[PHP-CVS] [php-src] PHP-8.5: Merge branch 'PHP-8.4' into PHP-8.5

Author: ndossche (ndossche)
Date: 2026-08-05T10:26:02+02:00

Commit: https://github.com/php/php-src/commit/0db39103b167d07a979261c06486b997f4532e97
Raw diff: https://github.com/php/php-src/commit/0db39103b167d07a979261c06486b997f4532e97.diff

Merge branch 'PHP-8.4' into PHP-8.5

* PHP-8.4:
  Fix GH-23043: broken session id code can cause zend_mm_heap corrupted
  session: fix corruption in mod_mm

Changed paths:
  A  ext/session/tests/user_session_module/gh23043.phpt
  M  NEWS
  M  ext/session/mod_mm.c
  M  ext/session/session.c


Diff:

diff --git a/NEWS b/NEWS
index b069e00a86b4..25a706a9cb5e 100644
--- a/NEWS
+++ b/NEWS
@@ -49,6 +49,11 @@ PHP                                                                        NEWS
   . Fixed segfault in ReflectionMethod::createFromMethodName() on an
     uninstantiable subclass. (iliaal)
 
+- Session:
+  . Fix corruption in mod_mm. (ndossche)
+  . Fixed bug GH-23043 (broken session id code can cause zend_mm_heap
+    corrupted). (ndossche)
+
 - Sockets:
   . Fixed socket_set_option() validation error messages for UDP_SEGMENT and
     SO_LINGER options. (Weilin Du)
diff --git a/ext/session/mod_mm.c b/ext/session/mod_mm.c
index b794be646961..a27bd754b99d 100644
--- a/ext/session/mod_mm.c
+++ b/ext/session/mod_mm.c
@@ -351,7 +351,7 @@ PS_READ_FUNC(mm)
 		&& ps_mm_key_exists(data, key) == FAILURE) {
 		/* key points to PS(id), but cannot change here. */
 		if (key) {
-			efree(PS(id));
+			zend_string_release_ex(PS(id), false);
 			PS(id) = NULL;
 		}
 		PS(id) = PS(mod)->s_create_sid((void **)&data);
diff --git a/ext/session/session.c b/ext/session/session.c
index c4f9e8781159..4b1a52442d4d 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -455,6 +455,7 @@ static zend_result php_session_initialize(void)
 	if (!PS(id) || !ZSTR_VAL(PS(id))[0]) {
 		if (PS(id)) {
 			zend_string_release_ex(PS(id), 0);
+			PS(id) = NULL;
 		}
 		PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
 		if (!PS(id)) {
@@ -472,6 +473,7 @@ static zend_result php_session_initialize(void)
 	) {
 		if (PS(id)) {
 			zend_string_release_ex(PS(id), 0);
+			PS(id) = NULL;
 		}
 		PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
 		if (!PS(id)) {
@@ -2423,6 +2425,7 @@ PHP_FUNCTION(session_regenerate_id)
 			/* Try to generate non-existing ID */
 			while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == SUCCESS) {
 				zend_string_release_ex(PS(id), 0);
+				PS(id) = NULL;
 				PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
 				if (!PS(id)) {
 					PS(mod)->s_close(&PS(mod_data));
diff --git a/ext/session/tests/user_session_module/gh23043.phpt b/ext/session/tests/user_session_module/gh23043.phpt
new file mode 100644
index 000000000000..e3528884a79a
--- /dev/null
+++ b/ext/session/tests/user_session_module/gh23043.phpt
@@ -0,0 +1,35 @@
+--TEST--
+GH-23043 (broken session id code can cause zend_mm_heap corrupted)
+--EXTENSIONS--
+session
+--CREDITS--
+lmaltsis
+--FILE--
+<?php
+ob_start();
+class a extends SessionHandler {
+    function read($b): string {
+        return "";
+    }
+    function create_sid(): string {
+        var_dump(session_id());
+        return '';
+    }
+}
+$c = new a;
+session_set_save_handler($c);
+session_start();
+session_write_close();
+session_start();
+?>
+--EXPECTF--
+string(0) ""
+
+Warning: SessionHandler::write(): Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
+
+Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: a::write) in %s on line %d
+string(0) ""
+
+Warning: SessionHandler::write(): Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in Unknown on line 0
+
+Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: a::write) in Unknown on line 0