[php-src] PHP-8.5: Fix NULL pointer dereference in SessionHandler::create_sid()

Author: Jorg Sowa (jorgsowa)
Date: 2026-08-18T22:58:03+02:00

Commit: https://github.com/php/php-src/commit/d974c64303375df5d210b8e8240c7593e06c6cf1
Raw diff: https://github.com/php/php-src/commit/d974c64303375df5d210b8e8240c7593e06c6cf1.diff

Fix NULL pointer dereference in SessionHandler::create_sid()

s_create_sid() can return NULL when php_random_bytes_throw() fails
(e.g. CSPRNG exhaustion), but RETURN_STR() dereferences the string
unconditionally. Every other internal caller of s_create_sid() in
session.c (php_session_initialize, session_regenerate_id) already
NULL-checks the result; this PHP-facing method, reachable from any
userland SessionHandler subclass via create_sid(), did not.

No dedicated regression test is added: forcing php_random_bytes_throw()
to fail is not portably reproducible from a .phpt test (it's a raw
getrandom() syscall on Linux and CCRandomGenerateBytes on macOS, neither
of which can be faulted from userland), which is also why the existing
NULL-checks this mirrors in session.c have none either.

Changed paths:
  M  ext/session/mod_user_class.c


Diff:

diff --git a/ext/session/mod_user_class.c b/ext/session/mod_user_class.c
index 853db659887b..a2ab3c0615c2 100644
--- a/ext/session/mod_user_class.c
+++ b/ext/session/mod_user_class.c
@@ -167,6 +167,12 @@ PHP_METHOD(SessionHandler, create_sid)
 	PS_SANITY_CHECK;
 
 	id = PS(default_mod)->s_create_sid(&PS(mod_data));
+	if (!id) {
+		if (!EG(exception)) {
+			zend_throw_error(NULL, "Failed to create session ID: %s", PS(default_mod)->s_name);
+		}
+		RETURN_THROWS();
+	}
 
 	RETURN_STR(id);
 }