From 5ca1d403878b6b173965e1399d04f0013d4481e5 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sun, 16 Aug 2026 11:19:07 -0400
Subject: [PATCH] Fix IntlGregorianCalendar double-free of an adopted TimeZone

GregorianCalendar(TimeZone*, ...) adopts the zone in the constructor.
On U_FAILURE the unique_ptr destructor already deletes the calendar
and its zone. Remove the extra delete tz.
---
 NEWS                                          |  4 ++++
 .../calendar/gregoriancalendar_methods.cpp    |  1 -
 .../gregoriancalendar_adopt_timezone.phpt     | 21 +++++++++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 ext/intl/tests/gregoriancalendar_adopt_timezone.phpt

diff --git a/NEWS b/NEWS
index 9977ea3b3409..3d5adc0db986 100644
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,10 @@ PHP                                                                        NEWS
     left busy for the next fetch, and rows delivered from a result another
     statement took over. (KentarouTakeda)
 
+- Intl:
+  . Fixed a double-free when IntlGregorianCalendar construction fails after
+    the ICU constructor adopts the TimeZone. (iliaal)
+
 - Phar:
   . Fixed Phar archives being automatically detected when ".phar" only occurs
     in a directory name or is not a filename extension in an included file's
diff --git a/ext/intl/calendar/gregoriancalendar_methods.cpp b/ext/intl/calendar/gregoriancalendar_methods.cpp
index aeb728e29de1..9573bdf5d9e7 100644
--- a/ext/intl/calendar/gregoriancalendar_methods.cpp
+++ b/ext/intl/calendar/gregoriancalendar_methods.cpp
@@ -165,7 +165,6 @@ static void _php_intlgregcal_constructor_body(INTERNAL_FUNCTION_PARAMETERS, bool
 		if (U_FAILURE(status)) {
 			intl_error_set(NULL, status, "error creating ICU "
 				"GregorianCalendar from time zone and locale");
-			delete tz;
 			if (!is_constructor) {
 				zval_ptr_dtor(return_value);
 				RETVAL_NULL();
diff --git a/ext/intl/tests/gregoriancalendar_adopt_timezone.phpt b/ext/intl/tests/gregoriancalendar_adopt_timezone.phpt
new file mode 100644
index 000000000000..7afe4290f2ed
--- /dev/null
+++ b/ext/intl/tests/gregoriancalendar_adopt_timezone.phpt
@@ -0,0 +1,21 @@
+--TEST--
+IntlGregorianCalendar timezone-and-locale constructor adopts the TimeZone
+--EXTENSIONS--
+intl
+--INI--
+date.timezone=UTC
+--FILE--
+<?php
+
+$cal = new IntlGregorianCalendar(new DateTimeZone('Europe/Amsterdam'), 'en_US');
+echo $cal->getTimeZone()->getID(), "\n";
+echo $cal->getType(), "\n";
+
+$cal2 = IntlGregorianCalendar::createInstance('UTC', 'en_US');
+echo $cal2->getTimeZone()->getID(), "\n";
+
+?>
+--EXPECT--
+Europe/Amsterdam
+gregorian
+UTC