Bug #16044: crashing apparently in session module

[eblade]

From:             [EMAIL PROTECTED]
Operating system: Linux 2.4.7
PHP version:      4.1.2
PHP Bug Type:     Reproducible crash
Bug description:  crashing apparently in session module

Using any handler BUT files for sessions seems to crash the PHP program
nine times out of ten - once the session is registered, however, it seems
to operate just fine.

Here's my session code, hope it will help.  

<?PHP
require_once 'db.php';
$debug_session = 0;
$SESS_DBNAME = "mage";
$SESS_DBTABLE = "sessions";
//$SESS_LIFE = get_cfg_var("session.gc_maxlifetime");
$SESS_LIFE = 1800; // session data not refresh could run for 30 min?

function sess_open($save_path, $session_name) { 
    global $SESS_DBNAME, $SESS_DBTABLE, $debug_session;
    return true;
}

function sess_close() { 
    global $debug_session;
    return true; 
}

function sess_read($key) {
    global $debug_session, $SESS_DBNAME, $SESS_DBTABLE;
    if($debug_session) echo "sess_read($key)<BR>";
        $q = "SELECT svalue FROM $SESS_DBTABLE WHERE sesskey='$key' AND expire <
".time();
        $dbr = db_request($q);
        if($dbr && mysql_num_rows($dbr)) {
                $q = "DELETE FROM $SESS_DBTABLE WHERE sesskey='$key'";
                db_request($q);
                header("Location: expire.php");
                exit;
        }
    $q = "SELECT svalue FROM $SESS_DBTABLE WHERE sesskey='$key' AND expire
> " . time();
        $dbr = db_request($q);
    if($debug_session) echo "msql($q) returns $dbr<BR>";
    if(!$dbr) return false;
    $value = mysql_fetch_row($dbr); 
    if($debug_session) echo "sess_read returning $value[0]<BR>";
    return $value[0];
}

function sess_write($key, $val) {
    global $user,$debug_session, $SESS_LIFE, $SESS_DBNAME, $SESS_DBTABLE;
    $expire = time() + (60 * 30);
    $value = addslashes($val);
    $q = "INSERT INTO $SESS_DBTABLE VALUES ('$key', $expire, '$value',
'$user[username]', '$user[location]', '$user[activity]')";
        $dbr = db_request($q);
    if($debug_session) echo "sess_write($key, $val)<BR>msql($q) returns
$dbr<BR>";
    if(!$dbr) {
        $q = "UPDATE $SESS_DBTABLE SET
location='$user[location]',activity='$user[activity]',username='$user[username]',expire=$expire,svalue='$value'
WHERE sesskey = '$key' AND expire > " . time();
        $dbr = db_request($q);
    }
    if($debug_session) echo "sess_write() returning $dbr<BR>";
    return $dbr;
}

function sess_destroy($key) {
    global $debug_session, $SESS_DBNAME, $SESS_DBTABLE;
    $q = "DELETE FROM $SESS_DBTABLE WHERE sesskey = '$key'";
    $dbr = db_request($q);
    if($debug_session) echo "sess_destroy($key)<BR>msql($q) return
$dbr<BR>";
    return $dbr;
}

function sess_gc($maxlifetime) {
    global $SESS_DBNAME, $SESS_DBTABLE;
    $q = "DELETE FROM $SESS_DBTABLE WHERE expire < " . time();
    $dbr = db_request($q);
    return mysql_affected_rows();
}

function session_dump() {
    $session_array = explode(';',session_encode());
    $html = "<!-- SESSION VARIABLE DUMP\n\n";
    for($x = 0; $x < count($session_array); $x++) {
        $html .= " $session_array[$x] \n";
    }
    $html .= " -->\n\n";
    echo $html;
}

function query_present($loc) {
        global $SESS_DBTABLE;
        $q = "location='$loc' and expire > ".time();
        $f = "username,activity";
        $dbr = db_array($SESS_DBTABLE, $q, $f);
        if(!$dbr) return 0;
        while($x = each($dbr)) {
                $ret[$x['value']['username']] = $x['value']['activity'];
        }
        return $ret;
}

function query_num_online() {
        global $SESS_DBTABLE;
        $q = "expire > ".time();
        $f = "count(*)";
        $dbr = db_single($SESS_DBTABLE, $q, $f);
        return $dbr[0];
}



session_set_save_handler("sess_open", "sess_close", "sess_read",
                         "sess_write", "sess_destroy", "sess_gc");
?>

-- 
Edit bug report at http://bugs.php.net/?id=16044&edit=1
-- 
Fixed in CVS:        http://bugs.php.net/fix.php?id=16044&r=fixedcvs
Fixed in release:    http://bugs.php.net/fix.php?id=16044&r=alreadyfixed
Need backtrace:      http://bugs.php.net/fix.php?id=16044&r=needtrace
Try newer version:   http://bugs.php.net/fix.php?id=16044&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=16044&r=support
Expected behavior:   http://bugs.php.net/fix.php?id=16044&r=notwrong
Not enough info:     http://bugs.php.net/fix.php?id=16044&r=notenoughinfo
Submitted twice:     http://bugs.php.net/fix.php?id=16044&r=submittedtwice