Fixed crash when save_path is invalid.

Fixed crash when user save handler is incorrectly used.
Fixed crash when session read failed.

Author: Yasuo Ohgaki

ext/session/mod_files.c

@@ -123,7 +123,7 @@ static void ps_files_close(ps_files *data)
 	}
 }
 
-static void ps_files_open(ps_files *data, const char *key)
+static int ps_files_open(ps_files *data, const char *key)
 {
 	char buf[MAXPATHLEN];
 	TSRMLS_FETCH();
@@ -138,7 +138,7 @@ static void ps_files_open(ps_files *data, const char *key)
 
 		if (!ps_files_valid_key(key) || 
 				!ps_files_path_create(buf, sizeof(buf), data, key))
-			return;
+			return FAILURE;
 
 		data->lastkey = estrdup(key);
 
@@ -153,10 +153,13 @@ static void ps_files_open(ps_files *data, const char *key)
 		if (data->fd != -1) 
 			flock(data->fd, LOCK_EX);
 
-		if (data->fd == -1)
+		if (data->fd == -1) {
 			php_error(E_WARNING, "open(%s, O_RDWR) failed: %s (%d)", buf, 
 					strerror(errno), errno);
+			return FAILURE;
+		}
 	}
+	return SUCCESS;
 }
 
 static int ps_files_cleanup_dir(const char *dirname, int maxlifetime)
@@ -254,7 +257,9 @@ PS_READ_FUNC(files)
 	struct stat sbuf;
 	PS_FILES_DATA;
 
-	ps_files_open(data, key);
+	if (ps_files_open(data, key) == FAILURE)
+		return FAILURE;
+	
 	if (data->fd < 0)
 		return FAILURE;
 
@@ -283,7 +288,9 @@ PS_WRITE_FUNC(files)
 	long n;
 	PS_FILES_DATA;
 
-	ps_files_open(data, key);
+	if (ps_files_open(data, key) == FAILURE)
+		return FAILURE;
+
 	if (data->fd < 0)
 		return FAILURE;
 

ext/session/session.c

@@ -543,19 +543,21 @@ static char *_php_create_id(int *newlen TSRMLS_DC)
 	return estrdup(buf);
 }
 
-static void php_session_initialize(TSRMLS_D)
+static int php_session_initialize(TSRMLS_D)
 {
 	char *val;
 	int vallen;
 
 	if (PS(mod)->open(&PS(mod_data), PS(save_path), PS(session_name)) == FAILURE) {
 		php_error(E_ERROR, "Failed to initialize session module");
-		return;
+		return FAILURE;
 	}
-	if (PS(mod)->read(&PS(mod_data), PS(id), &val, &vallen) == SUCCESS) {
-		php_session_decode(val, vallen TSRMLS_CC);
-		efree(val);
+	if (PS(mod)->read(&PS(mod_data), PS(id), &val, &vallen) == FAILURE) {
+		return FAILURE;
 	}
+	php_session_decode(val, vallen TSRMLS_CC);
+	efree(val);
+	return SUCCESS;
 }
 
 
@@ -946,11 +948,10 @@ static void php_session_start(TSRMLS_D)
 	}
 
 	php_session_cache_limiter(TSRMLS_C);
-	php_session_initialize(TSRMLS_C);
-
-	if (PS(mod_data) && PS(gc_probability) > 0) {
+	if (php_session_initialize(TSRMLS_C) == SUCCESS && 
+		PS(mod_data) && PS(gc_probability) > 0) {
 		int nrdels = -1;
-
+		
 		nrand = (int) (100.0*php_combined_lcg(TSRMLS_C));
 		if (nrand < PS(gc_probability)) {
 			PS(mod)->gc(&PS(mod_data), PS(gc_maxlifetime), &nrdels);
@@ -962,6 +963,7 @@ static void php_session_start(TSRMLS_D)
 	}
 }
 
+
 static zend_bool php_session_destroy(TSRMLS_D)
 {
 	zend_bool retval = SUCCESS;