[php-src] PR #22924: ext/session: check the created ID before validating it
| From: | iliaal | Date: | Wed, 29 Jul 2026 18:01:02 +0000 |
| Subject: | [php-src] PR #22924: ext/session: check the created ID before validating it | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37338@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/22924
Author: iliaal
session_create_id() hands the return value of s_create_sid() straight to
s_validate_sid(). A userland create_sid() that throws makes
ps_create_sid_user() return NULL, and ps_validate_sid_user() then reaches
ZVAL_STR_COPY() with a NULL key.
Reproducer is a SessionHandler subclass whose create_sid() throws on its second call, with
validateId() defined, then session_create_id() on an active session: SIGSEGV on 8.4, 8.5 and master.
The four other s_create_sid() call sites, in php_session_initialize() and session_regenerate_id(),
already test for NULL; #22580 covers the remaining one in SessionHandler::create_sid().