stack overflow

This kind of save handler abuse is trivial. 
e.g.
function sess($foo) {
  sess($foo);
}

Another example is
https://3v4l.org/Cj76q

I don't think abusive code protection worths to implement, at least by session module. Making this a documentation problem. (BTW, session_regenerate_id() calls all handlers to do the job correctly. So it does not limited to read() handler, but all handlers.)

Possible solution by core is to excessive recursive call detection like Python, or stack limit reach detection like Ruby.

Possible solution by session module is to limit number of handler calls. Does any of us feel this is preferred?

> Possible solution by session module is to limit number of handler calls. Does any of us feel this is preferred?

I'll add documentation, but I'll also add new state "session is in save handler" to prevent infinite calls because I realized that this is required so that session_create_id() to be usable in create_sid() save handler. (I was expecting user to generate new session ID by their own while session is active, but using session_create_id() is handy)

I think this should be in PHP7.1 (not 7.0), so I'll prepare the patch soon.

@Yohgaki: is it known why this does *not* crash in 5.6? I'm asking since there are no protection against this in 5.6 but yet no crash occures.

5.6 does not crash because it does not what it should do.