From 2bf7989273054f125c361320bb4f00683d13ce6d Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 24 Aug 2026 10:52:37 -0400
Subject: [PATCH] [session] Close save handler before re-initializing an active
 session

php_session_initialize() now aborts an already-active session (closing
the save handler) before reopening it, so session_reset() no longer
calls open() twice with no close(). Sibling audit: php_session_start()
returns early while a session is active; the strict-mode create_sid
fallback leaves the close to the existing php_session_reset_id()
failure guard, which already calls php_session_abort(); the rfc1867
update/cleanup callbacks are covered by the same new guard.
---
 NEWS                                          |  2 +
 ext/session/session.c                         |  4 ++
 .../tests/session_reset_handler_close.phpt    | 60 +++++++++++++++++++
 3 files changed, 66 insertions(+)
 create mode 100644 ext/session/tests/session_reset_handler_close.phpt

diff --git a/NEWS b/NEWS
index a2c65685b4ce..4d8844cfec7e 100644
--- a/NEWS
+++ b/NEWS
@@ -115,6 +115,8 @@ PHP                                                                        NEWS
     is freed while the stream is still open). (Eyüp Can Akman)
 
 - Session:
+  . Fixed calling SessionHandler::open() twice without an intervening close()
+    when resetting or re-initializing an active session. (iliaal)
   . Fix corruption in mod_mm. (ndossche)
   . Fixed bug GH-23043 (broken session id code can cause zend_mm_heap
     corrupted). (ndossche)
diff --git a/ext/session/session.c b/ext/session/session.c
index 2073ea55fe1f..abfce3b4b68c 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -420,6 +420,10 @@ static zend_result php_session_initialize(void) /* {{{ */
 {
 	zend_string *val = NULL;
 
+	if (PS(session_status) == php_session_active) {
+		php_session_abort();
+	}
+
 	PS(session_status) = php_session_active;
 
 	if (!PS(mod)) {
diff --git a/ext/session/tests/session_reset_handler_close.phpt b/ext/session/tests/session_reset_handler_close.phpt
new file mode 100644
index 000000000000..54bfc6b7f1d1
--- /dev/null
+++ b/ext/session/tests/session_reset_handler_close.phpt
@@ -0,0 +1,60 @@
+--TEST--
+Session reset closes the save handler before reopening it
+--INI--
+session.use_cookies=0
+session.gc_probability=0
+--FILE--
+<?php
+
+class LoggingHandler implements SessionHandlerInterface
+{
+    public function open(string $path, string $name): bool
+    {
+        $GLOBALS['calls'][] = 'open';
+        return true;
+    }
+    public function close(): bool
+    {
+        $GLOBALS['calls'][] = 'close';
+        return true;
+    }
+    public function read(string $id): string|false
+    {
+        $GLOBALS['calls'][] = 'read';
+        return '';
+    }
+    public function write(string $id, string $data): bool
+    {
+        $GLOBALS['calls'][] = 'write';
+        return true;
+    }
+    public function destroy(string $id): bool
+    {
+        $GLOBALS['calls'][] = 'destroy';
+        return true;
+    }
+    public function gc(int $max_lifetime): int|false
+    {
+        $GLOBALS['calls'][] = 'gc';
+        return 0;
+    }
+}
+
+$GLOBALS['calls'] = [];
+session_set_save_handler(new LoggingHandler(), true);
+var_dump(session_start());
+var_dump(session_reset());
+print_r($GLOBALS['calls']);
+
+?>
+--EXPECT--
+bool(true)
+bool(true)
+Array
+(
+    [0] => open
+    [1] => read
+    [2] => close
+    [3] => open
+    [4] => read
+)