[php-src] master: SAPI: clear current_user and content_type_dup after releasing them (#22974)

Author: Ilia Alshanetsky (iliaal)
Committer: GitHub (web-flow)
Pusher: Girgias
Date: 2026-08-07T12:32:45+01:00

Commit: https://github.com/php/php-src/commit/642fa8c93bf825fb98b3999cbd94f904548fef8a
Raw diff: https://github.com/php/php-src/commit/642fa8c93bf825fb98b3999cbd94f904548fef8a.diff

SAPI: clear current_user and content_type_dup after releasing them (#22974)

sapi_deactivate_module() releases both without resetting the pointer,
unlike the auth_user, auth_password and auth_digest fields next to them.
Nothing reads them between the release and the next sapi_activate()
today, so this is consistency rather than a live bug.

Closes GH-22974

Changed paths:
  M  main/SAPI.c


Diff:

diff --git a/main/SAPI.c b/main/SAPI.c
index 3daa88e07f25..7de36af440c3 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -495,9 +495,11 @@ SAPI_API void sapi_deactivate_module(void)
 	}
 	if (SG(request_info).content_type_dup) {
 		efree(SG(request_info).content_type_dup);
+		SG(request_info).content_type_dup = NULL;
 	}
 	if (SG(request_info).current_user) {
 		zend_string_release_ex(SG(request_info).current_user, false);
+		SG(request_info).current_user = NULL;
 	}
 	if (sapi_module.deactivate) {
 		sapi_module.deactivate();