php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #36646 foreach($_SESSION as $key => $value) unset($_SESSION[$key]) crashes apache2
Submitted: 2006-03-07 15:04 UTC Modified: 2008-08-17 11:27 UTC
Votes:28
Avg. Score:4.8 ± 0.6
Reproduced:27 of 28 (96.4%)
Same Version:3 (11.1%)
Same OS:23 (85.2%)
From: christian dot cal at gmx dot de Assigned:
Status: Closed Package: Session related
PHP Version: 5.1.2 OS: Windows XP
Private report: No CVE-ID: None
View Developer Edit
 [2006-03-07 15:04 UTC] christian dot cal at gmx dot de 
Description:
------------
I am using PHP as an apache2 modul.

When trying to unset all vars that are stored in $_SESSION i use a foreach loop combined with unset. This method crashes the apache2.


I moved from PHP 4.4.2 to 5.1.2. The unmodified code works for 4.4.2 but crashes the server when using 5.1.2.

Reproduce code:
---------------
foreach ($_SESSION as $key => $value){
  unset($_SESSION[$key]);
}


Expected result:
----------------
All vars should be removed from $_SESSION

So i tried this:

$helper=&$_SESSION;
foreach ($helper as $key => $value){
  unset($helper[$key]);
}

This code does what I have expected from the code above.

Also this works:

$helper=array_keys($_SESSION);
foreach ($helper as $key){
  unset($_SESSION[$key]);
}

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-03-07 18:29 UTC] christian dot cal at gmx dot de 
I recently figured out that apache crashed when running into an infinitive loop it ran by using header("Location: "), because the vars in $_SESSION wasn't unset by unset().

I believe the error with not unsetting vars in foreach() has been posted.
 [2006-03-14 12:45 UTC] edink@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php5.1-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.1-win32-latest.zip

I have just tested your test case and it works fine here. Do you do session_start() on a page which unsets $_SESSION?
 [2006-03-22 01:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2006-07-25 16:10 UTC] gmartyn at judicialtitle dot com 
I am able to reproduce this bug with php 5.1.4 on IIS 6.

I also tried one of the solutions provided by the first comment:
$helper=array_keys($_SESSION);
foreach ($helper as $key){
  unset($_SESSION[$key]);
}

..but after a print_r($_SESSION), I got this. Note the Access Violation:

The session is now:
Array ( [numRecords] => 2 [curRecord] => 1 [curTab_r0] => Header [curPartyType_r1] => d [numDebtors_r1] => 1 [numSecured_r1] => 1 [numProperty_r1] => 1 [curTab_r1] => Document [OriginalDocPgcnt_r1] => 1PHP has encountered an Access Violation at 01E1CCA6 [curTab_r2] => Document [OriginalDocPgcnt_r2] => 2 [chkbox_doc_nonstd_r1] => false [curPartyType_r2] => d [numDebtors_r2] => 1 [numSecured_r2] => 1 [numProperty_r2] => 1 )
 [2006-07-25 16:14 UTC] tony2001@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip
 [2006-07-25 16:20 UTC] gmartyn at judicialtitle dot com 
I'm sorry, my last comment was incorrect. My problem was that I was trying to do this:

$_SESSION = array_merge($_SESSION, $SomeVars);
 [2006-07-25 16:30 UTC] gmartyn at judicialtitle dot com 
Ugh, looks like I was affected by this bug after all.. the array_merge was a problem, but so was the foreach over the $_SESSION.

I got my script working by using the trick provided in the first comment:
$helper=&$_SESSION;
foreach ($helper as $key => $value){
  unset($helper[$key]);
}
 [2006-08-02 01:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2006-08-27 01:09 UTC] joe at gmail dot com 
I'm running 5.1.6 and I have this problem... it still hasn't been fixed!
 [2006-08-27 01:12 UTC] joe at gmail dot com 
Actually to clarify, it doesn't crash Apache on my computer, but it doesn't unset the variables!
 [2006-09-18 13:53 UTC] s dot stok at rollerscapes dot net 
Im ussing the latest version of php5.2, and i also haffing this problem.

The whird thing is that on my linux box everything works fine,only on windows it fails to work.
Only the workaround makes it work.
 [2007-03-30 00:17 UTC] no at email dot here 
No crash for me, but I confirm the bug with php version 5.2.0 under windows : no unset the variables

The proposed solution is OK :

$helper=&$_SESSION;
foreach ($helper as $key => $value){
  unset($helper[$key]);
}

Thanks
 [2007-03-30 22:16 UTC] grafelbd at telstar-online dot net 
I am using PHP 5.2.1 and I have tested this same issue with an array of 15 items with randomly generated strings, and this bug did not affect me.

I tried using PHP 5.2.1 both as an Apache module (running Apache 2.0.59) and as a FastCGI but was unable to reproduce this error in either setup.

I believe this bug might have been resolved in PHP 5.2.1 ? Unless all of you are referring to Apache 2.2.x, which I have not tested.
 [2008-08-17 00:52 UTC] jay at websynergia dot com 
$_SESSION = array();

Why not just do the above if you want to clear the session array?

It has always worked for me regardless.
 [2008-08-17 11:27 UTC] nicos@php.net 
I cannot reproduce it on 5.3.0 or 5.2.6.

Seems fixed.

If you can reproduce it, please open it again.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 11:01:29 2024 UTC