fix session manager UAF