendar/calendar_methods.cpp Diff: diff --git a/NEWS b/NEWS index 2595e055ddfe..7d3d54540a3a 100644 --- a/NEWS +++ b/NEWS @@ -15,6 +15,9 @@ PHP NEWS unconstructed Collator. (Ilia Alshanetsky) . Added optional $availableLocales argument to Locale::acceptFromHttp() (GH-24074). (David Carlier) + . Fixed a double-free when Calendar::createInstance() or + IntlCalendar::fromDateTime() fails after adopting a TimeZone. + (Ilia Alshanetsky) - Lexbor: . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a diff --git a/ext/intl/calendar/calendar_methods.cpp b/ext/intl/calendar/calendar_methods.cpp index 0c6e68a65e21..f4c9cb36cded 100644 --- a/ext/intl/calendar/calendar_methods.cpp +++ b/ext/intl/calendar/calendar_methods.cpp @@ -96,7 +96,6 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(intlcal_create_instance) Calendar *cal = Calendar::createInstance(timeZone, Locale::createFromName(locale_str), status); if (UNEXPECTED(cal == NULL)) { - delete timeZone; intl_error_set(NULL, status, "Error creating ICU Calendar object"); RETURN_NULL(); } @@ -1073,7 +1072,6 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(intlcal_from_date_time) cal = Calendar::createInstance(timeZone, Locale::createFromName(locale_str), status); if (UNEXPECTED(cal == NULL)) { - delete timeZone; intl_error_set(NULL, status, "error creating ICU Calendar object"); goto error;