From e35ddcab19cb3c035906467290d90abdc4b30dd4 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sun, 7 Jun 2026 16:40:20 -0400
Subject: [PATCH] readline: Fix memory leak in interactive shell INI directive

The readline() buffer is not freed on the #name=value INI-directive
branch before continue, unlike the sibling branches.
---
 ext/readline/readline_cli.c                   |  1 +
 .../tests/readline_cli_ini_directive.phpt     | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 ext/readline/tests/readline_cli_ini_directive.phpt

diff --git a/ext/readline/readline_cli.c b/ext/readline/readline_cli.c
index 2b0950784bf2..ca4e8eb4fe9f 100644
--- a/ext/readline/readline_cli.c
+++ b/ext/readline/readline_cli.c
@@ -662,6 +662,7 @@ static int readline_shell_run(void) /* {{{ */
 				zend_string_release_ex(prompt, 0);
 				/* TODO: This might be wrong! */
 				prompt = cli_get_prompt("php", '>');
+				free(line);
 				continue;
 			}
 		}
diff --git a/ext/readline/tests/readline_cli_ini_directive.phpt b/ext/readline/tests/readline_cli_ini_directive.phpt
new file mode 100644
index 000000000000..ebf4ac10a281
--- /dev/null
+++ b/ext/readline/tests/readline_cli_ini_directive.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Interactive shell: setting an INI directive via #name=value
+--EXTENSIONS--
+readline
+--SKIPIF--
+<?php
+if (!function_exists('proc_open')) die('skip proc_open() not available');
+?>
+--FILE--
+<?php
+$php = getenv('TEST_PHP_EXECUTABLE');
+$ini = getenv('TEST_PHP_EXTRA_ARGS');
+$descriptorspec = [['pipe', 'r'], STDOUT, STDERR];
+$proc = proc_open("$php $ini -a", $descriptorspec, $pipes);
+fwrite($pipes[0], "#precision=5\n");
+fwrite($pipes[0], "echo 'INI[' . ini_get('precision') . ']';\n");
+fclose($pipes[0]);
+proc_close($proc);
+?>
+--EXPECTF--
+%AINI[5]%A