From 5961e1b2018eda3686e68e30eb972c73269e6ee1 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 27 Apr 2026 07:53:03 -0400
Subject: [PATCH] ext/xsl: free libxslt buffer when transformToXml output is
 empty

If xsltSaveResultToString sets doc_txt_ptr to a non-NULL allocation
but doc_txt_len to zero, the previous gate skipped xmlFree and leaked
the buffer. Current libxslt (1.1.34) sets both to NULL/0 in that case,
so this is latent today; the fix removes the dependency on that
convention.
---
 ext/xsl/xsltprocessor.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/ext/xsl/xsltprocessor.c b/ext/xsl/xsltprocessor.c
index 71971332a251..4a259f5940ee 100644
--- a/ext/xsl/xsltprocessor.c
+++ b/ext/xsl/xsltprocessor.c
@@ -547,8 +547,10 @@ PHP_METHOD(XSLTProcessor, transformToXml)
 	ret = -1;
 	if (newdocp) {
 		ret = xsltSaveResultToString(&doc_txt_ptr, &doc_txt_len, newdocp, sheetp);
-		if (doc_txt_ptr && doc_txt_len) {
-			RETVAL_STRINGL((char *) doc_txt_ptr, doc_txt_len);
+		if (doc_txt_ptr) {
+			if (doc_txt_len > 0) {
+				RETVAL_STRINGL((char *) doc_txt_ptr, doc_txt_len);
+			}
 			xmlFree(doc_txt_ptr);
 		}
 		xmlFreeDoc(newdocp);