Commit 0862a59e751 for php

commit 0862a59e751aacd2dab3ede48a10c849ed680d44
Merge: 599bf763cbf 55230ecea9a
Author: Jorg Sowa <jorg.sowa@gmail.com>
Date:   Thu Oct 29 16:04:52 2026 +0100

    Merge branch 'PHP-8.4' into PHP-8.5

diff --cc NEWS
index 54e53e3b23c,e39ef7ac85a..0d4838421d8
--- a/NEWS
+++ b/NEWS
@@@ -203,7 -209,13 +203,9 @@@ PH
    . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
      (Martin Mirchev)

 -- SOAP:
 -  . Fixed use of uninitialized func in do_request() on OOM bailout.
 -    (David Carlier)
 -
  - Session:
+   . Validate whole session ID instead of stopping at the first NUL byte.
+     (Sjoerd Langkemper)
    . Fixed session data loss in the files save handler when writing the session
      file fails after it was already truncated. (Ilia Alshanetsky)

diff --cc ext/session/session.c
index dd2c22e5d6d,63072b331dd..ecdb38b8e49
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@@ -388,18 -380,22 +392,22 @@@ static zend_result php_session_valid_ke
  	return SUCCESS;
  }

+ /* Validate the full zend_string, including embedded NUL bytes. */
+ zend_result php_session_valid_key_ex(const zend_string *key)
+ {
+ 	return php_session_valid_key_len(ZSTR_VAL(key), ZSTR_LEN(key));
+ }
+
+ /* C-string compatibility wrapper. Callers that have a zend_string should use
+  * php_session_valid_key_ex() instead. */
+ PHPAPI zend_result php_session_valid_key(const char *key)
+ {
+ 	return php_session_valid_key_len(key, strlen(key));
+ }

 -static zend_long php_session_gc(bool immediate) /* {{{ */
 +static zend_long php_session_gc(bool immediate)
  {
 -	zend_long num = -1;
 +	zend_long sessions_deleted = -1;
  	bool collect = immediate;

  	/* GC must be done before reading session data. */