Fix memory leak in filter_var_array() when a nested element throws

php_filter_array_handler() returns on a pending exception without freeing nval, its copy of the input value, so an array value leaks.
Free it before returning.

Author: eyupcanakman

NEWS

@@ -25,6 +25,10 @@ PHP                                                                        NEWS
 - Curl:
   . Fixed curl_reset() retaining CURLOPT_PRIVATE after reset. (lacatoire)
 
+- Filter:
+  . Fixed memory leak in filter_var_array() and filter_input_array() when
+    filtering a nested array throws. (Eyüp Can Akman)
+
 - MBString:
   . Fixed stack overflow in mb_check_encoding() and mb_convert_encoding() with
     deeply nested arrays. (Eyüp Can Akman)

ext/filter/filter.c

@@ -665,6 +665,7 @@ static void php_filter_array_handler(zval *input, HashTable *op_ht, zend_long op
 					2
 				);
 				if (EG(exception)) {
+					zval_ptr_dtor(&nval);
 					RETURN_THROWS();
 				}
 				zend_hash_update(Z_ARRVAL_P(return_value), arg_key, &nval);

ext/filter/tests/filter_var_array_exception_leak.phpt

@@ -0,0 +1,37 @@
+--TEST--
+filter_var_array() does not leak the filtered value when filtering it throws
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+function leakcheck(callable $fn): bool {
+    $fn();
+    $before = memory_get_usage();
+    for ($i = 0; $i < 2000; $i++) {
+        $fn();
+    }
+    return memory_get_usage() - $before === 0;
+}
+
+var_dump(leakcheck(function () {
+    try {
+        filter_var_array(['a' => ['1', 'x']], ['a' => ['filter' => FILTER_VALIDATE_INT, 'flags' => FILTER_REQUIRE_ARRAY | FILTER_THROW_ON_FAILURE]]);
+    } catch (Filter\FilterFailedException $e) {
+    }
+}));
+
+var_dump(leakcheck(function () {
+    try {
+        filter_var_array(['a' => ['1', 'x']], ['a' => ['filter' => FILTER_CALLBACK, 'options' => function ($value) {
+            if ($value === 'x') {
+                throw new Exception('callback failed');
+            }
+            return $value;
+        }]]);
+    } catch (Exception $e) {
+    }
+}));
+?>
+--EXPECT--
+bool(true)
+bool(true)