#45573 [Bgs]: unserialize does not work if a linebreak is inside the input string

ID: 45573 User updated by: t_mueller_stolzenhain at yahoo dot de Reported By: t_mueller_stolzenhain at yahoo dot de Status: Bogus Bug Type: CGI related Operating System: windows2003 PHP Version: 5.2CVS-2008-07-23 Assigned To: fb-req-jani New Comment: sample to reproduce the error I had: <?php //the original array $a = array( 'a23' => 'abcdefg hij' ); //make it serial $s = serialize($a); //just to see the serial string var_dump($s); //the serialized array $s1 = 'a:1:{s:3:"a23";s:11:"abcdefg hij";}'; //the same with linux line end character $s2 = "a:1:{s:3:\"a23\";s:11:\"abcdefg\12hij\";}"; //the same with windows line end character, same I had in my PEAR files $s3 = "a:1:{s:3:\"a23\";s:11:\"abcdefg\15\12hij\";}"; //turn it back to an array $a1 = unserialize($s1); // ok $a2 = unserialize($s2); // ok $a3 = unserialize($s3); // not ok ?> Previous Comments: ------------------------------------------------------------------------ [2008-07-24 23:04:14] jani@php.net As long as there is no preproducing script, there is no problem either. ------------------------------------------------------------------------ [2008-07-24 21:10:21] t_mueller_stolzenhain at yahoo dot de I don't have a sample script (I'm not able to create an text with two different line endings in it), but I found the reason for that issue: As you know, PEAR is storing some information inside the .registry directory in *.reg files. Some of these files I found converted to the windows style, means they had a windows line ending ("\15\12") instead of the linux line ending ("\12"). After reformating these files with the linux line ending, the error messages disappeared, and the PEAR update was running without any error messages. I asume, the most of the files on a windows computer have the windows line ending included, not the linux line ending. PHP is able to detect that it is running on a windows computer, and unserialize should be able to handle the windows line ending without error message. ------------------------------------------------------------------------ [2008-07-24 00:31:50] jani@php.net Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. ------------------------------------------------------------------------ [2008-07-23 21:40:29] t_mueller_stolzenhain at yahoo dot de I tried the package from http://snaps.php.net/win32/php5.2-win32-latest.zip, but the error is still there. I changed the category for this bug, because the PEAR update was not running inside the browser, it was running inside a dos window. ------------------------------------------------------------------------ [2008-07-20 20:23:11] t_mueller_stolzenhain at yahoo dot de Description: ------------ After updating PHP to version 5.2.6 on a windows 2003 server running under IIS, it was not possible to update PEAR anymore. Each package created some error messages like Notice: unserialize(): Error at offset 1139 of 4783 bytes in PEAR\Registry.php on line 1062 After putting the line $data = str_replace("\15\12", "\12", $data); before the unserialize-including line, the error message disappeared an I was able to update PEAR again. I asume, this is an IIS related issue, because on an other Computer with PHP 5.2.5 (running on Win XP and Apache) are no error messages. Reproduce code: --------------- These are the lines 1058-1064 from /PEAR/PEAR/Registry.php including one line with an fix $this->_closePackageFile($fp); $data = file_get_contents($this->_packageFileName($package, $channel)); set_magic_quotes_runtime($rt); $data = str_replace("\15\12", "\12", $data);//additional line with fix $data = unserialize($data); if ($key === null) { return $data; } Expected result: ---------------- no error message Actual result: -------------- e.g. Notice: unserialize(): Error at offset 1139 of 4783 bytes in PEAR\Registry.php on line 1062 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=45573&edit=1