bug73529.phpt 1.0 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546
  1. --TEST--
  2. Bug #73529 session_decode() silently fails on wrong input
  3. --EXTENSIONS--
  4. session
  5. --SKIPIF--
  6. <?php include('skipif.inc'); ?>
  7. --FILE--
  8. <?php
  9. ob_start();
  10. ini_set("session.serialize_handler", "php_serialize");
  11. session_start();
  12. $result1 = session_decode('foo|s:3:"bar";');
  13. $session1 = $_SESSION;
  14. session_destroy();
  15. ini_set("session.serialize_handler", "php");
  16. session_start();
  17. $result2 = session_decode(serialize(["foo" => "bar"]));
  18. $session2 = $_SESSION;
  19. session_destroy();
  20. echo ob_get_clean();
  21. var_dump($result1);
  22. var_dump($session1);
  23. var_dump($result2);
  24. var_dump($session2);
  25. ?>
  26. --EXPECTF--
  27. Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
  28. Warning: session_destroy(): Trying to destroy uninitialized session in %s on line %d
  29. Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
  30. Warning: session_destroy(): Trying to destroy uninitialized session in %s on line %d
  31. bool(false)
  32. array(0) {
  33. }
  34. bool(false)
  35. array(0) {
  36. }