Fixed bug #39602 (Invalid session.save_handler crashes PHP)

diff --git a/NEWS b/NEWS
index 71a2f4e4c27e04d1d2ed657a3be40373ad860695..db793db2b037fa3ad07d2b16681efe1b92508e47 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -41,6 +41,7 @@ PHP                                                                        NEWS
     php_filter.h).
 - Fixed wrong signature initialization in imagepng (Takeshi Abe)
 - Added optimization for imageline with horizontal and vertial lines (Pierre)
+- Fixed bug #39602 (Invalid session.save_handler crashes PHP). (Dmitry)
 - Fixed bug #39576 (array_walk() doesn't separate userdata zval). (Tony)
 - Fixed bug #39538 (fgetcsv can't handle starting newlines and trailing odd
   number of backslashes). (David Soria Parra, Pierre)

diff --git a/Zend/tests/bug39602.phpt b/Zend/tests/bug39602.phpt
new file mode 100755 (executable)
index 0000000..810ba4d
--- /dev/null
+++ b/Zend/tests/bug39602.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #39602 (Invalid session.save_handler crashes PHP)
+--INI--
+session.save_handler=qwerty
+--FILE--
+<?php
+ini_set("session.save_handler","files");
+$x = new stdClass();
+echo "ok";
+?>
+--EXPECT--
+ok
+Fatal error: Unknown: Cannot find save handler qwerty in Unknown on line 0

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index d5845de612a13889906364126adb07c676a347e5..179424ee042709190640e21d3bc91262cd4e5910 100644 (file)
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -64,8 +64,11 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS
 
 ZEND_API void zend_objects_store_mark_destructed(zend_objects_store *objects TSRMLS_DC)
 {
-       zend_uint i = 1;
+       zend_uint i;
 
+       if (!objects->object_buckets) {
+               return;
+       }
        for (i = 1; i < objects->top ; i++) {
                if (objects->object_buckets[i].valid) {
                        objects->object_buckets[i].destructor_called = 1;