Disallow characters that Cookie RFC does not allow in unquoted cookies

MFH: php_gmtime_r() fixes

do not send cookie when session is passed in URL, same as it happens with GET/POST

MFH: fix #40998 (long session array keys are truncated)

Fixed MOPB-22-2007:PHP session_regenerate_id() Double Free Vulnerability

# Discovered by Stefan Esser

Adjust checks to allow paths without a trailing /

Improve safe_mode check

snprintf() -> slprintf()

- Avoid sprintf, even when checked copy'n'paste or changes lead to errors

disallow negative length

Fixed SIGSEGV

Prevent SESSION/GLOBALS overload via session decoding

MFH: Bump year.

Added boundary checks to php_binary deserializer

Session deserializer protection.

protect _SESSION, HTTP_SESSION_VARS and GLOBALS
maintain an internal reference of _SESSION, so that it won't be possible to destroy it from userspace

MFH: fix retval type

Fixed bug #37627 (session save_path check checks the parent directory).

Disallow \0 chars inside session.save_path

MFH: Fix double "wron param count" messages

Expose session storage module locater and serialization function via PHPAPI

Fixed bug #38993 (Fixed safe_mode/open_basedir checks for
session.save_path, allowing them to account for extra parameters).

change ini handlers to produce E_ERROR if they are called during startup

MFH: change E_ERROR to E_WARNING when invalid argument has been passed
make sure ini_set() doesn't reset PS(mod) and PS(serializer) to invalid values

Fixed proto