[php-src] PR #25211: ext/openssl: Fix shared SSL_CTX callbacks reading a freed session stream

From: Date: Thu, 05 Nov 2026 15:00:40 +0000
Subject: [php-src] PR #25211: ext/openssl: Fix shared SSL_CTX callbacks reading a freed session stream
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40324@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25211 Author: iliaal Since b1242c32bca, a server stream seeded from a session stream shares the parent's SSL_CTX, whose ALPN select callback (and, on Windows without a CA file, certificate verify callback) was registered with the parent's stream. If the parent is closed before the child's handshake, both read freed memory and the child negotiates no ALPN protocol. Look up the stream from the handshake's SSL instead, and give the child its own copy of the protocol list. Only 8.6 is affected, so this should probably go into 8.6.0 as well.

« previous php.git-pulls (#40324) next »