Bug #71962 [NEW]: session_start returns true after timeout, corrupts session data

From: woolardfa at appstate dot edu Operating system: OpenSuSE PHP version: 5.6.20 Package: Session related Bug Type: Bug Bug description:session_start returns true after timeout, corrupts session data Description: ------------ When configured to use memcached for a session store, session_start returns true when the session lock key was already present (from a previous, long-running page request), and exhausts the retry attempts. An empty $_SESSION super global is created. When in the second page request (e.g. an AJAX call via xhr) finished and calls session_write_close() it then steps on the existing serialized data in memcached, corrupting the session state for the first, and still running page request. The php-memcached code (php_memcached_session.c, line 85) returns a failure code to PHP session management, but it is being ignored. Test script: --------------- Can simulate by adding a key lock value to memcached (via telnet) before a call to session_start. Expected result: ---------------- session_start to return false Actual result: -------------- session_start returns true -- Edit bug report at https://bugs.php.net/bug.php?id=71962&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71962&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71962&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71962&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71962&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71962&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71962&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71962&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71962&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71962&r=support Expected behavior: https://bugs.php.net/fix.php?id=71962&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71962&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71962&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71962&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71962&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71962&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71962&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71962&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71962&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71962&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71962&r=mysqlcfg