ext/phar: Fix memory leak in phar_verify_signature() when md_ctx is invalid

JarneClauw · Girgias · commit 2fe85279a0f7 · 2026-04-20T16:58:42.000+01:00
Closes GH-21750
diff --git a/ext/phar/util.c b/ext/phar/util.c
@@ -1640,6 +1640,7 @@ zend_result phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t s
 				if (md_ctx) {
 					EVP_MD_CTX_destroy(md_ctx);
 				}
+				EVP_PKEY_free(key);
 				if (error) {
 					spprintf(error, 0, "openssl signature could not be verified");
 				}

Original file line number	Diff line number	Diff line change
`@@ -1640,6 +1640,7 @@ zend_result phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t s`
`1640`	`1640`	`if (md_ctx) {`
`1641`	`1641`	`EVP_MD_CTX_destroy(md_ctx);`
`1642`	`1642`	`}`
	`1643`	`+ EVP_PKEY_free(key);`
`1643`	`1644`	`if (error) {`
`1644`	`1645`	`spprintf(error, 0, "openssl signature could not be verified");`
`1645`	`1646`	`}`