Edit report at https://bugs.php.net/bug.php?id=60860&edit=1
ID: 60860
Updated by: fel...@php.net
Reported by: bfra...@php.net
Summary: session.save_handler=user without defined function
core dumps
-Status: Open
+Status: Assigned
Type: Bug
Package: Session related
Operating System: Fedora, RHEL, OS X
PHP Version: 5.3.9
-Assigned To:
+Assigned To: felipe
Block user comment: N
Private report: N
New Comment:
I've committed a fix in trunk, I'll check if it's ok to other branches.
Previous Comments:
------------------------------------------------------------------------
[2012-01-28 01:24:52] fel...@php.net
Automatic comment from SVN on behalf of felipe
Revision: http://svn.php.net/viewvc/?view=revision&revision=322897
Log: - Fixed bug #60860 (session.save_handler=user without defined function
core dumps)
------------------------------------------------------------------------
[2012-01-23 20:46:30] bfra...@php.net
Description:
------------
The following script will core dump because the save_handlers have not been
defined, but the session extension is not checking to make sure the functions
are not null before trying to call them.
I would expect an error, but not a core dump.
I think the fix would be in mod_user.c to add a check in PS_OPEN_FUNC,
PS_CLOSE_FUNC, PS_READ_FUNC, PS_WRITE_FUNC, PS_DESTROY_FUNC, PS_GC_FUNC with
something like this:
----
if (PSF(open) == NULL) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "user session handler open not
found");
return FAILURE;
}
----
Or maybe the error "User session functions not configured" or something.
The problem I have with the patch is that it needs TSRMLS_CC, which the PS
function don't pass in and I don't know enough about the threading stuff to fix.
Test script:
---------------
% php -d session.save_handler=user
<?PHP
session_start();
var_dump($_SESSION);
?>
Expected result:
----------------
Expecting a warning about how the user session function are not defined/set.
Actual result:
--------------
This is a backtrace from running under Apache 2.x
#0 zend_is_callable_ex (callable=0x0, object_ptr=0x0, check_flags=8,
callable_name=0xffffaf48, callable_name_len=0xffffae8c, fcc=0xffffaf50,
error=0xffffaf4c)
at php-5.3.9/Zend/zend_API.c:2718
#1 0xf72e150a in zend_call_function (fci=0xffffaff0, fci_cache=0xffffaf50) at
php-5.3.9/Zend/zend_execute_API.c:817
#2 0xf72e21c1 in call_user_function_ex (function_table=0x81f43f8,
object_pp=0x0, function_name=0xffffaf4c, retval_ptr_ptr=0xffffaf4c,
param_count=4294946636, params=0xffffaf4c, no_separation=-20660,
symbol_table=0xffffaf4c) at php-5.3.9/Zend/zend_execute_API.c:758
#3 0xf72e2235 in call_user_function (function_table=0x81f43f8, object_pp=0x0,
function_name=0x0, retval_ptr=0xf6cc7d10, param_count=2, params=0xffffb0c0)
at php-5.3.9/Zend/zend_execute_API.c:731
#4 0xf6a35fcf in ps_call_handler (func=0x0, argc=2, argv=0xffffb0c0) at
php-5.3.9/ext/session/mod_user.c:53
#5 0xf6a360e7 in ps_open_user (mod_data=0xffffaf4c, save_path=0xf6a36a49 "",
session_name=0xf6a3675f "YBY") at php-5.3.9/ext/session/mod_user.c:93
#6 0xf6a32951 in php_session_start () at php-5.3.9/ext/session/session.c:512
#7 0xf6a34784 in zif_session_start (ht=0, return_value=0xf6cc7b00,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
at php-5.3.9/ext/session/session.c:1911
#8 0xf7315474 in zend_do_fcall_common_helper_SPEC (execute_data=0xf654f028) at
php-5.3.9/Zend/zend_vm_execute.h:320
#9 0xf73144ba in execute (op_array=0xf6cc7a1c) at
php-5.3.9/Zend/zend_vm_execute.h:107
#10 0xf72f0e31 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
php-5.3.9/Zend/zend.c:1237
#11 0xf7294be4 in php_execute_script (primary_file=0xffffd5d0) at
php-5.3.9/main/main.c:2343
#12 0xf737ae3d in php_handler (r=0x82c6588) at
php-5.3.9/sapi/apache2handler/sapi_apache2.c:685
#13 0x08074ddd in ap_run_handler (r=0x82c6588) at config.c:157
#14 0x080751c1 in ap_invoke_handler (r=0x82c6588) at config.c:376
#15 0x08081d22 in ap_process_request (r=0x82c6588) at http_request.c:282
#16 0x0807f31a in ap_process_http_connection (c=0x82c23b8) at http_core.c:190
#17 0x0807b971 in ap_run_process_connection (c=0x82c23b8) at connection.c:43
#18 0x080868b7 in child_main (child_num_arg=Variable "child_num_arg" is not
available.
) at prefork.c:667
#19 0x08086ab1 in make_child (s=0x80aafd0, slot=0) at prefork.c:712
#20 0x08087153 in ap_mpm_run (_pconf=0x80a90d8, plog=0x80d7190, s=0x80aafd0) at
prefork.c:990
#21 0x08063047 in main (argc=2, argv=0xffffdb74) at main.c:739
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=60860&edit=1
