From fa9fdb73b7e912149dce4d72ca390e4938c73be8 Mon Sep 17 00:00:00 2001 From: Jakub Skopal Date: Sat, 19 Sep 2026 02:36:29 +0200 Subject: [PATCH] Fix GH-23764: Built-in server leaks fd on HEAD request for static file php_cli_server_begin_send_static() opens the file, but for HEAD requests never stores the descriptor in client->file_fd, so nothing closes it. Close it right away; Content-Length comes from the stat and the body is never sent, so the descriptor is not needed. --- NEWS | 4 ++++ sapi/cli/php_cli_server.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/NEWS b/NEWS index c8eb609cc2a6..dfbe477384bb 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 8.4.27 +- CLI: + . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD + request for a static file). (Jakub Skopal) + - DOM: . Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector. diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c index 36187aaeb035..5a3abb4ded9d 100644 --- a/sapi/cli/php_cli_server.c +++ b/sapi/cli/php_cli_server.c @@ -2185,6 +2185,9 @@ static zend_result php_cli_server_begin_send_static(php_cli_server *server, php_ client->content_sender_initialized = true; if (client->request.request_method != PHP_HTTP_HEAD) { client->file_fd = fd; + } else { + /* Content-Length comes from the stat, the body is never sent. */ + close(fd); } {