Edit report at https://bugs.php.net/bug.php?id=62852&edit=1
ID: 62852
Comment by: julio at listascuba dot com
Reported by: kasper at webmasteren dot eu
Summary: Unserialize Invalid Date causes crash
Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: windows, linux
PHP Version: Irrelevant
Assigned To: laruence
Block user comment: N
Private report: N
New Comment:
I think the problem persist in PHP 5.5.6
Previous Comments:
------------------------------------------------------------------------
[2014-03-31 02:17:28] michael at currinda dot com
I believe this issue is still happening in 5.5.5.
After looking at the code, I suspect that a new DateTime(null); breaks, but the almost equivalent
'new DateTime("now");' passes.
------------------------------------------------------------------------
[2014-03-27 12:33:52] justinasu at gmail dot com
The problem still persists, using PHP v5.4.26.
Invalid date produces Fatal error:
Fatal error: Invalid serialization data for DateTime object
------------------------------------------------------------------------
[2014-03-07 23:48:43] Matthew dot J dot Mucklo at qvc dot com
We've been seeing the same thing in production.
It's been tough to trace down exactly how to reproduce it, so we ended up patching
php_memcached.c so that these sorts of things don't get saved into memcache (we also had to do
a similar filter for session saving as the serialization happens in a different place):
Diff is below:
--- php_memcached.c 2014-02-05 16:00:37.000000000 -0800
+++ memcached_master_02_05_2014/php_memcached.c 2014-02-06 11:01:27.000000000 -0800
@@ -3193,6 +3193,44 @@
php_error_docref(NULL TSRMLS_CC, E_WARNING, "could not serialize value");
return 0;
}
+
+ const char * const cmp = "\"DateTime\":0:{}";
+ const size_t cmplen = 15;
+ if (buf->len >= cmplen)
+ {
+ size_t len = buf->len - cmplen;
+ char *c = buf->c;
+ size_t i = 0;
+ while(i <= len)
+ {
+ if (*c == *cmp) {
+ char *cmp1 = cmp + 1;
+
+ // Run the comparison
+ while (*cmp1) {
+ c++;
+ i++;
+ if (*c != *cmp1)
+ {
+ break;
+ }
+ cmp1++;
+ }
+
+ // match
+ if (!*cmp1)
+ {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "could not serialize
DateTime value");
+ return 0;
+ }
+ }
+ else
+ {
+ c++;
+ i++;
+ }
+ }
+ }
MEMC_VAL_SET_TYPE(*flags, MEMC_VAL_IS_SERIALIZED);
}
break;
------------------------------------------------------------------------
[2014-01-23 12:13:18] mail at ericreiche dot net
Forgot to mention, version is 5.4.21-1~dotdeb.1
------------------------------------------------------------------------
[2014-01-23 12:12:38] mail at ericreiche dot net
I'm also still getting this with empty DateTime object in session data
O:8:"DateTime":0:{}.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=62852
--
Edit this bug report at https://bugs.php.net/bug.php?id=62852&edit=1