Bug #16859 Updated: session_decode gives SEGV in PHP 4.2.0

ID: 16859 Updated by: phpcoder@ihearditwas.com Reported By: hope@internexo.co.cr Status: Open Bug Type: Session related Operating System: Solaris 2.6 (5.6) PHP Version: 4.2.0 New Comment: I can also reproduce a Segmentation Fault with session_decode() on: RedHat 7.3 Apache 1.3.23 PHP 4.2.1 Previous Comments: ------------------------------------------------------------------------ [2002-06-09 22:56:55] chris-php@bolt.cx Recompiled with --enable-debug on FreeBSD 4.5, and I'm getting a considerably different backtrace: (gdb) bt #0 0x8082108 in set_default_charset_by_name (cs_name=0x818d0cc "signature", flags=9) at charset.c:416 #1 0x8082879 in zm_info_pcre (zend_module=0x818200c) at php_pcre.c:88 #2 0x8082a25 in pcre_get_compiled_regex ( regex=0x818200c "signature|s:8:\"Damn\\'..\";!daheader|!daHeaderRandom|!daIndexTop|!daMenuDeviations|daTaglines|s:2:\"no\";!daNewLimit|!daNewDevs|daBuddyList|N;daBuddyStatus|s:6:\"online\";!daNewDisplay|daSortBy|s:4:\"date\";d"..., extra=0x81b, preg_options=0x8151044) at php_pcre.c:164 #3 0x8084c72 in preg_replace_impl (ht=1, return_value=0x818d0ac, this_ptr=0x0, return_value_used=0, is_callable_replace=8 '\b') at php_pcre.c:1009 #4 0x80fdf48 in tsrm_strndup (s=0x817f88c "\002", length=2) at tsrm_virtual_cwd.c:161 #5 0x80e37b8 in zif_xml_parser_set_option (ht=8, return_value=0x0, this_ptr=0x3, return_value_used=0) at xml.c:1519 #6 0x8061242 in php_module_startup (sf=0xbfbffc10) at main.c:971 #7 0x805f180 in main (argc=3, argv=0xbfbffc78) at cgi_main.c:649 #8 0x805e54d in acos () ------------------------------------------------------------------------ [2002-06-09 22:31:25] chris-php@bolt.cx Forgot to mention, I have an example script including all session data which crashes it: http://neo.zero-gravity.org/bug16859.txt ------------------------------------------------------------------------ [2002-06-09 22:28:58] chris-php@bolt.cx I can also reproduce this bug: Linux 2.4.19-pre4 SMP Apache 1.3.24 PHP 4.2.1 ------------------------------------------------------------------------ [2002-05-25 12:14:14] thomas.paulmichl@limu.com I can reproduce this bug on: Linux 2.4.7-10 Apache 1.3.24 PHP 4.2.1 .... when using session_decode to decode session data strings read from /tmp/sess_* session files. ------------------------------------------------------------------------ [2002-04-29 12:06:48] hope@internexo.co.cr As an explanation to the backtrace I posted: The backslashes that appear before some of the double quotes in the backtrace are due to gdb. The file that is read (and the string that's processed) do _not_ contain the backslash. The variable "ses_login" is the first of the session variables that are stored as part of the session data. The backtrace says that it's dying in session.c, line 290. This is in function php_set_session_var(), at the point where it's trying to call zend_set_hash_symbol(). The PHP setting "register_globals" is set to "On" in both the local and master contexts. The script that causes this error is calling session_decode without having called any kind of session_start or session_name beforehand. (Again, this works as I expected it to in 4.1.2; the SEGV is in 4.2.0). ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/16859 -- Edit this bug report at http://bugs.php.net/?id=16859&edit=1