[php-src] Issue #24561: session_write_close() returns true when the session data could not be written
| From: | Marti2203 | Date: | Thu, 22 Oct 2026 16:39:28 +0000 |
| Subject: | [php-src] Issue #24561: session_write_close() returns true when the session data could not be written | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253105@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24561
Author: Marti2203
### Description
session_write_close() returns true even when the session data could not be
written. The manual says it "Returns true on success or false on
failure", but php_session_flush() returns true whenever the session
was active, and php_session_save_current_state() does not report the write result.
The following code:
```php
<?php
ini_set('session.use_cookies', 0);
ini_set('session.cache_limiter', '');
class H implements SessionHandlerInterface {
function open($p, $n): bool { return true; }
function close(): bool { return true; }
function read($id): string|false { return ''; }
function write($id, $data): bool { echo "write() called, returning false\n"; return
false; }
function destroy($id): bool { return true; }
function gc($m): int|false { return 0; }
}
session_set_save_handler(new H, false);
session_id('abc');
session_start();
$_SESSION['x'] = 1;
var_dump(session_write_close());
```
Resulted in this output:
```
write() called, returning false
Warning: session_write_close(): Failed to write session data using user defined save handler.
(session.save_path: , handler: H::write) in ... on line 17
bool(true)
```
But I expected this output instead:
```
write() called, returning false
Warning: session_write_close(): Failed to write session data using user defined save handler.
(session.save_path: , handler: H::write) in ... on line 17
bool(false)
```
The same happens when encoding fails (e.g. a key containing |): the recently added
ext/session/tests/session_write_close_encode_failure.phpt expects
bool(true) after the "Failed to write session data" warning, so I'm not
sure whether returning true here is intended (meaning "the session was
closed") or whether session_write_close() should report the failed write. If it
should, I'm happy to send a PR for master (php_session_save_current_state()
returning its result and php_session_flush() passing it on), since it changes the
return value.
### PHP Version
PHP 8.4.28-dev (PHP-8.4 at b4ca62e317); same code on master
### Operating System
Linux x86-64
This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually.