[php-src] PR #25082: ext/session: validate session id just before sending cookie
| From: | Sjord | Date: | Sat, 31 Oct 2026 11:17:49 +0000 |
| Subject: | [php-src] PR #25082: ext/session: validate session id just before sending cookie | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40128@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25082
Author: Sjord
Validate the session ID so we don't send an invalid cookie. This is meant as a hardening
measure. In php2shell memory was dumped through the session cookie, making it possible to bypass
ASLR. By validating the cookie value we can prevent this.
Related to https://github.com/php/php-src/pull/24997