Fixed by #39751 by KevinJohnHoffman at gmail dot com

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index a61d7c70346d23c8c7a2a87244d1bd01869c11fc..977f59cece1e3f6a6efde319e70737f524aea2ce 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -3837,6 +3837,9 @@ static void php_putenv_destructor(putenv_entry *pe)
                SetEnvironmentVariable(pe->key, "bugbug");
 #endif
                putenv(pe->previous_value);
+# if defined(PHP_WIN32)
+               efree(pe->previous_value);
+# endif
        } else {
 # if HAVE_UNSETENV
                unsetenv(pe->key);
@@ -4430,7 +4433,12 @@ PHP_FUNCTION(putenv)
                pe.previous_value = NULL;
                for (env = environ; env != NULL && *env != NULL; env++) {
                        if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') {  /* found it */
+#if defined(PHP_WIN32)
+                               /* must copy previous value because MSVCRT's putenv can free the string without notice */
+                               pe.previous_value = estrndup(*env, 1024);
+#else
                                pe.previous_value = *env;
+#endif
                                break;
                        }
                }