Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix memory leak on socket_sendmsg() / socket_recvmsg() error

Author: nikic

ext/sockets/sendrecvmsg.c

@@ -192,14 +192,13 @@ PHP_FUNCTION(socket_sendmsg)
 	res = sendmsg(php_sock->bsd_socket, msghdr, (int)flags);
 
 	if (res != -1) {
-		zend_llist_destroy(allocations);
-		efree(allocations);
-
-		RETURN_LONG((zend_long)res);
+		RETVAL_LONG((zend_long)res);
 	} else {
 		PHP_SOCKET_ERROR(php_sock, "error in sendmsg", errno);
-		RETURN_FALSE;
+		RETVAL_FALSE;
 	}
+
+	allocations_dispose(&allocations);
 }
 
 PHP_FUNCTION(socket_recvmsg)
@@ -246,7 +245,6 @@ PHP_FUNCTION(socket_recvmsg)
 
 		/* we don;t need msghdr anymore; free it */
 		msghdr = NULL;
-		allocations_dispose(&allocations);
 
 		zval_ptr_dtor(zmsg);
 		if (!err.has_error) {
@@ -257,14 +255,15 @@ PHP_FUNCTION(socket_recvmsg)
 			/* no need to destroy/free zres -- it's NULL in this circumstance */
 			assert(zres == NULL);
 		}
+		RETVAL_LONG((zend_long)res);
 	} else {
 		SOCKETS_G(last_error) = errno;
 		php_error_docref(NULL, E_WARNING, "Error in recvmsg [%d]: %s",
 				errno, sockets_strerror(errno));
-		RETURN_FALSE;
+		RETVAL_FALSE;
 	}
 
-	RETURN_LONG((zend_long)res);
+	allocations_dispose(&allocations);
 }
 
 PHP_FUNCTION(socket_cmsg_space)

ext/sockets/tests/socket_sendrecvmsg_error.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Error during socket_sendmsg() or socket_recvmsg()
+--FILE--
+<?php
+
+$socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
+socket_sendmsg($socket, [], -1);
+$message = ['controllen' => 1];
+socket_recvmsg($socket, $message, -1);
+
+?>
+--EXPECTF--
+Warning: socket_sendmsg(): error in sendmsg [%d]: %a in %s on line %d
+
+Warning: socket_recvmsg(): Error in recvmsg [%d]: %a in %s on line %d