#27099 [Opn->Fbk]: session_decode crash on incorrect data

ID: 27099 Updated by: sniper@php.net Reported By: oleg at khimich dot com -Status: Open +Status: Feedback Bug Type: Session related Operating System: Windows XP PHP Version: 4.3.4 New Comment: Please try using this CVS snapshot: http://snaps.php.net/php4-STABLE-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-STABLE-latest.zip I can not reproduce this. (try provide full example) Previous Comments: ------------------------------------------------------------------------ [2004-01-30 10:14:35] oleg at khimich dot com Description: ------------ In incorrect data passed to session_decode function PHP engine may crash. Reproduce code: --------------- Made session dump with: $f=fopen("$name.profile","w"); fwrite($f,session_encode()); fclose($f); and then if partial read was made before decoding session: $t=fread($f,65000); instead of $t=fread($f,filesize("$name.profile")); so, now in $t there is unclosed strings, brackets.. Now try to make session_decode($t) and php probably crash. Expected result: ---------------- WinXP shows exeption for apache process ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=27099&edit=1