Commit 8309d9f12e9 for php

commit 8309d9f12e9a9caac9be9c7e8c6f11100eae0e6b
Author: Daniel Scherzer <daniel.e.scherzer+phpf@gmail.com>
Date:   Thu Oct 1 19:58:04 2026 -0700

    ext/openssl: fix use after free when `psk_client_cb` callback closes stream

diff --git a/ext/openssl/tests/close_in_psk_client_cb_UAF.phpt b/ext/openssl/tests/close_in_psk_client_cb_UAF.phpt
new file mode 100644
index 00000000000..d5d96c9b0b9
--- /dev/null
+++ b/ext/openssl/tests/close_in_psk_client_cb_UAF.phpt
@@ -0,0 +1,61 @@
+--TEST--
+Closing the stream in the `psk_client_cb` callback triggers use after free
+--EXTENSIONS--
+openssl
+--CREDITS--
+Calif.io
+--FILE--
+<?php
+
+$serverCode = <<<'PHP'
+$context = stream_context_create(['ssl' => [
+    'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_SERVER,
+    'ciphers' => 'PSK',
+    'psk_server_cb' => static function ($stream, string $identity): ?Openssl\Psk {
+        if ($identity !== 'audit-client') {
+            return null;
+        }
+
+        return new Openssl\Psk(str_repeat("\x41", 32));
+    },
+]]);
+
+$server = stream_socket_server(
+    'tls://127.0.0.1:0',
+    $errno,
+    $errstr,
+    STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
+    $context,
+);
+phpt_notify_server_start($server);
+@stream_socket_accept($server, 10);
+PHP;
+
+$clientCode = <<<'PHP'
+$context = stream_context_create(['ssl' => [
+    'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
+    'ciphers' => 'PSK',
+    'verify_peer' => false,
+    'verify_peer_name' => false,
+    'psk_client_cb' => static function ($stream): ?Openssl\Psk {
+        fclose($stream);
+
+        return new Openssl\Psk(str_repeat("\x41", 32), 'audit-client');
+    },
+]]);
+
+@stream_socket_client(
+    'tls://{{ ADDR }}',
+    $errno,
+    $errstr,
+    10,
+    STREAM_CLIENT_CONNECT,
+    $context,
+);
+PHP;
+
+require 'ServerClientTestCase.inc';
+ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+
+?>
+--EXPECT--
diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c
index 1df29d007e0..56ae65171b1 100644
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -1790,11 +1790,19 @@ static unsigned int php_openssl_psk_client_cb(SSL *ssl, const char *hint,
 		return 0;
 	}

+	bool originally_no_fclose = stream->flags & PHP_STREAM_FLAG_NO_FCLOSE;
+	stream->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
 	zval result;
 	if (php_openssl_call_psk_cb(stream, &sslsock->psk_callbacks->client_cb,
 			NULL, 0, &result) != SUCCESS) {
+		if (!originally_no_fclose) {
+			stream->flags ^= PHP_STREAM_FLAG_NO_FCLOSE;
+		}
 		return 0;
 	}
+	if (!originally_no_fclose) {
+		stream->flags ^= PHP_STREAM_FLAG_NO_FCLOSE;
+	}

 	if (Z_TYPE(result) == IS_NULL) {
 		return 0;