Fix memory leaks in php_http.c when call_user_function() fails

retval can be refcounted but is not destroyed.

Closes GH-18638.

Author: nielsdos

NEWS

@@ -12,6 +12,9 @@ PHP                                                                        NEWS
   . Fix memory leak when calloc() fails in php_readline_completion_cb().
     (nielsdos)
 
+- Soap:
+  . Fix memory leaks in php_http.c when call_user_function() fails. (nielsdos)
+
 05 Jun 2025, PHP 8.3.22
 
 - Core:

ext/soap/php_http.c

@@ -416,6 +416,7 @@ int make_http_soap_request(zval        *this_ptr,
 			} else {
 				zval_ptr_dtor(&params[0]);
 				zval_ptr_dtor(&func);
+				zval_ptr_dtor(&retval);
 				if (request != buf) {
 					zend_string_release_ex(request, 0);
 				}
@@ -1314,6 +1315,7 @@ int make_http_soap_request(zval        *this_ptr,
 		} else {
 			zval_ptr_dtor(&params[0]);
 			zval_ptr_dtor(&func);
+			zval_ptr_dtor(&retval);
 			efree(content_encoding);
 			zend_string_release_ex(http_headers, 0);
 			zend_string_release_ex(http_body, 0);