Edit report at https://bugs.php.net/bug.php?id=62852&edit=1
ID: 62852
Comment by: mail at ericreiche dot net
Reported by: kasper at webmasteren dot eu
Summary: Unserialize Invalid Date causes crash
Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: windows, linux
PHP Version: Irrelevant
Assigned To: laruence
Block user comment: N
Private report: N
New Comment:
I'm also still getting this with empty DateTime object in session data
O:8:"DateTime":0:{}.
Previous Comments:
------------------------------------------------------------------------
[2013-11-17 09:31:39] laruence@php.net
Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=f8b91d9acff10ede7bd3f2bc631794a3abef8ff7
Log: Fixed bug #62852 Unserialize Invalid Date crash
------------------------------------------------------------------------
[2013-11-05 02:59:59] mkwan at corp dot oodle dot com
According to the documentation, if "the passed string is not unserializeable, FALSE is returned
and E_NOTICE is issued."
http://php.net/manual/en/function.unserialize.php
Why is it that if the string happens to looks like a DateTime, instead an unrecoverable E_ERROR is
issued?
------------------------------------------------------------------------
[2013-04-19 20:42:52] webmaster at thedigitalorchard dot ca
My [ugly] workaround for this problem is to manually replace instances of
serialized DateTime objects with a fake, non-existent class name, which avoids
this crash.
$str = 'O:8:"DateTime":0:{}';
$str = str_replace('O:8:"DateTime"', 'O:12:"PHP_DateTime"',
$str);
Of course, if the serialized data needed to be recovered, an alternate approach
would be needed. In my own case, I want to be discarding this object. I'm hoping
this issue that ran into is an unforeseen issue with this latest bug fix, and a
proper fix can be made in a future update. I don't like adding in workarounds. :-)
------------------------------------------------------------------------
[2013-04-19 20:28:26] webmaster at thedigitalorchard dot ca
I'm getting an error since this bug was "fixed". In one of my databases, a
DateTime object was inadvertently serialized as a child object. Now, with this bug
fix, I'm getting the following error.
The serialized object is represented by this short string:
O:8:"DateTime":0:{}
Running that through unserialize presents this error:
"Invalid serialization data for DateTime object"
I'm unable to catch this error and handle it gracefully (ie. ignoring this object
unserialization entirely).
------------------------------------------------------------------------
[2013-03-15 20:31:10] ab@php.net
Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=f8b91d9acff10ede7bd3f2bc631794a3abef8ff7
Log: Fixed bug #62852 Unserialize Invalid Date crash
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=62852
--
Edit this bug report at https://bugs.php.net/bug.php?id=62852&edit=1