From 48a03318827097fe41603db6b09e41f7205bced2 Mon Sep 17 00:00:00 2001 From: Ryosuke Ishibashi Date: Sat, 10 Oct 2026 00:54:52 +0900 Subject: [PATCH] Fix GH-24220: Failed listen() on a tcp:// server reported as success With ext/openssl, tcp:// streams use php_openssl_sockop_set_option(). Its STREAM_XPORT_OP_LISTEN case, added with TLS session resumption, assigned the return value of php_stream_socket_ops.set_option() to xparam->outputs.returncode. That return value only says the option was handled, so it overwrote the -1 that a failed listen() had stored there, and stream_socket_server() returned a stream that was not listening. --- NEWS | 4 ++++ ext/openssl/xp_ssl.c | 5 +++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index a4b3d143c37c..3bf743b3f997 100644 --- a/NEWS +++ b/NEWS @@ -27,6 +27,10 @@ PHP NEWS . Fix too wide type inference for ASSIGN_DIM_OP. (ndossche) . Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche) +- OpenSSL: + . Fixed bug GH-24220 (Failed listen() on a tcp:// server reported as + success with ext/openssl). (Ryosuke Ishibashi) + - Phar: . Fixed GH-24166 (Double-free in Phar::webPhar() in CGI without PATH_INFO). (RigelYoung, Jakub Zelenka) diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c index ad06af444ffe..c9c2b8081c30 100644 --- a/ext/openssl/xp_ssl.c +++ b/ext/openssl/xp_ssl.c @@ -3843,8 +3843,9 @@ static int php_openssl_sockop_set_option(php_stream *stream, int option, int val case STREAM_XPORT_OP_LISTEN: /* Do normal listen first */ - xparam->outputs.returncode = php_stream_socket_ops.set_option( - stream, option, value, ptrparam); + if (php_stream_socket_ops.set_option(stream, option, value, ptrparam) != PHP_STREAM_OPTION_RETURN_OK) { + xparam->outputs.returncode = -1; + } if (xparam->outputs.returncode == 0 && sslsock->enable_on_connect) { /* Create SSL_CTX early to share it for session resumption and early data */