Bug #16859 Updated: session_decode gives SEGV in PHP 4.2.0

ID: 16859 Updated by: chris-php@bolt.cx Reported By: hope@internexo.co.cr Status: Open Bug Type: Session related Operating System: Solaris 2.6 (5.6) PHP Version: 4.2.0 New Comment: Forgot to mention, I have an example script including all session data which crashes it: http://neo.zero-gravity.org/bug16859.txt Previous Comments: ------------------------------------------------------------------------ [2002-06-09 22:28:58] chris-php@bolt.cx I can also reproduce this bug: Linux 2.4.19-pre4 SMP Apache 1.3.24 PHP 4.2.1 ------------------------------------------------------------------------ [2002-05-25 12:14:14] thomas.paulmichl@limu.com I can reproduce this bug on: Linux 2.4.7-10 Apache 1.3.24 PHP 4.2.1 .... when using session_decode to decode session data strings read from /tmp/sess_* session files. ------------------------------------------------------------------------ [2002-04-29 12:06:48] hope@internexo.co.cr As an explanation to the backtrace I posted: The backslashes that appear before some of the double quotes in the backtrace are due to gdb. The file that is read (and the string that's processed) do _not_ contain the backslash. The variable "ses_login" is the first of the session variables that are stored as part of the session data. The backtrace says that it's dying in session.c, line 290. This is in function php_set_session_var(), at the point where it's trying to call zend_set_hash_symbol(). The PHP setting "register_globals" is set to "On" in both the local and master contexts. The script that causes this error is calling session_decode without having called any kind of session_start or session_name beforehand. (Again, this works as I expected it to in 4.1.2; the SEGV is in 4.2.0). ------------------------------------------------------------------------ [2002-04-28 14:23:18] hope@internexo.co.cr Backtrace (running in gdb with -X) is: (gdb) bt #0 0x8ed44 in php_set_session_var (name=0x3364f0 "ses_login", namelen=9, state_val=0x328dd0, var_hash=0xefffcfb0) at session.c:290 #1 0x8f588 in ps_srlzr_decode_php ( val=0x339128 "ses_login|s:8:\"theodore\";ses_id|s:19:\"PMwwKgoAADwAADKfkFU\";ses_timestamp_ultimo|i:1020014634;ses_timestamp_inicio|i:1020014634;ses_ip|s:9:\"10.0.0.64\";ses_url|s:13:\"/contar.phtml\";ses_valor|i:1;", vallen=193) at session.c:441 #2 0x8f87c in php_session_decode ( val=0x339128 "ses_login|s:8:\"theodore\";ses_id|s:19:\"PMwwKgoAADwAADKfkFU\";ses_timestamp_ultimo|i:1020014634;ses_timestamp_inicio|i:1020014634;ses_ip|s:9:\"10.0.0.64\";ses_url|s:13:\"/contar.phtml\";ses_valor|i:1;", vallen=193) at session.c:490 #3 0x93454 in zif_session_decode (ht=1, return_value=0x3360d0, this_ptr=0x0, return_value_used=0) at session.c:1339 #4 0x1a2080 in execute (op_array=0x323440) at ./zend_execute.c:1598 #5 0x169e48 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:810 #6 0x4e270 in php_execute_script (primary_file=0xeffff7f0) at main.c:1381 #7 0x17c1fc in apache_php_module_main (r=0x30a420, display_source_mode=0) at sapi_apache.c:90 #8 0x48b8c in send_php () #9 0x48bf8 in send_parsed_php () #10 0x1ad4e4 in ap_invoke_handler () #11 0x1bf494 in process_request_internal () #12 0x1bf4ec in ap_process_request () #13 0x1b7d84 in child_main () #14 0x1b7f38 in make_child () #15 0x1b8084 in startup_children () #16 0x1b866c in standalone_main () #17 0x1b8df4 in main () (gdb) ------------------------------------------------------------------------ [2002-04-26 20:07:49] mfischer@php.net To properly diagnose this bug, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/16859 -- Edit this bug report at http://bugs.php.net/?id=16859&edit=1