From 6fb9e69b0231a43ec80969437efc730f35e095eb Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Fri, 27 Jun 2025 20:36:47 +0200
Subject: [PATCH] Warn on http_response_code() after header('HTTP/...')

Fixes GH-18582
Fixes #81451

Co-authored-by: Jakub Zelenka <bukka@php.net>
---
 ext/standard/head.c         |  8 ++++++++
 sapi/cli/tests/gh18582.phpt | 40 +++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 sapi/cli/tests/gh18582.phpt

diff --git a/ext/standard/head.c b/ext/standard/head.c
index ccef4be16bdfd..45a0ba763be37 100644
--- a/ext/standard/head.c
+++ b/ext/standard/head.c
@@ -375,6 +375,14 @@ PHP_FUNCTION(http_response_code)
 			}
 			RETURN_FALSE;
 		}
+
+		if (SG(sapi_headers).http_status_line) {
+			php_error_docref(NULL, E_WARNING, "Calling http_response_code() after header('HTTP/...') has no effect");
+			// If it is decided that this should have effect in the future, replace warning with
+			// efree(SG(sapi_headers).http_status_line);
+			// SG(sapi_headers).http_status_line = NULL;
+		}
+
 		zend_long old_response_code;
 
 		old_response_code = SG(sapi_headers).http_response_code;
diff --git a/sapi/cli/tests/gh18582.phpt b/sapi/cli/tests/gh18582.phpt
new file mode 100644
index 0000000000000..0c3cebf71c3d1
--- /dev/null
+++ b/sapi/cli/tests/gh18582.phpt
@@ -0,0 +1,40 @@
+--TEST--
+GH-18582: Allow http_response_code() to clear HTTP start-line
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+include "php_cli_server.inc";
+
+php_cli_server_start(<<<'PHP'
+http_response_code(401);
+header('HTTP/1.1 404 Not Found');
+$is_404 = http_response_code(403);
+$should_be_404_but_is_403 = http_response_code();
+echo $is_404 . PHP_EOL;
+echo $should_be_404_but_is_403 . PHP_EOL;
+PHP);
+
+$host = PHP_CLI_SERVER_HOSTNAME;
+$fp = php_cli_server_connect();
+if (fwrite($fp, "GET / HTTP/1.1\nHost: {$host}\n\n")) {
+    while (!feof($fp)) {
+        echo fgets($fp);
+    }
+}
+fclose($fp);
+?>
+--EXPECTF--
+HTTP/1.1 404 Not Found
+Host: %s
+Date: %s
+Connection: close
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+<br />
+<b>Warning</b>:  http_response_code(): Calling http_response_code() after header('HTTP/...') has no effect in <b>%s</b> on line <b>3</b><br />
+404
+403