From 9bff96396da7b49fc53888ef8e9c90ff50ac836d Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 16 Sep 2021 15:29:08 +0200
Subject: [PATCH] Don't leak header callback if headers already sent

We need to avoid storing it in the first place, as we don't
really have a good place to release it later. If headers haven't
been sent yet, send_headers will do this. sapi_deactive happens
too late in the shutdown sequence and will result in leak reports.
---
 main/SAPI.c                                            | 6 +++++-
 tests/basic/header_register_callback_after_output.phpt | 9 +++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 tests/basic/header_register_callback_after_output.phpt

diff --git a/main/SAPI.c b/main/SAPI.c
index 52509e3b017..039ba068270 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -124,7 +124,11 @@ PHP_FUNCTION(header_register_callback)
 		SG(fci_cache) = empty_fcall_info_cache;
 	}
 
-	ZVAL_COPY(&SG(callback_func), &fci.function_name);
+	/* Don't store callback if headers have already been sent:
+	 * It won't get used and we won't have a chance to release it. */
+	if (!SG(headers_sent)) {
+		ZVAL_COPY(&SG(callback_func), &fci.function_name);
+	}
 
 	RETURN_TRUE;
 }
diff --git a/tests/basic/header_register_callback_after_output.phpt b/tests/basic/header_register_callback_after_output.phpt
new file mode 100644
index 00000000000..eb9931948a2
--- /dev/null
+++ b/tests/basic/header_register_callback_after_output.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Call header_register_callback() after headers sent
+--FILE--
+<?php
+echo "Send headers.\n";
+header_register_callback(function() { echo "Too late";});
+?>
+--EXPECT--
+Send headers.