From cc489eab295b5f3f4fc9307985bb457f265d4ee2 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Sun, 11 Jan 2026 15:06:06 +0100
Subject: [PATCH 1/2] Fix GH-20906: Assertion failure when messing up output
 buffers

---
 ext/standard/basic_functions.c            | 15 +++++++++++---
 ext/standard/tests/strings/gh20906_1.phpt | 25 +++++++++++++++++++++++
 ext/standard/tests/strings/gh20906_2.phpt | 21 +++++++++++++++++++
 ext/standard/tests/strings/gh20906_3.phpt | 21 +++++++++++++++++++
 4 files changed, 79 insertions(+), 3 deletions(-)
 create mode 100644 ext/standard/tests/strings/gh20906_1.phpt
 create mode 100644 ext/standard/tests/strings/gh20906_2.phpt
 create mode 100644 ext/standard/tests/strings/gh20906_3.phpt

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 16c34a21966e9..b550ea38afc99 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1768,7 +1768,10 @@ PHP_FUNCTION(highlight_file)
 	}
 
 	if (i) {
-		php_output_start_default();
+		if (php_output_start_default() != SUCCESS) {
+			zend_throw_error(NULL, "Unable to start output handler");
+			RETURN_THROWS();
+		}
 	}
 
 	php_get_highlight_struct(&syntax_highlighter_ini);
@@ -1803,7 +1806,10 @@ PHP_FUNCTION(php_strip_whitespace)
 		Z_PARAM_PATH_STR(filename)
 	ZEND_PARSE_PARAMETERS_END();
 
-	php_output_start_default();
+	if (php_output_start_default() != SUCCESS) {
+		zend_throw_error(NULL, "Unable to start output handler");
+		RETURN_THROWS();
+	}
 
 	zend_stream_init_filename_ex(&file_handle, filename);
 	zend_save_lexical_state(&original_lex_state);
@@ -1840,7 +1846,10 @@ PHP_FUNCTION(highlight_string)
 	ZEND_PARSE_PARAMETERS_END();
 
 	if (i) {
-		php_output_start_default();
+		if (php_output_start_default() != SUCCESS) {
+			zend_throw_error(NULL, "Unable to start output handler");
+			RETURN_THROWS();
+		}
 	}
 
 	EG(error_reporting) = E_ERROR;
diff --git a/ext/standard/tests/strings/gh20906_1.phpt b/ext/standard/tests/strings/gh20906_1.phpt
new file mode 100644
index 0000000000000..ccb0dfbee5669
--- /dev/null
+++ b/ext/standard/tests/strings/gh20906_1.phpt
@@ -0,0 +1,25 @@
+--TEST--
+GH-20906 (Assertion failure when messing up output buffers) - php_strip_whitespace
+--CREDITS--
+vi3tL0u1s
+--FILE--
+<?php
+class A {
+    function __destruct() {
+        php_strip_whitespace(__FILE__);
+        echo "x";
+        $c = new A;
+        ob_start(function () use ($c) { return '/'; }, 1);
+        ob_start(function () use (&$c) { $c = new A; return '/'; }, 1);
+    }
+}
+
+try {
+  new A;
+} catch (Throwable $e) {
+  echo $e::class, ": ", $e->getMessage(), "\n";
+}
+?>
+--EXPECTF--
+%a
+Fatal error: php_strip_whitespace(): Cannot use output buffering in output buffering display handlers in %s on line %d
diff --git a/ext/standard/tests/strings/gh20906_2.phpt b/ext/standard/tests/strings/gh20906_2.phpt
new file mode 100644
index 0000000000000..b3ea5cf6ef74b
--- /dev/null
+++ b/ext/standard/tests/strings/gh20906_2.phpt
@@ -0,0 +1,21 @@
+--TEST--
+GH-20906 (Assertion failure when messing up output buffers) - highlight_file
+--CREDITS--
+vi3tL0u1s
+--FILE--
+<?php
+class A {
+    function __destruct() {
+        highlight_file(__FILE__, true);
+        echo "x";
+        $c = new A;
+        ob_start(function () use ($c) { return '/'; }, 1);
+        ob_start(function () use (&$c) { $c = new A; return '/'; }, 1);
+    }
+}
+
+new A;
+?>
+--EXPECTF--
+%a
+Fatal error: highlight_file(): Cannot use output buffering in output buffering display handlers in %s on line %d
diff --git a/ext/standard/tests/strings/gh20906_3.phpt b/ext/standard/tests/strings/gh20906_3.phpt
new file mode 100644
index 0000000000000..a26fc61bed654
--- /dev/null
+++ b/ext/standard/tests/strings/gh20906_3.phpt
@@ -0,0 +1,21 @@
+--TEST--
+GH-20906 (Assertion failure when messing up output buffers) - highlight_string
+--CREDITS--
+vi3tL0u1s
+--FILE--
+<?php
+class A {
+    function __destruct() {
+        highlight_string(__FILE__, true);
+        echo "x";
+        $c = new A;
+        ob_start(function () use ($c) { return '/'; }, 1);
+        ob_start(function () use (&$c) { $c = new A; return '/'; }, 1);
+    }
+}
+
+new A;
+?>
+--EXPECTF--
+%a
+Fatal error: highlight_string(): Cannot use output buffering in output buffering display handlers in %s on line %d

From f655a8fc13a135b6316d97a1616c7545fdf933b6 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Sun, 11 Jan 2026 20:36:48 +0100
Subject: [PATCH 2/2] unexpected

---
 ext/standard/basic_functions.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index b550ea38afc99..cf54fbbe651c5 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1768,7 +1768,7 @@ PHP_FUNCTION(highlight_file)
 	}
 
 	if (i) {
-		if (php_output_start_default() != SUCCESS) {
+		if (UNEXPECTED(php_output_start_default() != SUCCESS)) {
 			zend_throw_error(NULL, "Unable to start output handler");
 			RETURN_THROWS();
 		}
@@ -1806,7 +1806,7 @@ PHP_FUNCTION(php_strip_whitespace)
 		Z_PARAM_PATH_STR(filename)
 	ZEND_PARSE_PARAMETERS_END();
 
-	if (php_output_start_default() != SUCCESS) {
+	if (UNEXPECTED(php_output_start_default() != SUCCESS)) {
 		zend_throw_error(NULL, "Unable to start output handler");
 		RETURN_THROWS();
 	}
@@ -1846,7 +1846,7 @@ PHP_FUNCTION(highlight_string)
 	ZEND_PARSE_PARAMETERS_END();
 
 	if (i) {
-		if (php_output_start_default() != SUCCESS) {
+		if (UNEXPECTED(php_output_start_default() != SUCCESS)) {
 			zend_throw_error(NULL, "Unable to start output handler");
 			RETURN_THROWS();
 		}