From 8f52ffc4e6de0db125d23296e2628a299320e134 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 17 Aug 2026 20:40:15 -0400
Subject: [PATCH] Close the keyword UEnumeration on Locale::getKeywords failure

uloc_getKeywordValue failure destroyed the result array and returned
without uenum_close(). Close the enumeration on that path. The success
path already closes it.

Audited the other uenum_close site in this file (acceptLanguage).
---
 NEWS                                           |  2 ++
 ext/intl/locale/locale_methods.c               |  1 +
 .../tests/locale_get_keywords_failure.phpt     | 18 ++++++++++++++++++
 3 files changed, 21 insertions(+)
 create mode 100644 ext/intl/tests/locale_get_keywords_failure.phpt

diff --git a/NEWS b/NEWS
index 5ab1602dbd69..97057e27d310 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ PHP                                                                        NEWS
     the ICU constructor adopts the TimeZone. (iliaal)
   . Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions
     for UTF-8 strings). (ColumbusLabs)
+  . Fixed a leak in Locale::getKeywords() when a keyword value cannot be
+    read. (iliaal)
 
 - Opcache:
   . Fixed opcache.protect_memory race under ZTS. (realFlowControl)
diff --git a/ext/intl/locale/locale_methods.c b/ext/intl/locale/locale_methods.c
index b5d48257338a..bfcf4dd86316 100644
--- a/ext/intl/locale/locale_methods.c
+++ b/ext/intl/locale/locale_methods.c
@@ -776,6 +776,7 @@ PHP_FUNCTION( locale_get_keywords )
 					zend_string_efree( kw_value_str );
 				}
 				zend_array_destroy(Z_ARR_P(return_value));
+				uenum_close( e );
 				RETURN_FALSE;
 			}
 
diff --git a/ext/intl/tests/locale_get_keywords_failure.phpt b/ext/intl/tests/locale_get_keywords_failure.phpt
new file mode 100644
index 000000000000..823da63ca541
--- /dev/null
+++ b/ext/intl/tests/locale_get_keywords_failure.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Locale::getKeywords() closes the keyword enumeration on failure
+--EXTENSIONS--
+intl
+--SKIPIF--
+<?php
+if (version_compare(INTL_ICU_VERSION, '59.1', '<')) {
+    die('skip for ICU >= 59.1');
+}
+?>
+--FILE--
+<?php
+var_dump(Locale::getKeywords('en@foo=bar!'));
+var_dump(intl_get_error_code() === U_ILLEGAL_ARGUMENT_ERROR);
+?>
+--EXPECT--
+bool(false)
+bool(true)