Fix use of freed argv in atexit handlers on macOS

ext/zend_test/test.c

@@ -20,6 +20,11 @@
 #endif
 
 #include "php.h"
+
+#ifdef __APPLE__
+# include <crt_externs.h>
+#endif
+
 #include "php_ini.h"
 #include "ext/standard/info.h"
 #include "php_test.h"
@@ -1880,3 +1885,42 @@ static PHP_FUNCTION(zend_test_gh19792)
 	zend_error(E_WARNING, "a warning");
 	zend_throw_error(NULL, "an exception");
 }
+
+#ifdef __APPLE__
+static char **zend_test_argv_at_register;
+static bool zend_test_argv_atexit_registered;
+static bool zend_test_argv_atexit_enabled;
+
+static void zend_test_argv_atexit_handler(void)
+{
+	char **argv;
+
+	/* arginfo_zpp_mismatch calls every function, so only report when the test
+	 * asks for it. */
+	if (!zend_test_argv_atexit_enabled) {
+		return;
+	}
+
+	argv = *_NSGetArgv();
+
+	printf("argv_changed=%d\n", argv != zend_test_argv_at_register);
+	printf("argv_valid=%d\n", argv != NULL && argv[0] != NULL && strlen(argv[0]) > 0);
+	fflush(stdout);
+}
+#endif
+
+static PHP_FUNCTION(zend_test_register_argv_atexit)
+{
+	ZEND_PARSE_PARAMETERS_NONE();
+
+#ifdef __APPLE__
+	zend_test_argv_atexit_enabled = getenv("ZEND_TEST_ARGV_ATEXIT") != NULL;
+	zend_test_argv_at_register = *_NSGetArgv();
+
+	/* A single handler keeps --repeat from printing it more than once. */
+	if (!zend_test_argv_atexit_registered) {
+		zend_test_argv_atexit_registered = true;
+		atexit(zend_test_argv_atexit_handler);
+	}
+#endif
+}

ext/zend_test/test.stub.php

@@ -343,6 +343,8 @@ function zend_test_handle_post_data(mixed $stream, string $content_type, int $co
     function zend_new_singleton_array(): array {}
 
     function zend_test_set_local_var(string $name, mixed $value): bool {}
+
+    function zend_test_register_argv_atexit(): void {}
 }
 
 namespace ZendTestNS {

ext/zend_test/tests/gh25203.phpt

@@ -0,0 +1,26 @@
+--TEST--
+The original argv is restored before atexit() handlers run
+--EXTENSIONS--
+zend_test
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Darwin') {
+    die('skip macOS only');
+}
+?>
+--ENV--
+ZEND_DONT_UNLOAD_MODULES=1
+ZEND_TEST_ARGV_ATEXIT=1
+--FILE--
+<?php
+
+cli_set_process_title('php-test');
+
+// Keep the extension loaded so that the handler runs at process exit, after
+// cleanup_ps_args(), and not when the module is unloaded.
+zend_test_register_argv_atexit();
+
+?>
+--EXPECT--
+argv_changed=1
+argv_valid=1

sapi/cli/ps_title.c

@@ -437,6 +437,10 @@ void cleanup_ps_args(char **argv)
 #ifndef PS_USE_NONE
     if (save_argv)
     {
+#if defined(__APPLE__)
+        char **saved_argv = save_argv;
+#endif
+
         save_argv = NULL;
         save_argc = 0;
 
@@ -456,6 +460,16 @@ void cleanup_ps_args(char **argv)
 #if defined(PS_USE_CHANGE_ARGV) || defined(PS_USE_CLOBBER_ARGV)
         {
             int i;
+
+#if defined(__APPLE__)
+            /*
+             * Apple's Cyrus SASL reads the process arguments through
+             * _NSGetArgv() from an atexit() handler, which still points to
+             * the copy freed below. Restore the original array first.
+             */
+            *_NSGetArgv() = saved_argv;
+#endif
+
             for (i=0; argv[i] != NULL; i++)
                 free(argv[i]);
             free(argv);