PS(mod_user_class_name) must not leak into next request

Fixes GH-9584

Author: iluuu1994

NEWS

@@ -15,6 +15,10 @@ PHP                                                                        NEWS
 - Sockets:
   . Fixed socket constants regression as of PHP 8.2.0beta3. (Bruce Dou)
 
+- Session:
+  . Fixed GH-9584 (Avoid memory corruption when not unregistering custom session
+    handler). (ilutov)
+
 15 Sep 2022, PHP 8.2.0RC2
 
 - Core:

ext/session/session.c

@@ -142,6 +142,11 @@ static inline void php_rshutdown_session_globals(void) /* {{{ */
 		PS(session_vars) = NULL;
 	}
 
+	if (PS(mod_user_class_name)) {
+		zend_string_release(PS(mod_user_class_name));
+		PS(mod_user_class_name) = NULL;
+	}
+
 	/* User save handlers may end up directly here by misuse, bugs in user script, etc. */
 	/* Set session status to prevent error while restoring save handler INI value. */
 	PS(session_status) = php_session_none;

ext/session/tests/gh9584.phpt

@@ -0,0 +1,55 @@
+--TEST--
+GH-9584: PS(mod_user_class_name) must not leak into next request
+--EXTENSIONS--
+session
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php
+
+class MySessionHandler extends SessionHandler implements SessionUpdateTimestampHandlerInterface
+{
+    public function open($path, $sessname): bool {
+        return true;
+    }
+
+    public function close(): bool {
+        return true;
+    }
+
+    public function read($sessid): string|false {
+        return 'foo|s:3:"foo";';
+    }
+
+    public function write($sessid, $sessdata): bool {
+        return false;
+    }
+
+    public function destroy($sessid): bool {
+        return true;
+    }
+
+    public function gc($maxlifetime): int|false {
+        return true;
+    }
+
+    public function create_sid(): string {
+        return sha1(random_bytes(32));
+    }
+
+    public function validateId($sid): bool {
+        return true;
+    }
+
+    public function updateTimestamp($sessid, $sessdata): bool {
+        return false;
+    }
+}
+
+$handler = new MySessionHandler();
+session_set_save_handler($handler);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===