ext/session: Close the save handler when create_sid() fails

NEWS

@@ -48,6 +48,10 @@ PHP                                                                        NEWS
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
     set to an empty string. (Ilia Alshanetsky)
 
+- Session:
+  . Fixed session_regenerate_id() leaving the save handler open after a
+    failed create_sid(). (Ilia Alshanetsky)
+
 - Sockets:
   . Fixed socket_select() silently truncating sets larger than FD_SETSIZE on
     Windows. (David Carlier)

ext/session/session.c

@@ -2430,6 +2430,7 @@ PHP_FUNCTION(session_regenerate_id)
 
 	PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
 	if (!PS(id)) {
+		PS(mod)->s_close(&PS(mod_data));
 		PS(session_status) = php_session_none;
 		if (!EG(exception)) {
 			zend_throw_error(NULL, "Failed to create new session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));

ext/session/tests/user_session_module/session_regenerate_id_create_sid_fails_close.phpt

@@ -0,0 +1,78 @@
+--TEST--
+session_regenerate_id() closes the save handler when create_sid fails
+--INI--
+session.use_cookies=0
+session.gc_probability=0
+session.save_path=
+--EXTENSIONS--
+session
+--FILE--
+<?php
+
+class CountingHandler extends SessionHandler
+{
+    public int $opens = 0;
+    public int $closes = 0;
+    public int $createCalls = 0;
+
+    public function open($path, $name): bool
+    {
+        $this->opens++;
+        return true;
+    }
+
+    public function close(): bool
+    {
+        $this->closes++;
+        return true;
+    }
+
+    public function read($id): string
+    {
+        return '';
+    }
+
+    public function write($id, $data): bool
+    {
+        return true;
+    }
+
+    public function destroy($id): bool
+    {
+        return true;
+    }
+
+    public function gc($maxlifetime): int|false
+    {
+        return 0;
+    }
+
+    public function create_sid(): string
+    {
+        if (++$this->createCalls === 2) {
+            throw new RuntimeException('create_sid failed');
+        }
+        return parent::create_sid();
+    }
+}
+
+$h = new CountingHandler();
+session_set_save_handler($h, true);
+$started = session_start();
+try {
+    session_regenerate_id();
+} catch (Throwable $e) {
+    $msg = $e::class . ': ' . $e->getMessage();
+}
+session_module_name('files');
+echo $msg ?? 'no exception', PHP_EOL;
+var_dump($started);
+var_dump(session_status() === PHP_SESSION_NONE);
+echo "open={$h->opens} close={$h->closes}\n";
+
+?>
+--EXPECT--
+Error: Session id must be a string
+bool(true)
+bool(true)
+open=2 close=1