Bug #70506 [Opn]: Crash due to uninitialised variable in user-space session handler

Edit report at https://bugs.php.net/bug.php?id=70506&edit=1 ID: 70506 Updated by: laruence@php.net Reported by: lbarnaud@php.net Summary: Crash due to uninitialised variable in user-space session handler Status: Open Type: Bug Package: Session related PHP Version: master-Git-2015-09-15 (Git) Block user comment: N Private report: N New Comment: if it is non-string, read will return FAILURE, which means the val is un-initlized , I don't see why this is a problem? thanks Previous Comments: ------------------------------------------------------------------------ [2015-09-15 17:41:04] lbarnaud@php.net Description: ------------ There is an issue in the user-space session handler implementation that can leave a variable uninitialised. This causes random crashes or memory exhaustions. See https://github.com/php/php-src/blob/6065b29fe41f09e01dd06ba21980e0344f13230c/ext/session/mod_user.c#L122 When SessionHandlerInterface::read() returns anything that's not a string, val is left uninitialised. I've seen this bug causing crashed and memory exhaustions. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70506&edit=1