fix: deprecate negative values for session GC probability

ext/session/session.c

@@ -394,8 +394,8 @@ static zend_long php_session_gc(bool immediate) /* {{{ */
 
 	/* GC must be done before reading session data. */
 	if ((PS(mod_data) || PS(mod_user_implemented))) {
-		if (!collect && PS(gc_probability) > 0) {
-			collect = php_random_range(PS(random), 0, PS(gc_divisor) - 1) < PS(gc_probability);
+		if (!collect && PS(gc_probability) != 0 && PS(gc_divisor) != 0) {
+			collect = php_random_range(PS(random), 0, llabs(PS(gc_divisor)) - 1) < llabs(PS(gc_probability));
 		}
 
 		if (collect) {
@@ -717,6 +717,28 @@ static PHP_INI_MH(OnUpdateCookieLifetime) /* {{{ */
 }
 /* }}} */
 
+static PHP_INI_MH(OnUpdateGcDivisor) /* {{{ */
+{
+	SESSION_CHECK_ACTIVE_STATE;
+	SESSION_CHECK_OUTPUT_STATE;
+	if (atol(ZSTR_VAL(new_value)) <= 0) {
+		zend_error(E_DEPRECATED, "session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled.");
+	}
+	return OnUpdateLong(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
+}
+/* }}} */
+
+static PHP_INI_MH(OnUpdateGcProbability) /* {{{ */
+{
+	SESSION_CHECK_ACTIVE_STATE;
+	SESSION_CHECK_OUTPUT_STATE;
+	if (atol(ZSTR_VAL(new_value)) < 0) {
+		zend_error(E_DEPRECATED, "session.gc_probability lower than 0 is deprecated. GC on each request is disabled.");
+	}
+	return OnUpdateLong(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
+}
+/* }}} */
+
 
 static PHP_INI_MH(OnUpdateSessionLong) /* {{{ */
 {
@@ -810,9 +832,9 @@ PHP_INI_BEGIN()
 	STD_PHP_INI_ENTRY("session.name",               "PHPSESSID", PHP_INI_ALL, OnUpdateName,          session_name,       php_ps_globals,    ps_globals)
 	PHP_INI_ENTRY("session.save_handler",           "files",     PHP_INI_ALL, OnUpdateSaveHandler)
 	STD_PHP_INI_BOOLEAN("session.auto_start",       "0",         PHP_INI_PERDIR, OnUpdateBool,       auto_start,         php_ps_globals,    ps_globals)
-	STD_PHP_INI_ENTRY("session.gc_probability",     "1",         PHP_INI_ALL, OnUpdateSessionLong,          gc_probability,     php_ps_globals,    ps_globals)
-	STD_PHP_INI_ENTRY("session.gc_divisor",         "100",       PHP_INI_ALL, OnUpdateSessionLong,          gc_divisor,         php_ps_globals,    ps_globals)
-	STD_PHP_INI_ENTRY("session.gc_maxlifetime",     "1440",      PHP_INI_ALL, OnUpdateSessionLong,          gc_maxlifetime,     php_ps_globals,    ps_globals)
+	STD_PHP_INI_ENTRY("session.gc_probability",     "1",         PHP_INI_ALL, OnUpdateGcProbability, gc_probability,     php_ps_globals,    ps_globals)
+	STD_PHP_INI_ENTRY("session.gc_divisor",         "100",       PHP_INI_ALL, OnUpdateGcDivisor,     gc_divisor,         php_ps_globals,    ps_globals)
+	STD_PHP_INI_ENTRY("session.gc_maxlifetime",     "1440",      PHP_INI_ALL, OnUpdateSessionLong,   gc_maxlifetime,     php_ps_globals,    ps_globals)
 	PHP_INI_ENTRY("session.serialize_handler",      "php",       PHP_INI_ALL, OnUpdateSerializer)
 	STD_PHP_INI_ENTRY("session.cookie_lifetime",    "0",         PHP_INI_ALL, OnUpdateCookieLifetime,cookie_lifetime,    php_ps_globals,    ps_globals)
 	STD_PHP_INI_ENTRY("session.cookie_path",        "/",         PHP_INI_ALL, OnUpdateSessionString, cookie_path,        php_ps_globals,    ps_globals)

ext/session/tests/session_gc_probability_ini.phpt

@@ -0,0 +1,67 @@
+--TEST--
+Test session.gc_probability and session.gc_divisor settings for negative values - always run GC
+--INI--
+session.gc_maxlifetime=1
+--EXTENSIONS--
+session
+--SKIPIF--
+<?php
+include('skipif.inc');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--FILE--
+<?php
+
+$gc_settings = [
+    [
+        'gc_probability' => -1,
+        'gc_divisor' => -1
+    ],
+    [
+        'gc_probability' => -1,
+        'gc_divisor' => 1
+    ],
+];
+
+ob_start();
+foreach($gc_settings as $gc_setting) {
+    session_start($gc_setting);
+    $_SESSION['test'] = 'test';
+    session_write_close();
+
+    sleep(2);
+    session_start($gc_setting);
+    if(count($_SESSION) === 0) {
+        echo "\nERROR";
+    }
+    session_write_close();
+    $_SESSION = [];
+
+    session_start($gc_setting);
+    if(count($_SESSION) !== 0) {
+        echo "\nERROR";
+    }
+    session_destroy();
+}
+ob_end_flush();
+?>
+Done
+--EXPECTF--
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+Done

ext/session/tests/session_gc_probability_ini_2.phpt

@@ -0,0 +1,77 @@
+--TEST--
+Test session.gc_probability and session.gc_divisor settings for negative values - never run GC
+--INI--
+session.gc_maxlifetime=1
+--EXTENSIONS--
+session
+--SKIPIF--
+<?php
+include('skipif.inc');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--FILE--
+<?php
+
+$gc_settings = [
+    [
+        'gc_probability' => -1,
+        'gc_divisor' => 0
+    ],
+    [
+        'gc_probability' => 1,
+        'gc_divisor' => 0
+    ],
+    [
+        'gc_probability' => 0,
+        'gc_divisor' => 0
+    ],
+];
+
+ob_start();
+foreach($gc_settings as $gc_setting) {
+    session_start($gc_setting);
+    $_SESSION['test'] = 'test';
+    session_write_close();
+
+    sleep(2);
+    session_start($gc_setting);
+    if(count($_SESSION) === 0) {
+        echo "\nERROR";
+    }
+    session_write_close();
+    $_SESSION = [];
+
+    session_start($gc_setting);
+    if(count($_SESSION) === 0) {
+        echo "\nERROR";
+    }
+    session_destroy();
+}
+ob_end_flush();
+?>
+Done
+--EXPECTF--
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_probability lower than 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+
+Deprecated: session.gc_divisor lower than or equal 0 is deprecated. GC on each request is disabled. in %s on line %d
+Done