[php-src] PR #24022: ext/session: Close save handler when session encoding fails
| From: | iliaal | Date: | Wed, 30 Sep 2026 15:33:14 +0000 |
| Subject: | [php-src] PR #24022: ext/session: Close save handler when session encoding fails | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39001@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24022
Author: iliaal
Since 86b49211577, a session that cannot be encoded (for example a $_SESSION key containing a pipe
with the php serializer) makes session_write_close() return early without closing the save handler,
so the files handler keeps the session file locked until the end of the request and concurrent
requests for that session block on it. This only affects PHP-8.6 and master; 8.5 and earlier always
reached the close. The handler is now closed on that return, like the rest of the function and
session_regenerate_id() already do, including when an exception is pending, since the engine does
not invoke a user close() callback in that state anyway.
/cc @Girgias