From 56f4b59a26a339a31f8d8ade6ca005cdc1ca093e Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Sun, 8 Nov 2026 19:12:21 +0500
Subject: [PATCH] Fix GH-25307: NULL ps_files deref after
 SessionHandler::open() on user module

---
 ext/session/mod_user_class.c                  |  3 ++-
 .../tests/user_session_module/gh25307.phpt    | 24 +++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 ext/session/tests/user_session_module/gh25307.phpt

diff --git a/ext/session/mod_user_class.c b/ext/session/mod_user_class.c
index a2ab3c0615c2..b10a2956d20c 100644
--- a/ext/session/mod_user_class.c
+++ b/ext/session/mod_user_class.c
@@ -16,13 +16,14 @@
 
 #include "php.h"
 #include "php_session.h"
+#include "mod_user.h"
 
 #define PS_SANITY_CHECK						\
 	if (PS(session_status) != php_session_active) { \
 		zend_throw_error(NULL, "Session is not active"); \
 		RETURN_THROWS(); \
 	} \
-	if (PS(default_mod) == NULL) { \
+	if (PS(default_mod) == NULL || PS(default_mod) == ps_user_ptr) { \
 		zend_throw_error(NULL, "Cannot call default session handler"); \
 		RETURN_THROWS(); \
 	}
diff --git a/ext/session/tests/user_session_module/gh25307.phpt b/ext/session/tests/user_session_module/gh25307.phpt
new file mode 100644
index 000000000000..c4ce666dd548
--- /dev/null
+++ b/ext/session/tests/user_session_module/gh25307.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-25307 (NULL ps_files dereference in ps_files_close at shutdown)
+--EXTENSIONS--
+session
+--SKIPIF--
+<?php include(__DIR__ . '/../skipif.inc'); ?>
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+ob_start();
+session_set_save_handler(new SessionHandler(), true);
+ini_set("session.save_handler", "files");
+session_start();
+try {
+    (new SessionHandler)->open("", "");
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+echo "Done\n";
+?>
+--EXPECT--
+Cannot call default session handler
+Done