From 0b340be082e033a4a9e4c15f246cc9ef7fc835a0 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Wed, 14 Oct 2026 05:56:20 +0500
Subject: [PATCH 1/4] Fix GH-24308: Request shutdown closes a syslog handle PHP
 did not open

---
 NEWS                  | 2 ++
 ext/standard/syslog.c | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index c6452c720040..82ee1a785501 100644
--- a/NEWS
+++ b/NEWS
@@ -73,6 +73,8 @@ PHP                                                                        NEWS
     when getpwnam_r() needs a larger buffer. (Ilia Alshanetsky)
   . Fixed password_get_info() and password_needs_rehash() accepting malformed
     bcrypt costs. (Ilia Alshanetsky)
+  . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
+    was not opened by PHP). (lazerg)
 
 - Zip:
   . Fixed use-after-free when re-entering ZipArchive during destruction or
diff --git a/ext/standard/syslog.c b/ext/standard/syslog.c
index c5d73eb008ec..d12b9eec62e6 100644
--- a/ext/standard/syslog.c
+++ b/ext/standard/syslog.c
@@ -41,7 +41,9 @@ PHP_MINIT_FUNCTION(syslog)
 
 PHP_RSHUTDOWN_FUNCTION(syslog)
 {
-	php_closelog();
+	if (PG(have_called_openlog)) {
+		php_closelog();
+	}
 	if (BG(syslog_device)) {
 		free(BG(syslog_device));
 		BG(syslog_device) = NULL;

From 8cd9f6f76c62bd5ab6665914896bd6ec4d022074 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Wed, 14 Oct 2026 15:31:23 +0500
Subject: [PATCH 2/4] Close syslog at request end after syslog() opened it
 implicitly

---
 ext/standard/syslog.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ext/standard/syslog.c b/ext/standard/syslog.c
index d12b9eec62e6..653f221aca27 100644
--- a/ext/standard/syslog.c
+++ b/ext/standard/syslog.c
@@ -32,6 +32,8 @@
 #include "basic_functions.h"
 #include "php_ext_syslog.h"
 
+ZEND_TLS bool syslog_called;
+
 /* {{{ PHP_MINIT_FUNCTION */
 PHP_MINIT_FUNCTION(syslog)
 {
@@ -41,8 +43,9 @@ PHP_MINIT_FUNCTION(syslog)
 
 PHP_RSHUTDOWN_FUNCTION(syslog)
 {
-	if (PG(have_called_openlog)) {
+	if (PG(have_called_openlog) || syslog_called) {
 		php_closelog();
+		syslog_called = false;
 	}
 	if (BG(syslog_device)) {
 		free(BG(syslog_device));
@@ -104,6 +107,7 @@ PHP_FUNCTION(syslog)
 		Z_PARAM_STR(message)
 	ZEND_PARSE_PARAMETERS_END();
 
+	syslog_called = true;
 	php_syslog_str(priority, message);
 	RETURN_TRUE;
 }

From f0ed6aa1d9cfcd38eca6ec4c310566eef7b129bc Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Wed, 14 Oct 2026 16:42:41 +0500
Subject: [PATCH 3/4] Add regression test for GH-24308

---
 ext/standard/tests/network/gh24308.phpt | 44 +++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 ext/standard/tests/network/gh24308.phpt

diff --git a/ext/standard/tests/network/gh24308.phpt b/ext/standard/tests/network/gh24308.phpt
new file mode 100644
index 000000000000..bfb50ae95e40
--- /dev/null
+++ b/ext/standard/tests/network/gh24308.phpt
@@ -0,0 +1,44 @@
+--TEST--
+GH-24308 (syslog() without openlog() is closed at request end)
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Linux') die('skip Linux only');
+if (!@is_dir('/proc/self/fd')) die('skip requires /proc/self/fd');
+if (!@stream_socket_client('udg:///dev/log')) die('skip requires /dev/log');
+?>
+--FILE--
+<?php
+$serverCode = <<<'CODE'
+function sockets() {
+    $sockets = [];
+    foreach (scandir('/proc/self/fd') as $fd) {
+        $link = @readlink("/proc/self/fd/$fd");
+        if ($link !== false && str_starts_with($link, 'socket:')) {
+            $sockets[$fd] = $link;
+        }
+    }
+    return $sockets;
+}
+
+if (isset($_GET['syslog'])) {
+    $before = sockets();
+    syslog(LOG_DEBUG, 'GH-24308');
+    echo json_encode(array_diff_assoc(sockets(), $before));
+} else {
+    echo json_encode(sockets());
+}
+CODE;
+
+include __DIR__."/../../../../sapi/cli/tests/php_cli_server.inc";
+php_cli_server_start($serverCode, null, []);
+
+$opened = json_decode(file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/?syslog"), true);
+var_dump(count($opened));
+
+$next = json_decode(file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/"), true);
+var_dump(array_intersect_assoc($opened, $next));
+?>
+--EXPECT--
+int(1)
+array(0) {
+}

From 44d80f54d319e431174b6b5d5574075ecb58dd20 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Fri, 16 Oct 2026 07:07:12 +0500
Subject: [PATCH 4/4] Open syslog with PHP settings when syslog() is called
 before openlog()

---
 ext/standard/syslog.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/ext/standard/syslog.c b/ext/standard/syslog.c
index 653f221aca27..37aab54c569d 100644
--- a/ext/standard/syslog.c
+++ b/ext/standard/syslog.c
@@ -32,8 +32,6 @@
 #include "basic_functions.h"
 #include "php_ext_syslog.h"
 
-ZEND_TLS bool syslog_called;
-
 /* {{{ PHP_MINIT_FUNCTION */
 PHP_MINIT_FUNCTION(syslog)
 {
@@ -43,9 +41,8 @@ PHP_MINIT_FUNCTION(syslog)
 
 PHP_RSHUTDOWN_FUNCTION(syslog)
 {
-	if (PG(have_called_openlog) || syslog_called) {
+	if (PG(have_called_openlog)) {
 		php_closelog();
-		syslog_called = false;
 	}
 	if (BG(syslog_device)) {
 		free(BG(syslog_device));
@@ -107,7 +104,9 @@ PHP_FUNCTION(syslog)
 		Z_PARAM_STR(message)
 	ZEND_PARSE_PARAMETERS_END();
 
-	syslog_called = true;
+	if (!PG(have_called_openlog)) {
+		php_openlog(PG(syslog_ident), 0, PG(syslog_facility));
+	}
 	php_syslog_str(priority, message);
 	RETURN_TRUE;
 }