Commit 010d6e2277d for php

commit 010d6e2277dc7bce68627f541e638412425e4aef
Author: Daniel Scherzer <daniel.e.scherzer+phpf@gmail.com>
Date:   Thu Oct 1 20:02:38 2026 -0700

    ext/openssl: fix use after free when `session_get_cb` callback closes stream

diff --git a/ext/openssl/tests/close_in_session_get_cb_UAF.phpt b/ext/openssl/tests/close_in_session_get_cb_UAF.phpt
new file mode 100644
index 00000000000..edf926c19c1
--- /dev/null
+++ b/ext/openssl/tests/close_in_session_get_cb_UAF.phpt
@@ -0,0 +1,103 @@
+--TEST--
+Closing the stream in the `session_get_cb` callback triggers use after free
+--EXTENSIONS--
+openssl
+--CREDITS--
+Calif.io
+--CLEAN--
+<?php
+
+$certFile = sys_get_temp_dir() . '/php-audit-session-get-' . getmypid() . '.pem';
+@unlink($certFile);
+?>
+--FILE--
+<?php
+
+$certFile = sys_get_temp_dir() . '/php-audit-session-get-' . getmypid() . '.pem';
+
+$serverCode = <<<'PHP'
+$sessions = [];
+$context = stream_context_create(['ssl' => [
+    'local_cert' => '%s',
+    'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_SERVER,
+    'session_id_context' => 'audit-session-get',
+    'session_new_cb' => static function ($stream, $session) use (&$sessions): void {
+        $sessions[bin2hex($session->id)] = $session;
+    },
+    'session_get_cb' => static function ($stream, string $sessionId) use (&$sessions) {
+        $session = $sessions[bin2hex($sessionId)] ?? null;
+        fclose($stream);
+
+        return $session;
+    },
+]]);
+
+$server = stream_socket_server(
+    'tls://127.0.0.1:0',
+    $errno,
+    $errstr,
+    STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
+    $context,
+);
+phpt_notify_server_start($server);
+
+for ($i = 0; $i < 2; $i++) {
+    $client = @stream_socket_accept($server, 10);
+    if ($client) {
+        fwrite($client, "response\n");
+        fclose($client);
+    }
+}
+PHP;
+$serverCode = sprintf($serverCode, $certFile);
+
+$clientCode = <<<'PHP'
+$session = null;
+$context = stream_context_create(['ssl' => [
+    'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
+    'verify_peer' => false,
+    'verify_peer_name' => false,
+    'session_new_cb' => static function ($stream, $newSession) use (&$session): void {
+        $session = $newSession;
+    },
+]]);
+
+$first = stream_socket_client(
+    'tls://{{ ADDR }}',
+    $errno,
+    $errstr,
+    10,
+    STREAM_CLIENT_CONNECT,
+    $context,
+);
+if ($first) {
+    @fgets($first);
+    fclose($first);
+}
+
+$resumeContext = stream_context_create(['ssl' => [
+    'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
+    'verify_peer' => false,
+    'verify_peer_name' => false,
+    'session_data' => $session,
+]]);
+
+@stream_socket_client(
+    'tls://{{ ADDR }}',
+    $errno,
+    $errstr,
+    10,
+    STREAM_CLIENT_CONNECT,
+    $resumeContext,
+);
+PHP;
+
+require 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveNewCertAsFileWithKey('audit_session_get', $certFile);
+
+require 'ServerClientTestCase.inc';
+ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+
+?>
+--EXPECT--
diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c
index c67517b06c7..c1b586e5e56 100644
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -2276,7 +2276,12 @@ static SSL_SESSION *php_openssl_session_get_cb(SSL *ssl, const unsigned char *se

 	SSL_SESSION *session = NULL;

+	bool originally_no_fclose = stream->flags & PHP_STREAM_FLAG_NO_FCLOSE;
+	stream->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
 	zend_call_known_fcc(&sslsock->session_callbacks->get_cb, &retval, 2, args, NULL);
+	if (!originally_no_fclose) {
+		stream->flags ^= PHP_STREAM_FLAG_NO_FCLOSE;
+	}
 	zval_ptr_dtor(&args[1]);

 	if (php_openssl_is_session_ce(&retval)) {