Disallow \0 chars inside session.save_path

diff --git a/ext/session/session.c b/ext/session/session.c
index b6754d5df69b1cf470750f364570f8849f6afcf8..46a35a7a9e630df40b80db459277ef761f45073e 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -153,6 +153,10 @@ static PHP_INI_MH(OnUpdateSaveDir)
        if (stage == PHP_INI_STAGE_RUNTIME) {
                char *p;
 
+               if (memchr(new_value, '\0', new_value_length) != NULL) {
+                       return FAILURE;
+               }
+
                if ((p = zend_memrchr(new_value, ';', new_value_length))) {
                        p++;
                } else {