From b66970498354a7c215bbee7fb91cd1ef4b701f41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@tideways-gmbh.com>
Date: Tue, 6 Jan 2026 09:29:18 +0100
Subject: [PATCH 1/2] output: Fail starting to output buffer when the output
 layer is deactivated

Fixes php/php-src#20837.
---
 main/output.c             |  4 ++++
 tests/output/gh20352.phpt |  3 +++
 tests/output/gh20837.phpt | 23 +++++++++++++++++++++++
 3 files changed, 30 insertions(+)
 create mode 100644 tests/output/gh20837.phpt

diff --git a/main/output.c b/main/output.c
index 4e542318139a7..7f28c25b6c7d1 100644
--- a/main/output.c
+++ b/main/output.c
@@ -538,6 +538,10 @@ PHPAPI zend_result php_output_handler_start(php_output_handler *handler)
 	HashTable *rconflicts;
 	php_output_handler_conflict_check_t conflict;
 
+	if (!(OG(flags) & PHP_OUTPUT_ACTIVATED)) {
+		return FAILURE;
+	}
+
 	if (php_output_lock_error(PHP_OUTPUT_HANDLER_START) || !handler) {
 		return FAILURE;
 	}
diff --git a/tests/output/gh20352.phpt b/tests/output/gh20352.phpt
index 16be0b920e80f..3074add99d360 100644
--- a/tests/output/gh20352.phpt
+++ b/tests/output/gh20352.phpt
@@ -21,4 +21,7 @@ ob_start(new Test, 1);
 echo "trigger bug";
 ?>
 --EXPECTF--
+%r(Notice: ob_start\(\): Failed to create buffer in [^\r\n]+ on line \d+\r?\n(\r?\n)?)+%r
+Notice: ob_start(): Failed to create buffer in %s on line %d
+
 Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %s on line %d
diff --git a/tests/output/gh20837.phpt b/tests/output/gh20837.phpt
new file mode 100644
index 0000000000000..0952e4ef7b910
--- /dev/null
+++ b/tests/output/gh20837.phpt
@@ -0,0 +1,23 @@
+--TEST--
+ob_start(): NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()
+--FILE--
+<?php
+
+register_shutdown_function(function () {
+    ob_start(function ($input) {
+        echo "bar";
+        return strtoupper($input);
+    });
+});
+
+ob_start(function () {
+    ob_start();
+}, 1);
+
+echo "foo";
+
+?>
+--EXPECTF--
+Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %s on line %d
+
+Notice: ob_start(): Failed to create buffer in %s on line %d

From c7513901d23067cd58eecb7772d825d1c6129806 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@bastelstu.be>
Date: Sat, 10 Jan 2026 13:41:53 +0100
Subject: [PATCH 2/2] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index cc21664815252..a8cb10ca8f32d 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.18
 
+- Core:
+  . Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown
+    function triggered by bailout in php_output_lock_error()). (timwolla)
+
 - MbString:
   . Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is
     invalid in the encoding). (ndossche)