Built-in server leaks a file descriptor on every HEAD request for a static file

Description

Since PHP 8.2 (#8215), php_cli_server_begin_send_static() in sapi/cli/php_cli_server.c opens the static file but only stores the descriptor in client->file_fd for non-HEAD requests:

fd = open(client->request.path_translated, O_RDONLY);
...
if (client->request.request_method != PHP_HTTP_HEAD) {
    client->file_fd = fd;
}

For HEAD, fd is never stored and never closed. Each HEAD request to a static file leaks one descriptor; once RLIMIT_NOFILE is reached every request fails with 404 ... Too many open files. A monitoring probe doing HEAD / every 40 s takes down php -S in ~11 hours.

Affected: PHP-8.2, PHP-8.3, PHP-8.4, PHP-8.5, master. PHP 8.1 is not affected (no HEAD special-casing).

Reproduction:

mkdir t && echo hi > t/index.html
php -S 127.0.0.1:8080 -t t &
for i in $(seq 100); do curl -sI http://127.0.0.1:8080/ >/dev/null; done
ls -l /proc/$!/fd | grep -c index.html   # 100

Suggested fix — close the descriptor when it is not handed to the content sender (Content-Length uses client->request.sb.st_size from the earlier stat, so the fd is not needed for HEAD at all):

if (client->request.request_method != PHP_HTTP_HEAD) {
    client->file_fd = fd;
} else {
    close(fd);
}

PHP Version

PHP 8.2 – 8.5, master

Operating System

Linux (any)

Bắt đầu trong sapi/cli/php_cli_server.c tại php_cli_server_begin_send_static(), sau đó chạy php -S được cung cấp và quy trình tái hiện bằng curl HEAD lặp lại. Hoàn tất khi các yêu cầu HEAD lặp lại đến một tệp tĩnh không còn làm tăng số lượng trình mô tả tệp đang mở, đồng thời các phản hồi tĩnh thông thường vẫn tiếp tục hoạt động.