session: close save handler before re-initializing an active session

php_session_initialize() set the status to active and called the save
handler's open() and read() without first closing a session that was
already active, so session_reset() left the earlier open() unmatched.
Abort the active session first, pairing every open() with a close().

Closes GH-23597

Author: iliaal

NEWS

@@ -92,6 +92,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
     (Weilin Du)
 
+- Session:
+  . Fixed calling SessionHandler::open() twice without an intervening
+    close() when re-initializing an active session. (Ilia Alshanetsky)
+
 - SOAP:
   . Fixed bug GH-23447 (Segfault when a class passed to SoapServer::setClass()
     fails to initialize). (Lazizbek Ergashev)

ext/session/session.c

@@ -420,6 +420,10 @@ static zend_result php_session_initialize(void) /* {{{ */
 {
 	zend_string *val = NULL;
 
+	if (PS(session_status) == php_session_active) {
+		php_session_abort();
+	}
+
 	PS(session_status) = php_session_active;
 
 	if (!PS(mod)) {

ext/session/tests/session_reset_handler_close.phpt

@@ -0,0 +1,60 @@
+--TEST--
+Session reset closes the save handler before reopening it
+--INI--
+session.use_cookies=0
+session.gc_probability=0
+--FILE--
+<?php
+
+class LoggingHandler implements SessionHandlerInterface
+{
+    public function open(string $path, string $name): bool
+    {
+        $GLOBALS['calls'][] = 'open';
+        return true;
+    }
+    public function close(): bool
+    {
+        $GLOBALS['calls'][] = 'close';
+        return true;
+    }
+    public function read(string $id): string|false
+    {
+        $GLOBALS['calls'][] = 'read';
+        return '';
+    }
+    public function write(string $id, string $data): bool
+    {
+        $GLOBALS['calls'][] = 'write';
+        return true;
+    }
+    public function destroy(string $id): bool
+    {
+        $GLOBALS['calls'][] = 'destroy';
+        return true;
+    }
+    public function gc(int $max_lifetime): int|false
+    {
+        $GLOBALS['calls'][] = 'gc';
+        return 0;
+    }
+}
+
+$GLOBALS['calls'] = [];
+session_set_save_handler(new LoggingHandler(), true);
+var_dump(session_start());
+var_dump(session_reset());
+print_r($GLOBALS['calls']);
+
+?>
+--EXPECT--
+bool(true)
+bool(true)
+Array
+(
+    [0] => open
+    [1] => read
+    [2] => close
+    [3] => open
+    [4] => read
+)