Re: [PATCH] default session serialization

On Thu, Nov 26, 2009 at 2:23 PM, Antony Dovgal <tony@daylessday.org> wrote: > On 26.11.2009 03:43, Stanislav Malyshev wrote: > > I think it makes sense. One note: your code allows numeric session keys, > > previously not allowed. Not sure if it's important. > > This might be important for 32bit<->64bit interaction using serialized > data. > > Although the patch allows numeric keys to be encoded, they're silently dropped in decoding. Previously they were silently dropped during encoding. I prefer this way since it saves the overhead of filtering the array first. If there's an inherent danger in unserializing between 32/64bit int array keys, this risk is already present in the form of nested arrays (not to say it's an unimportant consideration). My testing with out of range values on 32bit and 64bit saw nothing unusual, although it revealed a misplaced zval_add_ref which the attached updated patch fixes. Incidentally, is there any need (in HEAD) to check EG(symbol_table) in the decode function, now that register_globals, session_register et al are gone? Regards, Arpad

Attachment: [text/x-diff] php6-session-encode-01.patch