php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #40016 Unsetting a session var in a foreach loop over $_SESSION
Submitted: 2007-01-04 02:23 UTC Modified: 2007-01-12 18:12 UTC
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: mbechler at eenterphace dot org Assigned:
Status: Closed Package: Session related
PHP Version: 5.2.0 OS: Any?
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mbechler at eenterphace dot org
New email:
PHP Version: OS:

 

 [2007-01-04 02:23 UTC] mbechler at eenterphace dot org
Description:
------------
When 'register_long_arrays' is enabled and a session variable is unset within a foreach loop over $_SESSION the session is not written out anymore, causing the changes to the session beeing lost. (session_unregister works nice btw.)

Reproduced on various (patched and vanilla) 5.* (including 5.2.0) versions on GNU/Linux

Some debugging showed that actually the internal pointer (in ps_globals' http_session_vars zval) to the session hashtable are wrecked when doing this so this seems not to be a ext/session issue but more of a core issue.

----
Dump in php_session_flush:
gdb> print (*ps_globals.http_session_vars).value
$5 = {lval = 0x5a5a5a5a, dval = 1.7838867517321418e+127, str = {val = 0x5a5a5a5a <Address 0x5a5a5a5a out of bounds>, len = 0x5a5a5a5a}, ht = 0x5a5a5a5a, obj = {handle = 0x5a5a5a5a, handlers = 0x5a5a5a5a}}

Reproduce code:
---------------
<?php
session_start();

var_dump($_SESSION);

$_SESSION['test'] = 'blubb';
$_SESSION['foo'] = 'test';

foreach($_SESSION as $key => $val) {
        unset($_SESSION['test']);
}

var_dump($_SESSION);
?>


Expected result:
----------------
On first run:
array(9) {
}
array(1) {
  ["foo"]=>
  string(4) "test"
}

On second run:
array(1) {
  ["foo"]=>
  string(4) "test"
}
array(1) {
  ["foo"]=>
  string(4) "test"
}

Actual result:
--------------
On every run:
array(9) {
}
array(1) {
  ["foo"]=>
  string(4) "test"
}

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-01-04 15:33 UTC] mbechler at eenterphace dot org
Have to correct me, it happens when register_long_arrays is Off (it was late last night, sorry :))
 [2007-01-10 21:50 UTC] iliaa@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip


 [2007-01-12 18:06 UTC] mbechler at eenterphace dot org
well, actually seems to work using latest cvs.
 [2007-01-12 18:12 UTC] iliaa@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sun Jul 13 12:01:31 2025 UTC