Skip to content

ext/session: fix cookie_lifetime overflow #21704

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Girgias merged 5 commits into from
Apr 20, 2026
Merged

ext/session: fix cookie_lifetime overflow #21704

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
29eb822
ext/session: fix cookie_lifetime overflow causing INI value desync
jorgsowa Apr 10, 2026
2860ac4
validation for cookie lifetime
jorgsowa Apr 10, 2026
070407c
removed unnecessary comments
jorgsowa Apr 11, 2026
481e9b7
chore: modify error flow and messages of warnings
jorgsowa Apr 13, 2026
83991b6
fix: return FAILURE on overflow
jorgsowa Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions ext/session/session.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -711,6 +711,10 @@ static PHP_INI_MH(OnUpdateCookieLifetime)
php_error_docref(NULL, E_WARNING, "CookieLifetime cannot be negative");
Comment thread
jorgsowa marked this conversation as resolved.
Outdated
return FAILURE;
} else if (v > maxcookie) {
php_error_docref(NULL, E_WARNING, "CookieLifetime value too large, value was set to the maximum of " ZEND_LONG_FMT, maxcookie);
zend_long *p = ZEND_INI_GET_ADDR();
*p = maxcookie;
entry->value = zend_long_to_str(maxcookie);
return SUCCESS;
}

Expand Down
5 changes: 4 additions & 1 deletion ext/session/tests/gh16290.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,11 @@ session
<?php include('skipif.inc'); ?>
--FILE--
<?php
ob_start();
session_set_cookie_params(PHP_INT_MAX, '/', null, false, true);
echo "DONE";
ob_end_flush();
?>
--EXPECT--
--EXPECTF--
Warning: session_set_cookie_params(): CookieLifetime value too large, value was set to the maximum of %d in %s on line %d
DONE
34 changes: 34 additions & 0 deletions ext/session/tests/session_cookie_lifetime_overflow.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
--TEST--
session.cookie_lifetime overflow value is clamped
--EXTENSIONS--
session
--SKIPIF--
<?php include('skipif.inc'); ?>
--FILE--
<?php

ob_start();

// Set a valid value first
ini_set("session.cookie_lifetime", 100);
var_dump(ini_get("session.cookie_lifetime"));

// Set an overflow value - should succeed with warning, value clamped
ini_set("session.cookie_lifetime", PHP_INT_MAX);
$val = (int) ini_get("session.cookie_lifetime");
var_dump($val < PHP_INT_MAX); // clamped, not PHP_INT_MAX
var_dump($val > 0); // positive

// Valid values still work after clamping
ini_set("session.cookie_lifetime", 200);
var_dump(ini_get("session.cookie_lifetime"));

ob_end_flush();
?>
--EXPECTF--
string(3) "100"

Warning: ini_set(): CookieLifetime value too large, value was set to the maximum of %d in %s on line %d
bool(true)
bool(true)
string(3) "200"
Loading