From 3a760c729636d0dff93cd3c1561ea840f34148b6 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Mon, 3 Aug 2026 19:26:14 -0400 Subject: [PATCH] SAPI: clear current_user and content_type_dup after releasing them sapi_deactivate_module() releases both without resetting the pointer, unlike the auth_user, auth_password and auth_digest fields next to them. Nothing reads them between the release and the next sapi_activate() today, so this is consistency rather than a live bug. Closes GH-22974 --- main/SAPI.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/main/SAPI.c b/main/SAPI.c index 3daa88e07f25..7de36af440c3 100644 --- a/main/SAPI.c +++ b/main/SAPI.c @@ -495,9 +495,11 @@ SAPI_API void sapi_deactivate_module(void) } if (SG(request_info).content_type_dup) { efree(SG(request_info).content_type_dup); + SG(request_info).content_type_dup = NULL; } if (SG(request_info).current_user) { zend_string_release_ex(SG(request_info).current_user, false); + SG(request_info).current_user = NULL; } if (sapi_module.deactivate) { sapi_module.deactivate();