intl: Fix leak in umsg_format_helper()

Closes GH-20756.

Author: ndossche

NEWS

@@ -22,6 +22,9 @@ PHP                                                                        NEWS
 - GD:
   . Fixed bug GH-20622 (imagestring/imagestringup overflow). (David Carlier)
 
+- Intl:
+  . Fix leak in umsg_format_helper(). (ndossche)
+
 - LDAP:
   . Fix memory leak in ldap_set_options(). (ndossche)
 

ext/intl/msgformat/msgformat_helpers.cpp

@@ -457,6 +457,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 						char *message;
 						spprintf(&message, 0, "Invalid UTF-8 data in string argument: "
 							"'%s'", ZSTR_VAL(str));
+						zend_tmp_string_release(tmp_str);
 						intl_errors_set(&err, err.code, message, 1);
 						efree(message);
 						delete text;

ext/intl/tests/msgfmt_format_error4.phpt

@@ -14,9 +14,18 @@ $mf = new MessageFormatter('en_US', $fmt);
 var_dump($mf->format(array("foo" => 7, "\x80" => "bar")));
 
 var_dump($mf->format(array("foo" => "\x80")));
+
+var_dump($mf->format(array("foo" => new class {
+    function __toString(): string {
+        return str_repeat("\x80", random_int(1, 1));
+    }
+})));
 --EXPECTF--
 Warning: MessageFormatter::format(): Invalid UTF-8 data in argument key: '€' in %s on line %d
 bool(false)
 
 Warning: MessageFormatter::format(): Invalid UTF-8 data in string argument: '€' in %s on line %d
 bool(false)
+
+Warning: MessageFormatter::format(): Invalid UTF-8 data in string argument: '€' in %s on line %d
+bool(false)