From a33d77f8379ac53bc799d06cb0d0f3c44d5dae8a Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Tue, 16 Jun 2026 15:36:11 -0400 Subject: [PATCH] Fix leak of resolved address list in snmp_session_init() When php_network_getaddresses() succeeds but none of the resolved addresses yield a usable peer name (for example bracketed IPv6 syntax over an IPv4-only host), snmp_session_init() returned without calling php_network_freeaddresses(), leaking the address list on every such call. Free it on that error path as the success path already does. Closes GH-22340 --- ext/snmp/snmp.c | 1 + ext/snmp/tests/snmp_resolve_fail_leak.phpt | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 ext/snmp/tests/snmp_resolve_fail_leak.phpt diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c index 22eb6525f8e0..afbdda285ec4 100644 --- a/ext/snmp/snmp.c +++ b/ext/snmp/snmp.c @@ -910,6 +910,7 @@ static bool netsnmp_session_init(php_snmp_session **session_p, int version, zend if (strlen(session->peername) == 0) { php_error_docref(NULL, E_WARNING, "Unknown failure while resolving '%s'", ZSTR_VAL(hostname)); + php_network_freeaddresses(psal); return false; } /* XXX FIXME diff --git a/ext/snmp/tests/snmp_resolve_fail_leak.phpt b/ext/snmp/tests/snmp_resolve_fail_leak.phpt new file mode 100644 index 000000000000..c8793b09e928 --- /dev/null +++ b/ext/snmp/tests/snmp_resolve_fail_leak.phpt @@ -0,0 +1,16 @@ +--TEST-- +snmp: resolved address list is freed when peername resolution drains empty +--EXTENSIONS-- +snmp +--FILE-- + +--EXPECTF-- +Warning: snmpget(): Unknown failure while resolving '[127.0.0.1]' in %s on line %d +bool(false)