#38224 [NEW]: session_start can't handle broken cookies

From: toni at schornboeck dot net Operating system: windows PHP version: 5.1.4 PHP Bug Type: Session related Bug description: session_start can't handle broken cookies Description: ------------ session_start() can't handle broken cookies at all. When a cookie with the name of the session exists, even if it's malformed, for example containing invalid characters, session_start just assumes it is a correct session id - and fails horribly when trying to save data in a file with that "id". Reproduce code: --------------- <?php ob_start(); //setcookie('session_cookie', gzcompress('ä#+´!')); //just call once session_name('session_cookie'); session_start(); echo 'test = ',$_SESSION['test']; $_SESSION['test']='foo'; ob_end_flush(); ?> Expected result: ---------------- Either session_start() should return false or it needs to overwrite the cookie. Nevertheless this code shouldn't produce any errors and save the session variable test correctly. Output: test = foo Actual result: -------------- Warning: session_start() [function.session-start]: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in C:\xampp\xampp\htdocs\yawe\bug.php on line 6 test = Warning: Unknown: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in Unknown on line 0 Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (C:\xampp\xampp\tmp) in Unknown on line 0 and session_start sets the cookie with the same corrupted "session id" again... -- Edit bug report at http://bugs.php.net/?id=38224&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38224&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38224&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38224&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38224&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38224&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38224&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38224&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38224&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38224&r=support Expected behavior: http://bugs.php.net/fix.php?id=38224&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38224&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38224&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38224&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38224&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38224&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38224&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38224&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38224&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38224&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38224&r=mysqlcfg