Skip to content

[intl] fix leak when iterating IntlBreakIterator parts iterators - #279

Closed
iliaal wants to merge 5 commits into
PHP-8.4from
fix/intl-enum-current-leak-84
Closed

[intl] fix leak when iterating IntlBreakIterator parts iterators#279
iliaal wants to merge 5 commits into
PHP-8.4from
fix/intl-enum-current-leak-84

Conversation

@iliaal

@iliaal iliaal commented Aug 24, 2026

Copy link
Copy Markdown
Owner

Iterating the result of IntlBreakIterator::getPartsIterator() leaked memory on every loop because the IntlPartsIterator object held a counted self-reference through its embedded zend_object_iterator's wrapping_obj, so refcount destruction could never complete; the retained current element was additionally never released at iterator destruction. This makes zoi_with_current_dtor() invalidate the current element and leaves the parts iterator's wrapping_obj UNDEF (as the plain BreakIterator iterator already does), so teardown is now deterministic: repeated 300k-iteration loops went from leaking about 85 MB to a flat zero-delta profile, verified by a new phpt that fails on unpatched builds. Sibling audit: the StringEnumeration iterator path still requires wrapping_obj for owner error handling in move_forward/rewind and keeps its self-reference, and ResourceBundle uses an independent iterator implementation.

lazerg and others added 3 commits August 24, 2026 16:57
sapi_cli_server_send_headers() sent the header buffer through
php_cli_server_client_send_through() but dropped the return value, so it
always reported SAPI_HEADER_SENT_SUCCESSFULLY, even when the send failed
and php_handle_aborted_connection() did not bail out (ignore_user_abort=1).
It now compares the send result against the buffer length and returns
SAPI_HEADER_SEND_FAILED when it comes up short.

php_cli_server_client_send_through() itself returned the number of bytes
left on failure, which equals str_len when nothing was sent: the same
value it returns on success. It now returns the number of bytes actually
sent on both paths.

Since sapi_send_headers() resets headers_sent on SAPI_HEADER_SEND_FAILED,
a headers_written flag on the client guards against rebuilding and
resending the whole header block on every subsequent output write.

Close phpGH-23428
…ams (php#23282)

Keep the native archive state alive independently of the ZipArchive object,
allowing streams to remain valid without retaining the object itself.
@iliaal iliaal closed this Aug 24, 2026
@iliaal iliaal reopened this Aug 24, 2026
iliaal added 2 commits August 25, 2026 18:18
uloc_getKeywordValue failure destroyed the result array and returned
without uenum_close(). Close the enumeration on that path. The success
path already closes it.

Audited the other uenum_close site in this file (acceptLanguage).

Closes phpGH-23351
Iterating getPartsIterator() leaked memory on every loop because the
IntlPartsIterator held a counted self-reference through its embedded
zend_object_iterator's wrapping_obj, so refcount destruction could
never complete, and zoi_with_current_dtor() never released the retained
current element either. zoi_with_current_dtor() now invalidates the
current element and the parts iterator no longer addrefs itself
(wrapping_obj stays UNDEF as in the plain BreakIterator iterator),
making teardown deterministic; the string enumeration iterator keeps
its self-reference because move_forward/rewind need the owner for error
handling.
@iliaal
iliaal force-pushed the fix/intl-enum-current-leak-84 branch from 18be6c0 to be7ba61 Compare August 25, 2026 23:15
@iliaal

iliaal commented Aug 25, 2026

Copy link
Copy Markdown
Owner Author

Promoted as php#23464.

@iliaal iliaal closed this Aug 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants