Bug #72178 [Com]: unserialize regression in 5.6.21 and 7.0.6

Edit report at https://bugs.php.net/bug.php?id=72178&edit=1 ID: 72178 Comment by: bc at benjamin-cremer dot de Reported by: bc at benjamin-cremer dot de Summary: unserialize regression in 5.6.21 and 7.0.6 Status: Open Type: Bug Package: *General Issues PHP Version: 7.0.6 Block user comment: N Private report: N New Comment: Relates to: https://bugs.php.net/bug.php?id=71840 Previous Comments: ------------------------------------------------------------------------ [2016-05-09 14:29:48] bc at benjamin-cremer dot de See: https://3v4l.org/qTJ8g ------------------------------------------------------------------------ [2016-05-09 13:59:03] bc at benjamin-cremer dot de Description: ------------ When using unserialize() on a serialized string missing the trailing semicolon a notice will be triggered and false will be returned. This is a backwards compatibility break introduced in 5.6.21 and 7.0.6. Test script: --------------- var_dump(unserialize('s:4:"test"')); Expected result: ---------------- string(4) "test" Actual result: -------------- PHP Notice: unserialize(): Error at offset 10 of 10 bytes in php shell code on line 1 bool(false) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72178&edit=1