Re: Re: [RFC][VOTE] Session ID without hashing
| From: | Leigh | Date: | Wed, 06 Jul 2016 16:16:18 +0000 |
| Subject: | Re: Re: [RFC][VOTE] Session ID without hashing | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-94403@lists.php.net to get a copy of this message | ||
On Wed, 6 Jul 2016 at 13:10 Christoph Becker <cmbecker69@gmx.de> wrote:
>
> Yes, I am aware that the patch uses php_random_bytes(), but what happens
> when it fails, in which case php_session_create_id() returns null[1]?
> Would it be impossible to use a session in this case?
>
> [1]
> <
>
> https://github.com/php/php-src/pull/1850/files#diff-52eb9eb7f9d5d9125fbb1337a6541c06R315
> >
>
> --
> Christoph M. Becker
>
The FAILURE check here is redundant because it is using the _throw variant
of random_bytes, which means an exception is thrown if there isn't a good
source of random available.