#43614 [Opn]: incorrect processing of numerical string keys of array (unserialize)
| From: | felipe@php.net | Date: | Mon, 17 Dec 2007 12:00:02 +0000 |
| Subject: | #43614 [Opn]: incorrect processing of numerical string keys of array (unserialize) | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-120697@lists.php.net to get a copy of this message | ||
ID: 43614
Updated by: felipe@php.net
Reported By: dmitriy dot buldakov at toatech dot com
Status: Open
Bug Type: Arrays related
Operating System: Mac OS X
PHP Version: 5.2.5
New Comment:
Hmm, ok, arbitray string...
Simple solution:
Index: var_unserializer.c
===================================================================
RCS file: /repository/php-src/ext/standard/var_unserializer.c,v
retrieving revision 1.70.2.4.2.7.2.3
diff -u -u -r1.70.2.4.2.7.2.3 var_unserializer.c
--- var_unserializer.c 17 Oct 2007 10:36:33 -0000
1.70.2.4.2.7.2.3
+++ var_unserializer.c 17 Dec 2007 11:58:43 -0000
@@ -282,6 +282,10 @@
return 0;
}
+ if (Z_TYPE_P(key) == IS_STRING &&
strspn(Z_STRVAL_P(key), "0123456789") == Z_STRLEN_P(key)) {
+ convert_to_long(key);
+ }
+
switch (Z_TYPE_P(key)) {
case IS_LONG:
if (zend_hash_index_find(ht,
Z_LVAL_P(key), (void **)&old_data)==SUCCESS) {
Previous Comments:
------------------------------------------------------------------------
[2007-12-17 08:24:21] dmitriy dot buldakov at toatech dot com
The bug also can be reproduced under FreeBSD 6.2
------------------------------------------------------------------------
[2007-12-17 08:14:35] dmitriy dot buldakov at toatech dot com
Description:
------------
php converts numerical string in array keys to integer if possible.
php4 converts those string while unserialize as well as while array
processing of php code
php5 converts those string while array processing of php code only, and
not converts while the unserialize a string
As the result - unserialized array can contains fake elements.
For example - there is no way to get access to the element by a key.
Reproduce code:
---------------
<?php
$a = unserialize('a:2:{s:2:"10";i:1;s:2:"01";i:2;}');
print $a['10']."\n";
$a['10'] = 3;
$a['01'] = 4;
print_r($a);
foreach ($a as $k => $v)
{
print 'KEY: ';
var_dump($k);
print 'VAL: ';
var_dump($v);
print "\n";
}
?>
Expected result:
----------------
Dmitriy-Buldakov:~ dmitry$ php4 test.php
1
Array
(
[10] => 3
[01] => 4
)
KEY: int(10)
VAL: int(3)
KEY: string(2) "01"
VAL: int(4)
Dmitriy-Buldakov:~ dmitry$
Actual result:
--------------
Dmitriy-Buldakov:~ dmitry$ php5 test.php
PHP Notice: Undefined index: 10 in /Users/dmitry/test.php on line 5
Notice: Undefined index: 10 in /Users/dmitry/test.php on line 5
Array
(
[10] => 1
[01] => 4
[10] => 3
)
KEY: string(2) "10"
VAL: int(1)
KEY: string(2) "01"
VAL: int(4)
KEY: int(10)
VAL: int(3)
Dmitriy-Buldakov:~ dmitry$
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=43614&edit=1