From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 23 Nov 2006 08:07:16 +0000 (+0000)
Subject: Fixed bug #39602 (Invalid session.save_handler crashes PHP)
X-Git-Tag: RELEASE_1_0_0RC1~932
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6b2f3046e871faf8c3ce575aec80fb91fc61cd63;p=php

Fixed bug #39602 (Invalid session.save_handler crashes PHP)
---

diff --git a/Zend/tests/bug39602.phpt b/Zend/tests/bug39602.phpt
new file mode 100755
index 0000000000..810ba4db09
--- /dev/null
+++ b/Zend/tests/bug39602.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #39602 (Invalid session.save_handler crashes PHP)
+--INI--
+session.save_handler=qwerty
+--FILE--
+<?php
+ini_set("session.save_handler","files");
+$x = new stdClass();
+echo "ok";
+?>
+--EXPECT--
+ok
+Fatal error: Unknown: Cannot find save handler qwerty in Unknown on line 0
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index beb07cbf1a..3534bb3832 100644
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -64,8 +64,11 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS
 
 ZEND_API void zend_objects_store_mark_destructed(zend_objects_store *objects TSRMLS_DC)
 {
-	zend_uint i = 1;
+	zend_uint i;
 
+	if (!objects->object_buckets) {
+		return;
+	}
 	for (i = 1; i < objects->top ; i++) {
 		if (objects->object_buckets[i].valid) {
 			objects->object_buckets[i].destructor_called = 1;