From a865cb30ded41e06b56a23211cc1180b4b86fe78 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Sat, 8 Nov 2025 17:39:42 +0100
Subject: [PATCH] Fix memory leak in array_diff() with custom type checks

---
 ext/standard/array.c                               |  1 +
 .../array/array_diff_leak_custom_type_checks.phpt  | 14 ++++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4896ac44a727d..37c80e0989caa 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -5762,6 +5762,7 @@ PHP_FUNCTION(array_diff)
 
 		for (i = 1; i < argc; i++) {
 			if (Z_TYPE(args[i]) != IS_ARRAY) {
+				zend_tmp_string_release(tmp_search_str);
 				zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
 				RETURN_THROWS();
 			}
diff --git a/ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt b/ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt
new file mode 100644
index 0000000000000..77aef0ccc08b2
--- /dev/null
+++ b/ext/standard/tests/array/array_diff_leak_custom_type_checks.phpt
@@ -0,0 +1,14 @@
+--TEST--
+array_diff() memory leak with custom type checks
+--FILE--
+<?php
+
+try {
+    array_diff([123], 'x');
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+array_diff(): Argument #2 must be of type array, string given