[php-src] Issue #24220: Failed listen() on a tcp:// server reported as success with ext/openssl
| From: | mpyw | Date: | Fri, 09 Oct 2026 15:56:39 +0000 |
| Subject: | [php-src] Issue #24220: Failed listen() on a tcp:// server reported as success with ext/openssl | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-252955@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24220
Author: mpyw
### Description
With ext/openssl loaded,
stream_socket_server() on a tcp:// address
returns a stream even when listen() fails. The stream is not listening, so the error
only shows later, when accepting.
php_openssl_sockop_set_option() handles STREAM_XPORT_OP_LISTEN since TLS
session resumption was added (#20296):
```c
case STREAM_XPORT_OP_LISTEN:
/* Do normal listen first */
xparam->outputs.returncode = php_stream_socket_ops.set_option(
stream, option, value, ptrparam);
```
php_stream_socket_ops.set_option() stores the result of listen() in
xparam->outputs.returncode, and returns PHP_STREAM_OPTION_RETURN_OK
because it handled the option. Assigning that return value overwrites the -1 of a
failed listen() with 0.
In practice, bind() usually fails first, for example on an address in use. So this
needs listen() itself to fail. On Linux, strace can make it fail:
```php
<?php
$server = @stream_socket_server("tcp://127.0.0.1:0", $errno, $errstr);
var_dump($server);
```
```sh
docker run --rm --security-opt seccomp=unconfined -v "$PWD":/app -w /app php:8.6.0RC3-cli
sh -c '
apt-get update -qq && apt-get install -y -qq strace >/dev/null
strace -f -q -o /dev/null -e trace=listen -e inject=listen:error=EADDRINUSE php repro.php'
```
Resulted in this output:
```
resource(5) of type (stream)
```
But I expected this output instead:
```
bool(false)
```
PHP 8.5.11 (php:8.5-cli) prints bool(false) under the same injection. A
build of PHP-8.6 without ext/openssl does too.
### PHP Version
```
PHP 8.6.0RC3 (cli) (NTS)
```
Also present on the PHP-8.6 branch and master as of 2026-10-10.
### Operating System
Debian (the php:8.6.0RC3-cli image). Not OS-specific.