From 1422bcd1a1087ba43754329991883da0955f9a34 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Tue, 20 Oct 2026 22:49:22 +0100
Subject: [PATCH] ext/ffi: zend_ffi_create_callback() leaks the error string on
 invalid callbacks.

---
 ext/ffi/ffi.c                       |  1 +
 ext/ffi/tests/callback_invalid.phpt | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 ext/ffi/tests/callback_invalid.phpt

diff --git a/ext/ffi/ffi.c b/ext/ffi/ffi.c
index 79783441c1db..0c6adfb47f42 100644
--- a/ext/ffi/ffi.c
+++ b/ext/ffi/ffi.c
@@ -1018,6 +1018,7 @@ static void *zend_ffi_create_callback(zend_ffi_type *type, zval *value) /* {{{ *
 
 	if (!zend_is_callable_ex(value, NULL, 0, NULL, &fcc, &error)) {
 		zend_throw_error(zend_ffi_exception_ce, "Attempt to assign an invalid callback, %s", error);
+		efree(error);
 		return NULL;
 	}
 
diff --git a/ext/ffi/tests/callback_invalid.phpt b/ext/ffi/tests/callback_invalid.phpt
new file mode 100644
index 000000000000..d01a03b6911c
--- /dev/null
+++ b/ext/ffi/tests/callback_invalid.phpt
@@ -0,0 +1,18 @@
+--TEST--
+FFI: assigning an invalid callback
+--EXTENSIONS--
+ffi
+--INI--
+ffi.enable=1
+--FILE--
+<?php
+$ffi = FFI::cdef('typedef int (*fn)(void);');
+$p = FFI::addr($ffi->new('fn'));
+try {
+    $p[0] = 'nope';
+} catch (FFI\Exception $e) {
+    echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+}
+?>
+--EXPECT--
+FFI\Exception: Attempt to assign an invalid callback, function "nope" not found or invalid function name