Crash when TLS authentication fails with verify_peer #21613

<?php

// Start a local "proxy" that answers CONNECT with 200 then closes immediately,
// causing the SSL handshake to fail on the client side.
$server = stream_socket_server("tcp://127.0.0.1:0", $errno, $errstr);
if (!$server) {
    die("Could not start proxy server: $errstr\n");
}
$proxyAddr = stream_socket_get_name($server, false);

$pid = pcntl_fork();
if ($pid === -1) {
    die("pcntl_fork failed\n");
}

if ($pid === 0) {
    // Child: minimal HTTP CONNECT proxy
    $conn = stream_socket_accept($server, 5);
    if ($conn) {
        // Drain the CONNECT request headers
        while (($line = fgets($conn)) !== false) {
            if (rtrim($line) === '') {
                break;
            }
        }
        // Acknowledge the tunnel — then immediately close.
        // The client will attempt the TLS handshake and fail.
        fwrite($conn, "HTTP/1.1 200 Connection established\r\n\r\n");
        fclose($conn);
    }
    exit(0);
}

// Parent: HTTPS request through the proxy.
// 'verify_peer' => true ensures reset_ssl_peer_name is set (peer_name not pre-set).
// No cafile needed; the TLS handshake itself will fail because the proxy closed.
$ctx = stream_context_create([
    'ssl' => [
        'verify_peer'      => true,
        'verify_peer_name' => true,
    ],
    'http' => [
        'proxy' => "tcp://$proxyAddr",
    ],
]);

// Suppress the expected PHP warning; we only care about the crash.
@file_get_contents("https://127.0.0.1/", false, $ctx);

pcntl_waitpid($pid, $status);
echo "Done\n";