Fix GH-23764: Built-in server leaks fd on HEAD request for static file

[jakubskopal]

Fixes GH-23764.

php_cli_server_begin_send_static() opens the file, but for HEAD requests never stores the descriptor in client->file_fd, so nothing closes it. Close it right away; Content-Length comes from the stat and the body is never sent, so the descriptor is not needed.

Verified with a --disable-all build: after 100 curl -I requests, /proc/<pid>/fd holds 0 references to the served file (previously 100); HEAD and GET responses unchanged.

Bug exists since 8.2 (#8215); targeting PHP-8.4 as the lowest branch still receiving bug fixes.

[ndossche]

Perhaps an even better fix is to avoid the open call and only rely on the stat call from earlier. What do you think?

[jakubskopal]

Have a look. I've amended the commit. HEAD should theoretically return the same status as GET, so one needs to check permissions to be able to do that (open not only opens, but also checks readability). I'm not sure one saved call (open+close vs. access) is worth the 10 lines added. Let me know which one you prefer. I personally would prefer the former.

[ndossche]

Yeah okay, you're right. Please go back to the original solution and I'll approve. Thanks for checking.

[jakubskopal]

okay, done :-) i've put it in the comment so that it's a bit clearer, let me know if I should take it out, i see there are not many comments in PHP source code.