Added eclusive error message for prefix in session_create_id() larger than 256

Author: jorgsowa

ext/session/session.c

@@ -368,6 +368,7 @@ PHPAPI zend_result php_session_valid_key(const char *key) /* {{{ */
 				|| (c >= '0' && c <= '9')
 				|| c == ','
 				|| c == '-')) {
+			php_error_docref(NULL, E_WARNING, "Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed");
 			return FAILURE;
 		}
 	}
@@ -377,6 +378,7 @@ PHPAPI zend_result php_session_valid_key(const char *key) /* {{{ */
 	/* Somewhat arbitrary length limit here, but should be way more than
 	   anyone needs and avoids file-level warnings later on if we exceed MAX_PATH */
 	if (len == 0 || len > PS_MAX_SID_LENGTH) {
+		php_error_docref(NULL, E_WARNING, "Prefix cannot be larger than 256 characters");
 		return FAILURE;
 	}
 
@@ -2385,7 +2387,6 @@ PHP_FUNCTION(session_create_id)
 	if (prefix && ZSTR_LEN(prefix)) {
 		if (php_session_valid_key(ZSTR_VAL(prefix)) == FAILURE) {
 			/* E_ERROR raised for security reason. */
-			php_error_docref(NULL, E_WARNING, "Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed");
 			RETURN_FALSE;
 		} else {
 			smart_str_append(&id, prefix);

ext/session/tests/session_create_id_invalid_prefix.phpt

@@ -12,8 +12,12 @@ session
 
 var_dump(session_create_id('_'));
 var_dump(session_create_id('%'));
-var_dump(session_create_id("AB\0CD"));
-
+var_dump(session_create_id('ABTgdPs68S3M4HMaqKwj33TzqLMv5PHpWQxJbfpeogEhrJRY7o9f33pKLCmhf0tXCtoBkIu0yxXYCSHfJhPd2miPUW4MIpd91dnEiOwWDfaBnfdJZOwgvgmYLSfDGaebqmnCAoyuzlcq2j59nNRhccgJIkr9ytY3RwFTTXszpcjpx6mlJuG9GksKAhPsnnaEwSEb0eFyqvn80gYI2roKSjaFSmJxg0xgXuCF4csMo8DxiSvovho5QTKx5u7h8VyQL'));
+try {
+    var_dump(session_create_id("AB\0CD"));
+} catch (Throwable $e) {
+    echo $e->getMessage() . "\n";
+}
 
 ?>
 Done
@@ -24,8 +28,7 @@ bool(false)
 Warning: session_create_id(): Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
 bool(false)
 
-Fatal error: Uncaught ValueError: session_create_id(): Argument #1 ($prefix) must not contain any null bytes in %s:%d
-Stack trace:
-#0 %s(5): session_create_id('AB\x00CD')
-#1 {main}
-  thrown in %s
+Warning: session_create_id(): Prefix cannot be larger than 256 characters in %s on line %d
+bool(false)
+session_create_id(): Argument #1 ($prefix) must not contain any null bytes
+Done