2 files changed, 64 insertions, 10 deletions

diff --git a/session.c b/session.c
index a3261c9..827c6b7 100644
--- a/session.c
+++ b/session.c
@@ -487,7 +487,6 @@ static php_ps_globals_43_44 *session_globals = NULL;
 #define SESSION_G(v) (session_globals->v)
 #endif
 
-static ps_module *ps_mod_user = NULL;
 
 ps_serializer *(*suhosin_find_ps_serializer)(char *name TSRMLS_DC) = NULL;
 
@@ -1018,14 +1017,14 @@ static void suhosin_hook_session_module(TSRMLS_D)
 static PHP_INI_MH(suhosin_OnUpdateSaveHandler)
 {
     int r;
-    char *tmp;
 
-    if ((ps_mod_user) && (SUHOSIN_G(s_original_mod) == ps_mod_user) && (strcmp(new_value, "user") == 0)) {
+    if (stage == PHP_INI_STAGE_RUNTIME && SESSION_G(session_status) == php_session_none && SUHOSIN_G(s_original_mod)
+        && strcmp(new_value, "user") == 0 && strcmp(((ps_module*)SUHOSIN_G(s_original_mod))->s_name, "user") == 0) {
         return SUCCESS;
     }
 
     SESSION_G(mod) = SUHOSIN_G(s_original_mod);
-    
+
     r = old_OnUpdateSaveHandler(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC);
     
     suhosin_hook_session_module(TSRMLS_C);
@@ -1095,12 +1094,6 @@ void suhosin_hook_session(TSRMLS_D)
     }
 #endif
 #endif
-    if (ps_mod_user == NULL) {
-        ps_mod_user = DL_FETCH_SYMBOL(module->handle, "ps_mod_user");
-        if (ps_mod_user == NULL) {
-            ps_mod_user = DL_FETCH_SYMBOL(module->handle, "_ps_mod_user");
-        }
-    }
     
     if (old_OnUpdateSaveHandler != NULL) {
         return;
diff --git a/tests/session/session_recursive_crash2.phpt b/tests/session/session_recursive_crash2.phpt
new file mode 100644
index 0000000..e99d924
--- /dev/null
+++ b/tests/session/session_recursive_crash2.phpt
@@ -0,0 +1,61 @@
+--TEST--
+session user handler recursive crash - issue #60
+--SKIPIF--
+<?php include "../skipifcli.inc"; ?>
+--ENV--
+return <<<END
+HTTP_USER_AGENT=test
+END;
+--INI--
+suhosin.session.encrypt=On
+suhosin.session.cryptkey=D3F4UL7
+suhosin.session.cryptua=On
+suhosin.session.cryptdocroot=Off
+suhosin.session.cryptraddr=0
+suhosin.session.checkraddr=0
+--FILE--
+<?php
+$foo = "";
+
+class MySessionHandlerA implements SessionHandlerInterface
+{
+        public function close() {}
+        public function destroy($session_id) {}
+        public function gc($maxlifetime) {}
+        public function open($save_path, $name) { global $foo; $foo .= "A\n"; }
+        public function read($session_id ) {}
+        public function write($session_id, $session_data) {}
+}
+
+session_set_save_handler(new MySessionHandlerA(), true);
+session_start();
+session_destroy();
+
+//
+
+class MySessionHandlerB extends MySessionHandlerA
+{
+        public function open($save_path, $name) { global $foo; $foo .= "B\n"; }
+}
+
+session_set_save_handler(new MySessionHandlerB(), true);
+session_start();
+session_destroy();
+
+//
+
+class MySessionHandlerC extends MySessionHandlerA
+{
+        public function open($save_path, $name) { global $foo; $foo .= "C\n"; }
+}
+
+session_set_save_handler(new MySessionHandlerC(), true);
+session_start();
+session_destroy();
+
+
+echo $foo;
+--EXPECTF--
+A
+B
+C