From 838951c2d6612efbf6adeb5b1abc7fced808dc39 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Mon, 22 Mar 2021 22:14:01 +0100
Subject: Fix #80889: amendment

`session_set_save_handler()` may be called with callables instead of an
object; we need to cater to that as well.

We also extract a set_user_save_handler_ini() function to avoid code
duplication.

Closes GH-6796.
---
 ext/session/session.c            | 31 +++++++++++++++----------------
 ext/session/tests/bug80889a.phpt | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 16 deletions(-)
 create mode 100644 ext/session/tests/bug80889a.phpt

(limited to 'ext/session')

diff --git a/ext/session/session.c b/ext/session/session.c
index 1fa9319fcf..ea9a1eede9 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -1923,13 +1923,24 @@ static PHP_FUNCTION(session_module_name)
 }
 /* }}} */
 
+static inline void set_user_save_handler_ini(void) {
+	zend_string *ini_name, *ini_val;
+
+	ini_name = zend_string_init("session.save_handler", sizeof("session.save_handler") - 1, 0);
+	ini_val = zend_string_init("user", sizeof("user") - 1, 0);
+	PS(set_handler) = 1;
+	zend_alter_ini_entry(ini_name, ini_val, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
+	PS(set_handler) = 0;
+	zend_string_release_ex(ini_val, 0);
+	zend_string_release_ex(ini_name, 0);
+}
+
 /* {{{ proto bool session_set_save_handler(string open, string close, string read, string write, string destroy, string gc, string create_sid)
    Sets user-level functions */
 static PHP_FUNCTION(session_set_save_handler)
 {
 	zval *args = NULL;
 	int i, num_args, argc = ZEND_NUM_ARGS();
-	zend_string *ini_name, *ini_val;
 
 	if (PS(session_status) == php_session_active) {
 		php_error_docref(NULL, E_WARNING, "Cannot change save handler when session is active");
@@ -2032,13 +2043,7 @@ static PHP_FUNCTION(session_set_save_handler)
 		}
 
 		if (PS(session_status) != php_session_active && (!PS(mod) || PS(mod) != &ps_mod_user)) {
-			ini_name = zend_string_init("session.save_handler", sizeof("session.save_handler") - 1, 0);
-			ini_val = zend_string_init("user", sizeof("user") - 1, 0);
-			PS(set_handler) = 1;
-			zend_alter_ini_entry(ini_name, ini_val, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
-			PS(set_handler) = 0;
-			zend_string_release_ex(ini_val, 0);
-			zend_string_release_ex(ini_name, 0);
+			set_user_save_handler_ini();
 		}
 
 		RETURN_TRUE;
@@ -2066,14 +2071,8 @@ static PHP_FUNCTION(session_set_save_handler)
 		}
 	}
 
-	if (PS(mod) && PS(mod) != &ps_mod_user) {
-		ini_name = zend_string_init("session.save_handler", sizeof("session.save_handler") - 1, 0);
-		ini_val = zend_string_init("user", sizeof("user") - 1, 0);
-		PS(set_handler) = 1;
-		zend_alter_ini_entry(ini_name, ini_val, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
-		PS(set_handler) = 0;
-		zend_string_release_ex(ini_val, 0);
-		zend_string_release_ex(ini_name, 0);
+	if (!PS(mod) || PS(mod) != &ps_mod_user) {
+		set_user_save_handler_ini();
 	}
 
 	for (i = 0; i < argc; i++) {
diff --git a/ext/session/tests/bug80889a.phpt b/ext/session/tests/bug80889a.phpt
new file mode 100644
index 0000000000..ff0c025382
--- /dev/null
+++ b/ext/session/tests/bug80889a.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #80889 (Cannot set save handler when save_handler is invalid)
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--INI--
+session.save_handler=whatever
+--FILE--
+<?php
+$initHandler = ini_get('session.save_handler');
+session_set_save_handler(
+    function ($savePath, $sessionName) {
+        return true;
+    },
+    function () {
+        return true;
+    },
+    function ($id) {
+        return '';
+    },
+    function ($id, $data) {
+        return true;
+    },
+    function ($id) {
+        return true;
+    },
+    function ($maxlifetime) {
+        return true;
+    }
+);
+$setHandler = ini_get('session.save_handler');
+var_dump($initHandler, $setHandler);
+?>
+--EXPECT--
+string(8) "whatever"
+string(4) "user"
-- 
cgit v1.2.1