Bug #70506 [Opn->Fbk]: Crash due to uninitialised variable in user-space session handler

Edit report at https://bugs.php.net/bug.php?id=70506&edit=1 ID: 70506 Updated by: laruence@php.net Reported by: lbarnaud@php.net Summary: Crash due to uninitialised variable in user-space session handler -Status: Open +Status: Feedback Type: Bug Package: Session related PHP Version: master-Git-2015-09-15 (Git) Block user comment: N Private report: N New Comment: Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2015-09-16 03:53:46] laruence@php.net if it is non-string, read will return FAILURE, which means the val is un-initlized , I don't see why this is a problem? thanks ------------------------------------------------------------------------ [2015-09-15 17:41:04] lbarnaud@php.net Description: ------------ There is an issue in the user-space session handler implementation that can leave a variable uninitialised. This causes random crashes or memory exhaustions. See https://github.com/php/php-src/blob/6065b29fe41f09e01dd06ba21980e0344f13230c/ext/session/mod_user.c#L122 When SessionHandlerInterface::read() returns anything that's not a string, val is left uninitialised. I've seen this bug causing crashed and memory exhaustions. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70506&edit=1