Bug #71840 [Opn->Csd]: Unserialize accepts wrongly data

Edit report at https://bugs.php.net/bug.php?id=71840&edit=1 ID: 71840 Updated by: laruence@php.net Reported by: laruence@php.net Summary: Unserialize accepts wrongly data -Status: Open +Status: Closed Type: Bug Package: Scripting Engine problem PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=6f241f5fad3a26810c96d5b634bfbceaeac10176 Log: Fixed bug #71840 (Unserialize accepts wrongly data) Previous Comments: ------------------------------------------------------------------------ [2016-03-17 05:15:32] ryat@php.net https://bugs.php.net/bug.php?id=70638 ------------------------------------------------------------------------ [2016-03-17 04:27:44] laruence@php.net Description: ------------ This is part of the bug #71824 which is spotted by nikic " var_dump(unserialize('a:1:{s:0:""0a:0:{}}')); ^-- wrong does not fail. That 0 should be a semicolon. We should not be accepting this string. " Test script: --------------- var_dump(unserialize('a:1:{s:0:""0a:0:{}}')); Expected result: ---------------- not accepted Actual result: -------------- accepted ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71840&edit=1