MFH: Fixed bug #24592 (Possible crash in session extnsion, with NULL values).

diff --git a/NEWS b/NEWS
index b193445b1d86b867f356e6de4b4051f7a3b78d05..cdd0fa37f71e75a2b043d83d69db1e34847ea242 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,8 @@ PHP 4                                                                      NEWS
 - Fixed possible crash in imagerotate() when an invalid color index
   is used for background color. (Pierre-Alain Joye)
 - Fixed bug #24640 (var_export and var_dump can't output large float). (Marcus)
+- Fixed bug #24592 (Possible crash in session extnsion, with NULL values).
+  (Ilia)
 - Fixed bug #24573 (debug_backtrace() crashes if $this set to null). (Jani)
 - Fixed bug #24560 (parse_url() incorrectly handling certain file:// based 
   schemas). (Ilia)

diff --git a/ext/session/session.c b/ext/session/session.c
index cc1c3aeb2dbbe57b079f3d8a998f4e113d3764d6..57b686cf13de634fa2f1e7cda82e852c2a9a6285 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -635,9 +635,12 @@ static int migrate_global(HashTable *ht, HashPosition *pos TSRMLS_DC)
 
        switch (n) {
                case HASH_KEY_IS_STRING:
-                       zend_hash_find(&EG(symbol_table), str, str_len, (void **) &val);
-                       if (val) {
-                               ZEND_SET_SYMBOL_WITH_LENGTH(ht, str, str_len, *val, (*val)->refcount + 1 , 1);
+                       if (zend_hash_find(&EG(symbol_table), str, str_len, (void **) &val) == SUCCESS && val) {
+                               if (!PZVAL_IS_REF(*val)) {
+                                       (*val)->is_ref = 1;
+                                       (*val)->refcount += 1;
+                                       zend_hash_update(ht, str, str_len, val, sizeof(zval *), NULL);
+                               }
                                ret = 1;
                        }
                        break;