From: Eric Covener <covener@apache.org>
Date: Sun, 1 Mar 2020 22:39:11 +0000 (+0000)
Subject: PR56052: resolve problems with expired sessions
X-Git-Tag: 2.5.0-alpha2-ci-test-only~1604
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2c8a4fe01c2b8e4553a3cb397f9f59a44095d0a6;p=thirdparty%2Fapache%2Fhttpd.git

PR56052: resolve problems with expired sessions

session_load providers cache the session_rec pointer, so hollow
them out and reuse them instead of replacing them.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1874673 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 09f1ecd7ef2..63bdafeed25 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_session: Fix an issue that blocked new sessions being created after
+     session expiration or other session errors. PR56052 [Eric Covener]
+
   *) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
      PR64140. [Renier Velazco <renier.velazco upr.edu>]
 
diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c
index b72ab140c6e..8a7c385a5ab 100644
--- a/modules/session/mod_session.c
+++ b/modules/session/mod_session.c
@@ -137,23 +137,22 @@ static apr_status_t ap_session_load(request_rec * r, session_rec ** z)
             ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01817)
                     "error while decoding the session, "
                     "session not loaded: %s", r->uri);
-            zz = NULL;
+            /* preserve pointers to zz in load/save providers */
+            memset(zz, 0, sizeof(session_rec));
+            zz->pool = r->pool;
+            zz->entries = apr_table_make(zz->pool, 10);
         }
 
        /* invalidate session if session is expired */
         if (zz && zz->expiry && zz->expiry < now) {
             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "session is expired");
-            zz = NULL;
+            /* preserve pointers to zz in load/save providers */
+            memset(zz, 0, sizeof(session_rec));
+            zz->pool = r->pool;
+            zz->entries = apr_table_make(zz->pool, 10);
         }
     }
 
-    /* no luck, create a blank session */
-    if (!zz) {
-        zz = (session_rec *) apr_pcalloc(r->pool, sizeof(session_rec));
-        zz->pool = r->pool;
-        zz->entries = apr_table_make(zz->pool, 10);
-    }
-
     /* make sure the expiry and maxage are set, if present */
     if (dconf->maxage) {
         if (!zz->expiry) {