From 9fbd67de54443d586ec21d8c53f801ed2815cbd1 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Wed, 14 Oct 2026 05:56:20 +0500
Subject: [PATCH 1/4] Fix GH-24308: Request shutdown closes a syslog handle PHP
 did not open

---
 NEWS                  | 2 ++
 ext/standard/syslog.c | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index aa752e0af386..57e490de1103 100644
--- a/NEWS
+++ b/NEWS
@@ -97,6 +97,8 @@ PHP                                                                        NEWS
     bcrypt costs. (Ilia Alshanetsky)
   . Fixed proc_open() null descriptor not being inheritable on Windows.
     (Jorg Sowa)
+  . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
+    was not opened by PHP). (lazerg)
 
 - Tidy:
   . Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and
diff --git a/ext/standard/syslog.c b/ext/standard/syslog.c
index c5d73eb008ec..d12b9eec62e6 100644
--- a/ext/standard/syslog.c
+++ b/ext/standard/syslog.c
@@ -41,7 +41,9 @@ PHP_MINIT_FUNCTION(syslog)
 
 PHP_RSHUTDOWN_FUNCTION(syslog)
 {
-	php_closelog();
+	if (PG(have_called_openlog)) {
+		php_closelog();
+	}
 	if (BG(syslog_device)) {
 		free(BG(syslog_device));
 		BG(syslog_device) = NULL;

From e5613568108d2eb5922d66e21d43f208a642e0a8 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Wed, 14 Oct 2026 15:31:23 +0500
Subject: [PATCH 2/4] Close syslog at request end after syslog() opened it
 implicitly

---
 ext/standard/syslog.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ext/standard/syslog.c b/ext/standard/syslog.c
index d12b9eec62e6..653f221aca27 100644
--- a/ext/standard/syslog.c
+++ b/ext/standard/syslog.c
@@ -32,6 +32,8 @@
 #include "basic_functions.h"
 #include "php_ext_syslog.h"
 
+ZEND_TLS bool syslog_called;
+
 /* {{{ PHP_MINIT_FUNCTION */
 PHP_MINIT_FUNCTION(syslog)
 {
@@ -41,8 +43,9 @@ PHP_MINIT_FUNCTION(syslog)
 
 PHP_RSHUTDOWN_FUNCTION(syslog)
 {
-	if (PG(have_called_openlog)) {
+	if (PG(have_called_openlog) || syslog_called) {
 		php_closelog();
+		syslog_called = false;
 	}
 	if (BG(syslog_device)) {
 		free(BG(syslog_device));
@@ -104,6 +107,7 @@ PHP_FUNCTION(syslog)
 		Z_PARAM_STR(message)
 	ZEND_PARSE_PARAMETERS_END();
 
+	syslog_called = true;
 	php_syslog_str(priority, message);
 	RETURN_TRUE;
 }

From 2aa762e225a7c216c459c1642cd2a47c5b5e7231 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Wed, 14 Oct 2026 16:42:41 +0500
Subject: [PATCH 3/4] Add regression test for GH-24308

---
 ext/standard/tests/network/gh24308.phpt | 44 +++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 ext/standard/tests/network/gh24308.phpt

diff --git a/ext/standard/tests/network/gh24308.phpt b/ext/standard/tests/network/gh24308.phpt
new file mode 100644
index 000000000000..bfb50ae95e40
--- /dev/null
+++ b/ext/standard/tests/network/gh24308.phpt
@@ -0,0 +1,44 @@
+--TEST--
+GH-24308 (syslog() without openlog() is closed at request end)
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Linux') die('skip Linux only');
+if (!@is_dir('/proc/self/fd')) die('skip requires /proc/self/fd');
+if (!@stream_socket_client('udg:///dev/log')) die('skip requires /dev/log');
+?>
+--FILE--
+<?php
+$serverCode = <<<'CODE'
+function sockets() {
+    $sockets = [];
+    foreach (scandir('/proc/self/fd') as $fd) {
+        $link = @readlink("/proc/self/fd/$fd");
+        if ($link !== false && str_starts_with($link, 'socket:')) {
+            $sockets[$fd] = $link;
+        }
+    }
+    return $sockets;
+}
+
+if (isset($_GET['syslog'])) {
+    $before = sockets();
+    syslog(LOG_DEBUG, 'GH-24308');
+    echo json_encode(array_diff_assoc(sockets(), $before));
+} else {
+    echo json_encode(sockets());
+}
+CODE;
+
+include __DIR__."/../../../../sapi/cli/tests/php_cli_server.inc";
+php_cli_server_start($serverCode, null, []);
+
+$opened = json_decode(file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/?syslog"), true);
+var_dump(count($opened));
+
+$next = json_decode(file_get_contents("http://" . PHP_CLI_SERVER_ADDRESS . "/"), true);
+var_dump(array_intersect_assoc($opened, $next));
+?>
+--EXPECT--
+int(1)
+array(0) {
+}

From 57c221c6550c9a7930896c94871cb00cbc8df2de Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Fri, 16 Oct 2026 07:07:12 +0500
Subject: [PATCH 4/4] Open syslog with PHP settings when syslog() is called
 before openlog()

---
 ext/standard/syslog.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/ext/standard/syslog.c b/ext/standard/syslog.c
index 653f221aca27..37aab54c569d 100644
--- a/ext/standard/syslog.c
+++ b/ext/standard/syslog.c
@@ -32,8 +32,6 @@
 #include "basic_functions.h"
 #include "php_ext_syslog.h"
 
-ZEND_TLS bool syslog_called;
-
 /* {{{ PHP_MINIT_FUNCTION */
 PHP_MINIT_FUNCTION(syslog)
 {
@@ -43,9 +41,8 @@ PHP_MINIT_FUNCTION(syslog)
 
 PHP_RSHUTDOWN_FUNCTION(syslog)
 {
-	if (PG(have_called_openlog) || syslog_called) {
+	if (PG(have_called_openlog)) {
 		php_closelog();
-		syslog_called = false;
 	}
 	if (BG(syslog_device)) {
 		free(BG(syslog_device));
@@ -107,7 +104,9 @@ PHP_FUNCTION(syslog)
 		Z_PARAM_STR(message)
 	ZEND_PARSE_PARAMETERS_END();
 
-	syslog_called = true;
+	if (!PG(have_called_openlog)) {
+		php_openlog(PG(syslog_ident), 0, PG(syslog_facility));
+	}
 	php_syslog_str(priority, message);
 	RETURN_TRUE;
 }