Unserialize bug in PHP 4.3.2RC4?

php.internals

Iacopo Spalletti

23 years ago
I'm testing PHP 4.3.2RC4 and i think i found a bug in unserialize function If you run this script: <?php error_reporting (E_ALL); $a = array(4); $str = serialize($a); print('Serialized array: '.$str."\n"); $b = unserialize($str); print('Unserialized array: '); var_dump($b); print("\n"); $str = serialize(array(4.5)); print('Serialized array: '.$str."\n"); $b = unserialize($str); print('Unserialized array: ') ; var_dump($b); print("\n"); ?> You should expect the second variable to contain an array with a single floating value. On my systems (Linux SuSE x86) i got this notice: Notice: unserialize(): Error at offset 15 of 16 bytes in script-name.php on line 12 Result for unserialize() is "false" Needless to say that on PHP 4.3.0 all run fine Serializing/deserializing float var it's ok Iacopo Spalletti i dot spalletti at iast dot it PGP key block: http://www.iast.it/pgp

Stanislav Malyshev

23 years ago
Strange thing - I saw this effect myself, but as soon as I have rebuilt var_unserializer.c from var_unserializer.re, it works OK again... Maybe just unclean CVS build or something? IS>> I'm testing PHP 4.3.2RC4 and i think i found a bug in unserialize function IS>> If you run this script: IS>> <?php IS>> error_reporting (E_ALL); IS>> $a = array(4); IS>> $str = serialize($a); IS>> print('Serialized array: '.$str."\n"); IS>> $b = unserialize($str); IS>> print('Unserialized array: '); IS>> var_dump($b); IS>> print("\n"); IS>> $str = serialize(array(4.5)); IS>> print('Serialized array: '.$str."\n"); IS>> $b = unserialize($str); IS>> print('Unserialized array: ') ; IS>> var_dump($b); IS>> print("\n"); IS>> ?> IS>> You should expect the second variable to contain an array with a single IS>> floating value. IS>> On my systems (Linux SuSE x86) i got this notice: IS>> Notice: unserialize(): Error at offset 15 of 16 bytes in script-name.php on IS>> line 12 IS>> Result for unserialize() is "false" IS>> Needless to say that on PHP 4.3.0 all run fine IS>> Serializing/deserializing float var it's ok IS>> IS>> IS>> IS>> Iacopo Spalletti IS>> i dot spalletti at iast dot it IS>> IS>> PGP key block: http://www.iast.it/pgp IS>> IS>> IS>>
-- Stanislav Malyshev, Zend Products Engineer stas@zend.com http://www.zend.com/ +972-3-6139665 ext.109

Jani Taskinen

23 years ago
The .c mismatched the .re, I just committed a freshly generated var_unserializer.c so this should be fixed now. --Jani On Thu, 22 May 2003, Stanislav Malyshev wrote:
>Strange thing - I saw this effect myself, but as soon as I have rebuilt >var_unserializer.c from var_unserializer.re, it works OK again... Maybe >just unclean CVS build or something? > >IS>> I'm testing PHP 4.3.2RC4 and i think i found a bug in unserialize function >IS>> If you run this script: >IS>> <?php >IS>> error_reporting (E_ALL); >IS>> $a = array(4); >IS>> $str = serialize($a); >IS>> print('Serialized array: '.$str."\n"); >IS>> $b = unserialize($str); >IS>> print('Unserialized array: '); >IS>> var_dump($b); >IS>> print("\n"); >IS>> $str = serialize(array(4.5)); >IS>> print('Serialized array: '.$str."\n"); >IS>> $b = unserialize($str); >IS>> print('Unserialized array: ') ; >IS>> var_dump($b); >IS>> print("\n"); >IS>> ?> >IS>> You should expect the second variable to contain an array with a single >IS>> floating value. >IS>> On my systems (Linux SuSE x86) i got this notice: >IS>> Notice: unserialize(): Error at offset 15 of 16 bytes in script-name.php on >IS>> line 12 >IS>> Result for unserialize() is "false" >IS>> Needless to say that on PHP 4.3.0 all run fine >IS>> Serializing/deserializing float var it's ok >IS>> >IS>> >IS>> >IS>> Iacopo Spalletti >IS>> i dot spalletti at iast dot it >IS>> >IS>> PGP key block: http://www.iast.it/pgp >IS>> >IS>> >IS>> > >
-- <- For Sale! ->

Iacopo Spalletti

23 years ago
Il 01.37 23/05/03 +0300, Jani Taskinen ha scritto:
> > The .c mismatched the .re, I just committed a freshly generated > var_unserializer.c so this should be fixed now. > > --Jani
Did you fixed var_unserializer.c only in cvs or even in RC4 package? Iacopo Spalletti i dot spalletti at iast dot it PGP key block: http://www.iast.it/pgp

Jani Taskinen

23 years ago
On Fri, 23 May 2003, Iacopo Spalletti wrote:
>Il 01.37 23/05/03 +0300, Jani Taskinen ha scritto: > > > > The .c mismatched the .re, I just committed a freshly generated > > var_unserializer.c so this should be fixed now. > > > > --Jani >Did you fixed var_unserializer.c only in cvs or even in RC4 package?
In CVS. Try a snapshot from http://snaps.php.net/ in about 20 minutes. --Jani