Skip to content

[Session] destroy session file without an open descriptor - #23656

Open
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/session-destroy-closed-fd-84
Open

[Session] destroy session file without an open descriptor#23656
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/session-destroy-closed-fd-84

Conversation

@iliaal

@iliaal iliaal commented Sep 10, 2026

Copy link
Copy Markdown
Member

The files save handler skipped unlink when the session file descriptor was -1, so destroy could return success and leave the file on disk. It now closes if needed and unlinks the path, treating a missing file as success.

PS_DESTROY_FUNC(files) skipped the unlink when data->fd was -1, so a
destroy of a never-opened or already-closed session file returned
SUCCESS while the file stayed on disk. The unlink now always runs after
the optional ps_files_close(), tolerating ENOENT via the existing
access() check. Sibling audit: PS_DESTROY_FUNC(mm) and mod_user have no
descriptor gate, and the files close/read/write paths keep their
existing descriptor handling.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant