Bug #69111 [Com]: Crash in SessionHandler::read()

Edit report at https://bugs.php.net/bug.php?id=69111&edit=1 ID: 69111 Comment by: nikic@php.net Reported by: nikic@php.net Summary: Crash in SessionHandler::read() Status: Assigned Type: Bug Package: Session related PHP Version: 5.5.22 Assigned To: yohgaki Block user comment: N Private report: N New Comment: Credit to http://www.reddit.com/user/Nicoon for finding this issue :) Previous Comments: ------------------------------------------------------------------------ [2015-02-23 20:33:19] nikic@php.net Description: ------------ The script <?php $sh = new SessionHandler; session_set_save_handler($sh); $savePath = ini_get('session.save_path'); $sessionName = ini_get('session.name'); // session_start(); // Uncommenting this makes it not crash when reading the session (see below), but it will not return any data. $sh->open($savePath, $sessionName); $sh->write("foo", "bar"); $sh->read($id); Results in a crash (running with -n). Backtrace: Program received signal SIGSEGV, Segmentation fault. __strcmp_ssse3 () at ../sysdeps/i386/i686/multiarch/strcmp-ssse3.S:233 233 ../sysdeps/i386/i686/multiarch/strcmp-ssse3.S: No such file or directory. (gdb) bt #0 __strcmp_ssse3 () at ../sysdeps/i386/i686/multiarch/strcmp-ssse3.S:233 #1 0x082ba633 in ps_files_open (data=0xb7fbfa58, key=0x0, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/ext/session/mod_files.c:127 #2 0x082bb146 in ps_read_files (mod_data=0x89eea24, key=0xb7fc0e7c "", val=0xbfffbc9c, vallen=0xbfffbca4, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/ext/session/mod_files.c:362 #3 0x082acca3 in zim_SessionHandler_read (ht=1, return_value=0xb7fc0eb0, return_value_ptr=0x0, this_ptr=0xb7fbdf48, return_value_used=0, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/ext/session/mod_user_class.c:83 #4 0x08486b53 in zend_do_fcall_common_helper_SPEC (execute_data=0xb7fa216c, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/Zend/zend_vm_execute.h:550 #5 0x084873e4 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0xb7fa216c, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/Zend/zend_vm_execute.h:685 #6 0x084860ff in execute_ex (execute_data=0xb7fa216c, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/Zend/zend_vm_execute.h:363 #7 0x084861b4 in zend_execute (op_array=0xb7fbe7f4, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/Zend/zend_vm_execute.h:388 #8 0x0844ad81 in zend_execute_scripts (type=8, tsrm_ls=0x894bd80, retval=0x0, file_count=3) at /home/nikic/dev/php-5.5/Zend/zend.c:1327 #9 0x083ad5f2 in php_execute_script (primary_file=0xbfffe0f0, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/main/main.c:2506 #10 0x084f4783 in do_cli (argc=2, argv=0x894bce8, tsrm_ls=0x894bd80) The issue is that PS(id) is NULL in the following line: (gdb) f 2 #2 0x082bb146 in ps_read_files (mod_data=0x89eea24, key=0xb7fc0e7c "", val=0xbfffbc9c, vallen=0xbfffbca4, tsrm_ls=0x894bd80) at /home/nikic/dev/php-5.5/ext/session/mod_files.c:362 362 ps_files_open(data, PS(id) TSRMLS_CC); This is a regression from https://github.com/php/php-src/commit/16411586449c7562b840d6226f6ef55f567c35f3 which fixed bug #65475. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69111&edit=1