Description

If I have set session.use_strict_mode = 1 and I have a custom session handler which implements the validateId function, then invoking session_regenerate_id calls

customhandler->create_sid
customhandler->validateId
customhandler->create_sid
customhandler->validateId
customhandler->create_sid
customhandler->validateId
customhandler->create_sid

Looking at the source code for session_regenerate_id, I can see the bug

https://github.com/php/php-src/blob/PHP-8.0.27/ext/session/session.c#L2263

while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == SUCCESS) {

Shouldn't this be

while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE) {

Note that this is the same code in master

PHP Version

PHP 8.0.27

Operating System

No response