Backported from 5.4.20

From 336a8e1943af85bb49cb5986d897d967ba73dcc0 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 10 Jun 2013 12:32:53 +0400
Subject: [PATCH] Callback has to be restored in MSHUTDOWN

---
 ext/session/session.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ext/session/session.c b/ext/session/session.c
index a3be9a7..d9989ba 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -2221,6 +2221,9 @@ static PHP_MSHUTDOWN_FUNCTION(session) /* {{{ */
 	PHP_MSHUTDOWN(ps_mm) (SHUTDOWN_FUNC_ARGS_PASSTHRU);
 #endif
 
+	/* restore the orig callback */
+	php_rfc1867_callback = php_session_rfc1867_orig_callback;
+
 	ps_serializers[PREDEFINED_SERIALIZERS].name = NULL;
 	memset(&ps_modules[PREDEFINED_MODULES], 0, (MAX_MODULES-PREDEFINED_MODULES)*sizeof(ps_module *));
 
From ba3234888dfbe14dadac7ac6c403a58bc1fdd220 Mon Sep 17 00:00:00 2001
From: Arpad Ray <arraypad@gmail.com>
Date: Wed, 17 Jul 2013 11:02:48 +0100
Subject: [PATCH] Fix bug #62129 - rfc1867 crashes php even though turned off

Patch by gxd305 at gmail dot com
---
 NEWS                  | 2 ++
 ext/session/session.c | 7 +++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/ext/session/session.c b/ext/session/session.c
index 5af3ef2..bbfe90e 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -2221,8 +2221,11 @@ static PHP_MSHUTDOWN_FUNCTION(session) /* {{{ */
 	PHP_MSHUTDOWN(ps_mm) (SHUTDOWN_FUNC_ARGS_PASSTHRU);
 #endif
 
-	/* restore the orig callback */
-	php_rfc1867_callback = php_session_rfc1867_orig_callback;
+	/* reset rfc1867 callbacks */
+	php_session_rfc1867_orig_callback = NULL;
+	if (php_rfc1867_callback == php_session_rfc1867_callback) {
+		php_rfc1867_callback = NULL;
+	}
 
 	ps_serializers[PREDEFINED_SERIALIZERS].name = NULL;
 	memset(&ps_modules[PREDEFINED_MODULES], 0, (MAX_MODULES-PREDEFINED_MODULES)*sizeof(ps_module *));