Bug #71472 [Asn->Csd]: session_regenerate_id malfunctions with certain session handlers

Edit report at https://bugs.php.net/bug.php?id=71472&edit=1 ID: 71472 Updated by: yohgaki@php.net Reported by: yohgaki@php.net Summary: session_regenerate_id malfunctions with certain session handlers -Status: Assigned +Status: Closed Type: Bug Package: Session related PHP Version: 7.0.2 Assigned To: yohgaki Block user comment: N Private report: N New Comment: Automatic comment on behalf of mikko@kuut.io Revision: http://git.php.net/?p=php-src.git;a=commit;h=46d4a371054f43fe8aeca14b83ba722adc84ac10 Log: Session regenerate id seems to malfunction with 3rd party session handlers Fixed bug #71472 session_regenerate_id malfunctions with certain session handlers Previous Comments: ------------------------------------------------------------------------ [2016-01-28 03:49:55] yohgaki@php.net Description from the PR The current order of session_regenerate_id seems to be: PS(mod)->s_close PS(mod)-> s_create_sid PS(mod)->s_open This causes PS_CREATE_SID_FUNC to receive NULL data and it completely circumvents the original intention of PS_CREATE_SID_FUNC. (for example mod_files.c skips collision checks if data is NULL). This doesn't seem to cause visible problems with built-in session handlers and not sure how to test this either. t.php <?php ob_start(); ini_set ('session.save_path', '/tmp'); var_dump(session_start()); var_dump(session_regenerate_id(true)); ?> Relevant run on lldb: lldb --file php -- t.php (lldb) target create "/opt/php7/bin/php" Current executable set to '/opt/php7/bin/php' (x86_64). (lldb) settings set -- target.run-args "t.php" (lldb) breakpoint set --file mod_files.c --line 677 Breakpoint 1: where = php`ps_create_sid_files + 100 at mod_files.c:677, address = 0x00000001001cdc34 (lldb) run Process 95005 launched: '/opt/php7/bin/php' (x86_64) Process 95005 stopped * thread #1: tid = 0x5b95ab, 0x00000001001cdc34 php`ps_create_sid_files(mod_data=0x0000000100d5bfe8) + 100 at mod_files.c:677, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 frame #0: 0x00000001001cdc34 php`ps_create_sid_files(mod_data=0x0000000100d5bfe8) + 100 at mod_files.c:677 674 } 675 /* Check collision */ 676 /* FIXME: mod_data(data) should not be NULL (User handler could be NULL) */ -> 677 if (data && ps_files_key_exists(data, ZSTR_VAL(sid)) == SUCCESS) { 678 if (sid) { 679 zend_string_release(sid); 680 sid = NULL; (lldb) p data (ps_files *) $0 = 0x00000001020810f0 (lldb) p *data (ps_files) $1 = (lastkey = 0x0000000000000000, basedir = "/tmp", basedir_len = 4, dirdepth = 0, st_size = 0, filemode = 384, fd = -1) (lldb) cont Process 95005 resuming Process 95005 stopped * thread #1: tid = 0x5b95ab, 0x00000001001cdc34 php`ps_create_sid_files(mod_data=0x0000000100d5bfe8) + 100 at mod_files.c:677, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 frame #0: 0x00000001001cdc34 php`ps_create_sid_files(mod_data=0x0000000100d5bfe8) + 100 at mod_files.c:677 674 } 675 /* Check collision */ 676 /* FIXME: mod_data(data) should not be NULL (User handler could be NULL) */ -> 677 if (data && ps_files_key_exists(data, ZSTR_VAL(sid)) == SUCCESS) { 678 if ( sid) { 679 zend_string_release(sid); 680 sid = NULL; (lldb) p *data error: Couldn't apply expression side effects : Couldn't dematerialize a result variable: couldn't read its memory (lldb) p data (ps_files *) $3 = 0x0000000000000000 @mkoppanen Session regenerate id seems to malfunction with 3rd party session han… … ------------------------------------------------------------------------ [2016-01-28 03:03:19] yohgaki@php.net Description: ------------ session_regenerate_id() should open save handler before calling create_sid. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71472&edit=1