diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 17000ca3c0f17..338cdc705d082 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -1384,12 +1384,12 @@ static int phar_build(zend_object_iterator *iter, void *puser) /* {{{ */
 	zval *value;
 	bool close_fp = true;
 	struct _phar_t *p_obj = (struct _phar_t*) puser;
-	size_t str_key_len, base_len = ZSTR_LEN(p_obj->base);
+	size_t str_key_len, base_len = p_obj->base ? ZSTR_LEN(p_obj->base) : 0;
 	phar_entry_data *data;
 	php_stream *fp;
 	size_t fname_len;
 	size_t contents_len;
-	char *fname = NULL, *error = NULL, *base = ZSTR_VAL(p_obj->base), *save = NULL, *temp = NULL;
+	char *fname = NULL, *error = NULL, *base = p_obj->base ? ZSTR_VAL(p_obj->base) : NULL, *save = NULL, *temp = NULL;
 	zend_string *opened;
 	char *str_key;
 	zend_class_entry *ce = p_obj->c;
diff --git a/ext/phar/tests/gh20882.phpt b/ext/phar/tests/gh20882.phpt
new file mode 100644
index 0000000000000..8928178a22a9e
--- /dev/null
+++ b/ext/phar/tests/gh20882.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GH-20882 (phar buildFromIterator breaks with missing base directory)
+--EXTENSIONS--
+phar
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+$phar = new \Phar(__DIR__ . "/test.phar");
+try {
+    $phar->buildFromIterator(
+        new RecursiveIteratorIterator(
+            new RecursiveDirectoryIterator(__DIR__.'/test79082', FilesystemIterator::SKIP_DOTS)
+        ),
+        null
+    );
+} catch (BadMethodCallException $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Iterator RecursiveIteratorIterator returns an SplFileInfo object, so base directory must be specified
diff --git a/main/fastcgi.c b/main/fastcgi.c
index 448576a978598..bee1fa47e662e 100644
--- a/main/fastcgi.c
+++ b/main/fastcgi.c
@@ -944,7 +944,7 @@ static inline ssize_t safe_write(fcgi_request *req, const void *buf, size_t coun
 	return n;
 }
 
-static inline ssize_t safe_read(fcgi_request *req, const void *buf, size_t count)
+static inline ssize_t safe_read(fcgi_request *req, void *buf, size_t count)
 {
 	int    ret;
 	size_t n = 0;
diff --git a/main/output.c b/main/output.c
index c90e4426d6cde..32de70862c2d8 100644
--- a/main/output.c
+++ b/main/output.c
@@ -538,6 +538,10 @@ PHPAPI zend_result php_output_handler_start(php_output_handler *handler)
 	HashTable *rconflicts;
 	php_output_handler_conflict_check_t conflict;
 
+	if (!(OG(flags) & PHP_OUTPUT_ACTIVATED)) {
+		return FAILURE;
+	}
+
 	if (php_output_lock_error(PHP_OUTPUT_HANDLER_START) || !handler) {
 		return FAILURE;
 	}
diff --git a/tests/output/gh20352.phpt b/tests/output/gh20352.phpt
index 16be0b920e80f..3074add99d360 100644
--- a/tests/output/gh20352.phpt
+++ b/tests/output/gh20352.phpt
@@ -21,4 +21,7 @@ ob_start(new Test, 1);
 echo "trigger bug";
 ?>
 --EXPECTF--
+%r(Notice: ob_start\(\): Failed to create buffer in [^\r\n]+ on line \d+\r?\n(\r?\n)?)+%r
+Notice: ob_start(): Failed to create buffer in %s on line %d
+
 Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %s on line %d
diff --git a/tests/output/gh20837.phpt b/tests/output/gh20837.phpt
new file mode 100644
index 0000000000000..0952e4ef7b910
--- /dev/null
+++ b/tests/output/gh20837.phpt
@@ -0,0 +1,23 @@
+--TEST--
+ob_start(): NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()
+--FILE--
+<?php
+
+register_shutdown_function(function () {
+    ob_start(function ($input) {
+        echo "bar";
+        return strtoupper($input);
+    });
+});
+
+ob_start(function () {
+    ob_start();
+}, 1);
+
+echo "foo";
+
+?>
+--EXPECTF--
+Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %s on line %d
+
+Notice: ob_start(): Failed to create buffer in %s on line %d