Commit be6fa2bc48f for php.net

commit be6fa2bc48ff46dd36e168b2339b8fda7e57021b
Merge: 132c0ecc039 0db39103b16
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Wed Aug 5 10:30:47 2026 +0200

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      Fix GH-23043: broken session id code can cause zend_mm_heap corrupted
      session: fix corruption in mod_mm

diff --cc ext/session/session.c
index dd968d453bd,4b1a52442d4..257eec00239
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@@ -442,7 -454,8 +442,8 @@@ static zend_result php_session_initiali
  	/* If there is no ID, use session module to create one */
  	if (!PS(id) || !ZSTR_VAL(PS(id))[0]) {
  		if (PS(id)) {
 -			zend_string_release_ex(PS(id), 0);
 +			zend_string_release_ex(PS(id), false);
+ 			PS(id) = NULL;
  		}
  		PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
  		if (!PS(id)) {
@@@ -458,7 -471,10 +459,10 @@@
  	} else if (PS(use_strict_mode) && PS(mod)->s_validate_sid &&
  		PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE
  	) {
- 		zend_string_release_ex(PS(id), false);
+ 		if (PS(id)) {
 -			zend_string_release_ex(PS(id), 0);
++			zend_string_release_ex(PS(id), false);
+ 			PS(id) = NULL;
+ 		}
  		PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
  		if (!PS(id)) {
  			PS(id) = php_session_create_id(NULL);
@@@ -2418,7 -2424,8 +2422,8 @@@ PHP_FUNCTION(session_regenerate_id
  			int limit = 3;
  			/* Try to generate non-existing ID */
  			while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == SUCCESS) {
 -				zend_string_release_ex(PS(id), 0);
 +				zend_string_release_ex(PS(id), false);
+ 				PS(id) = NULL;
  				PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
  				if (!PS(id)) {
  					PS(mod)->s_close(&PS(mod_data));
diff --cc ext/session/tests/user_session_module/gh23043.phpt
index 00000000000,e3528884a79..dc367699390
mode 000000,100644..100644
--- a/ext/session/tests/user_session_module/gh23043.phpt
+++ b/ext/session/tests/user_session_module/gh23043.phpt
@@@ -1,0 -1,35 +1,35 @@@
+ --TEST--
+ GH-23043 (broken session id code can cause zend_mm_heap corrupted)
+ --EXTENSIONS--
+ session
+ --CREDITS--
+ lmaltsis
+ --FILE--
+ <?php
+ ob_start();
+ class a extends SessionHandler {
+     function read($b): string {
+         return "";
+     }
+     function create_sid(): string {
+         var_dump(session_id());
+         return '';
+     }
+ }
+ $c = new a;
+ session_set_save_handler($c);
+ session_start();
+ session_write_close();
+ session_start();
+ ?>
+ --EXPECTF--
+ string(0) ""
+
+ Warning: SessionHandler::write(): Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
+
 -Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: a::write) in %s on line %d
++Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: ) in %s on line %d
+ string(0) ""
+
+ Warning: SessionHandler::write(): Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in Unknown on line 0
+
 -Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: a::write) in Unknown on line 0
++Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: ) in Unknown on line 0