From: Xinchen Hui <laruence@gmail.com>
Date: Sat, 7 Nov 2015 15:30:31 +0000 (-0800)
Subject: Fixed bug #70876 (Segmentation fault when regenerating session id with strict mode)
X-Git-Tag: php-7.0.1RC1~134
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e9fd8ad4462a39f61e757ef89f417c413aa1df6f;p=php

Fixed bug #70876 (Segmentation fault when regenerating session id with strict mode)
---

diff --git a/NEWS b/NEWS
index 95aab2c0c1..8f3ff128b1 100644
--- a/NEWS
+++ b/NEWS
@@ -24,7 +24,7 @@ PHP                                                                        NEWS
 
 - Session:
   . Fixed bug #70876 (Segmentation fault when regenerating session id with
-    strict mode). (Reeze Xia)
+    strict mode). (Laruence)
 
 - SOAP:
   . Fixed bug #70875 (Segmentation fault if wsdl has no targetNamespace
diff --git a/ext/session/session.c b/ext/session/session.c
index 570173a838..dd8651883d 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -2077,6 +2077,11 @@ static PHP_FUNCTION(session_regenerate_id)
 		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
 		RETURN_FALSE;
 	}
+	if (PS(mod)->s_open(&PS(mod_data), PS(save_path), PS(session_name)) == FAILURE) {
+		PS(session_status) = php_session_none;
+		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
+		RETURN_FALSE;
+	}
 	if (PS(use_strict_mode) && PS(mod)->s_validate_sid &&
 		PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE) {
 		zend_string_release(PS(id));
@@ -2087,11 +2092,6 @@ static PHP_FUNCTION(session_regenerate_id)
 			RETURN_FALSE;
 		}
 	}
-	if (PS(mod)->s_open(&PS(mod_data), PS(save_path), PS(session_name)) == FAILURE) {
-		PS(session_status) = php_session_none;
-		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Failed to create session ID: %s (path: %s)", PS(mod)->s_name, PS(save_path));
-		RETURN_FALSE;
-	}
 	/* Read is required to make new session data at this point. */
 	if (PS(mod)->s_read(&PS(mod_data), PS(id), &data, PS(gc_maxlifetime)) == FAILURE) {
 		PS(session_status) = php_session_none;
diff --git a/ext/session/tests/bug70876.phpt b/ext/session/tests/bug70876.phpt
new file mode 100644
index 0000000000..33e0323b9f
--- /dev/null
+++ b/ext/session/tests/bug70876.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #70876 Segmentation fault when regenerating session id with strict mode
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--INI--
+html_errors=0
+session.save_handler=files
+--FILE--
+<?php
+ini_set('session.use_strict_mode', true);
+session_start();
+session_regenerate_id();
+
+echo "ok";
+?>
+--EXPECT--
+ok
\ No newline at end of file