From 69dacd6d7f71c0412e6e94a454b59abbd0ff86da Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sat, 29 Aug 2026 08:15:41 -0400
Subject: [PATCH] [intl] Fix leak of time zone wrapper in Calendar debug info

Calendar_get_debug_info() built a temporary IntlTimeZone wrapper zval
via timezone_object_construct() and never released it, leaking one
wrapper object per var_dump()/debug dump of an IntlCalendar. Release
the wrapper with zval_ptr_dtor() after its debug info has been copied.
Sibling audit: all other timezone_object_construct() call sites write
into return_value and are refcount-managed; no other intl get_debug_info
handler constructs temporary wrapper objects.
---
 NEWS                                           |  1 +
 ext/intl/calendar/calendar_class.cpp           |  2 ++
 .../tests/calendar_get_debug_info_tz_leak.phpt | 18 ++++++++++++++++++
 3 files changed, 21 insertions(+)
 create mode 100644 ext/intl/tests/calendar_get_debug_info_tz_leak.phpt

diff --git a/NEWS b/NEWS
index 519b0ccaf053..646759fd0ce6 100644
--- a/NEWS
+++ b/NEWS
@@ -30,6 +30,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-19320 (FPM UID and GID overflow). (Pratik Bhujel)
 
 - Intl:
+  . Fixed a memory leak when dumping IntlCalendar instances. (iliaal)
   . Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator()
     results. (iliaal)
   . Fixed a double-free when IntlGregorianCalendar construction fails after
diff --git a/ext/intl/calendar/calendar_class.cpp b/ext/intl/calendar/calendar_class.cpp
index 97b21ff8f965..bacb549bdbc6 100644
--- a/ext/intl/calendar/calendar_class.cpp
+++ b/ext/intl/calendar/calendar_class.cpp
@@ -171,6 +171,8 @@ static HashTable *Calendar_get_debug_info(zend_object *object, int *is_temp)
 		FREE_HASHTABLE(debug_info_tz);
 
 		zend_hash_str_update(debug_info, "timeZone", sizeof("timeZone") - 1, &ztz_debug);
+
+		zval_ptr_dtor(&ztz);
 	}
 
 	{
diff --git a/ext/intl/tests/calendar_get_debug_info_tz_leak.phpt b/ext/intl/tests/calendar_get_debug_info_tz_leak.phpt
new file mode 100644
index 000000000000..6fea07e1408e
--- /dev/null
+++ b/ext/intl/tests/calendar_get_debug_info_tz_leak.phpt
@@ -0,0 +1,18 @@
+--TEST--
+IntlCalendar get_debug_info() must not leak the time zone wrapper object
+--EXTENSIONS--
+intl
+--FILE--
+<?php
+$cal = IntlCalendar::createInstance('UTC');
+$m0 = memory_get_usage();
+for ($i = 0; $i < 1000; $i++) {
+	ob_start();
+	var_dump($cal);
+	ob_end_clean();
+}
+$m1 = memory_get_usage();
+var_dump($m1 - $m0 < 10000);
+?>
+--EXPECT--
+bool(true)