Bug #73394 [Com]: php_session_initialize doesn't verify s_read return value
Edit report at https://bugs.php.net/bug.php?id=73394&edit=1
ID: 73394
Comment by: archiranee1491 at gmail dot com
Reported by: martijn at openbsd dot org
Summary: php_session_initialize doesn't verify s_read return
value
Status: Open
Type: Bug
Package: Session related
Operating System: irrelevant
PHP Version: 7.0.12
Block user comment: N
Private report: N
New Comment:
Looking for the best convection microwave oven in India under 10000 for healthy food buy now! https://www.bestmicrowave.in/best-microwave-oven-india/
Previous Comments:
------------------------------------------------------------------------
[2016-10-26 16:13:01] martijn at openbsd dot org
Description:
------------
When a read from the session backend fails it still initializes the session without data. This
causes problems during either the closing of the session or the php_session_decode (depending on the
serializer) with writing an empty session or destroying the session data respectively.
I choose E_ERROR to be in line with s_open and s_create_id function checks, but it can easily
changed into E_WARNING to be more in line with the original comment and would cause a return FALSE,
because PS(session_status) is not php_session_active.
I haven't looked into other versions, but I guess this applies to other versions as well.
Test script:
---------------
Originally found with https://github.com/php-memcached-dev/php-memcached/
as a session backend.
The script below can be tested by setting up memcached and doing a
"add memc.sess.lock.<session_id> 0 0 1" on a telnet session to memcached (make sure
that memcached.session_locking is set, which it is by default).
The request will first hang and at the end reset the session content in memcached.
<?php
ini_set('session.save_handler', 'memcached');
ini_set('session.save_path', "127.0.0.01:11211");
session_start();
var_dump($_SESSION, session_id());
$_SESSION["a"] = "b";
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=73394&edit=1
Thread (5 messages)