I fail to see how I can reproduce it. Can you tell me how you did get this corrupted data? As it looks to me that there is a bug in serializing here, not deserializing. I think it has to do with the binary stuff inside the _cached_html part though and Windows ;-) Can you provide the variable before serialization (use var_export($_SESSION) to obtain it).

can you reproduce the crash?

i used sql as session save handler
corrupted data may not bug of sedssion_encode(), it's bug of GBK mysql( http://bugs.mysql.com/bug.php?id=369 ), as when i use file, no crash

but it IS bug of session_decode(), it shouldn't crash on corrupted data.
e.g.: saving session data but crashed by other thread, data is corrupted. when page load again, session_decode crash.
and anyone who use vhost, can write a simple script to make php crash
the server admin can hardly track who and what make the crash.


and if possible, pls make session_encode() do base64_encode, because may ppl use his own sql-save-handler
e.g.: session_use_text_encode(true);

That's some nasty session data.

It crashes 4.3.2 and 5.0 CVS with a Segmentation Fault, which occurs *after* script execution (probably when PHP attempts to write the session to a file).

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.