Fix memory leak in tidy output handler on error

Closes phpGH-18649.

Author: ndossche

NEWS

@@ -18,6 +18,9 @@ PHP                                                                        NEWS
 - Soap:
   . Fix memory leaks in php_http.c when call_user_function() fails. (nielsdos)
 
+- Tidy:
+  . Fix memory leak in tidy output handler on error. (nielsdos)
+
 05 Jun 2025, PHP 8.3.22
 
 - Core:

ext/tidy/tidy.c

@@ -965,18 +965,18 @@ static int php_tidy_output_handler(void **nothing, php_output_context *output_co
 	TidyBuffer inbuf, outbuf, errbuf;
 
 	if (TG(clean_output) && (output_context->op & PHP_OUTPUT_HANDLER_START) && (output_context->op & PHP_OUTPUT_HANDLER_FINAL)) {
+		if (ZEND_SIZE_T_UINT_OVFL(output_context->in.used)) {
+			php_error_docref(NULL, E_WARNING, "Input string is too long");
+			return status;
+		}
+
 		doc = tidyCreate();
 		tidyBufInit(&errbuf);
 
 		if (0 == tidySetErrorBuffer(doc, &errbuf)) {
 			tidyOptSetBool(doc, TidyForceOutput, yes);
 			tidyOptSetBool(doc, TidyMark, no);
 
-			if (ZEND_SIZE_T_UINT_OVFL(output_context->in.used)) {
-				php_error_docref(NULL, E_WARNING, "Input string is too long");
-				return status;
-			}
-
 			TIDY_SET_DEFAULT_CONFIG(doc);
 
 			tidyBufInit(&inbuf);