Fix GH-23764: Built-in server leaks fd on HEAD request for static file

php_cli_server_begin_send_static() opens the file, but for HEAD requests
never stores the descriptor in client->file_fd, so nothing closes it.
Close it right away; Content-Length comes from the stat and the body is
never sent, so the descriptor is not needed.

Author: jakubskopal

NEWS

@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - CLI
   . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
     request activation). (matyhtf)
+  . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
+    request for a static file). (Jakub Skopal)
 
 - DOM:
   . Fixed use-after-free when re-constructing a DOMXPath whose php:function

sapi/cli/php_cli_server.c

@@ -2185,6 +2185,9 @@ static zend_result php_cli_server_begin_send_static(php_cli_server *server, php_
 	client->content_sender_initialized = true;
 	if (client->request.request_method != PHP_HTTP_HEAD) {
 		client->file_fd = fd;
+	} else {
+		/* Content-Length comes from the stat, the body is never sent. */
+		close(fd);
 	}
 
 	{