Bug #15308 Updated: Segfault when the string which contains '_' in session name is specified.

From: Date: Sun, 03 Feb 2002 03:22:14 +0000
Subject: Bug #15308 Updated: Segfault when the string which contains '_' in session name is specified.
References: 1  Groups: php.dev 
Request: Send a blank email to php-dev+get-78928@lists.php.net to get a copy of this message
ID: 15308
Updated by: yohgaki@php.net
Reported By: lasttom@ra2.so-net.ne.jp
Status: Analyzed
Bug Type: Session related
Operating System: any
PHP Version: 4.2.0-dev
New Comment:

This bug has been fixed in CVS.


Previous Comments:
------------------------------------------------------------------------

[2002-01-31 04:57:08] yohgaki@php.net

Thank you for responding, Markus.
I asked this user to submit bug report in Japanese PHP mail list.

I think I know what's wrong, but I don't have enough time create and
test patch...

In mod_files.c it tests session id file chars are [0-9a-zA-Z], if not
it returns 0. It seems returning false is causing this. In mod_user.c
and session_pgsql.c, there is very simlar problem. Returning false for
read causes segfault. 

The reason for these segfaults are the same, I guess. 
(i.e. session.c has problem when read returns false)


------------------------------------------------------------------------

[2002-01-31 03:30:13] mfischer@php.net

Does this also happen with 4.1.1 and if, please provide a backtrace
under unix (provided that you compiled both php and apache with debug
symbols).

------------------------------------------------------------------------

[2002-01-31 03:06:39] lasttom@ra2.so-net.ne.jp

Apache child segfault when the string which contains '_' in session
name is specified.
Although tried on Red Hat7.2 and Windows2000, the apache child
segfault.

php.ini
session.save_handler=files

<?php
    session_id ("_index");
    session_start ();
    $_SESSION["foo"]   = "bar";
?>

------------------------------------------------------------------------



Edit this bug report at http://bugs.php.net/?id=15308&edit=1



Thread (4 messages)

« previous php.dev (#78928) next »