Bug #71840 [Opn]: Unserialize accepts wrongly data

Edit report at https://bugs.php.net/bug.php?id=71840&edit=1 ID: 71840 Updated by: ryat@php.net Reported by: laruence@php.net Summary: Unserialize accepts wrongly data Status: Open Type: Bug Package: Scripting Engine problem PHP Version: Irrelevant Block user comment: N Private report: N New Comment: https://bugs.php.net/bug.php?id=70638 Previous Comments: ------------------------------------------------------------------------ [2016-03-17 04:27:44] laruence@php.net Description: ------------ This is part of the bug #71824 which is spotted by nikic " var_dump(unserialize('a:1:{s:0:""0a:0:{}}')); ^-- wrong does not fail. That 0 should be a semicolon. We should not be accepting this string. " Test script: --------------- var_dump(unserialize('a:1:{s:0:""0a:0:{}}')); Expected result: ---------------- not accepted Actual result: -------------- accepted ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71840&edit=1