Bug #79880 [Opn->Fbk]: Fatal error: Uncaught Error: Invalid serialization data for DateTime object

Edit report at https://bugs.php.net/bug.php?id=79880&edit=1 ID: 79880 Updated by: requinix@php.net Reported by: isharafa at unb dot ca Summary: Fatal error: Uncaught Error: Invalid serialization data for DateTime object -Status: Open +Status: Feedback Type: Bug -Package: *Programming Data Structures +Package: Date/time related Operating System: Ubuntu PHP Version: 7.4.8 Block user comment: N Private report: N New Comment: What's the bug? You're crafting a custom serialized string (which is already a bad thing) containing an invalid date string that DateTime would have rejected (so the object shouldn't even exist in the first place) and when you try to unserialize it you get an exception (as opposed to a crash). Previous Comments: ------------------------------------------------------------------------ [2020-07-21 22:10:59] isharafa at unb dot ca Description: ------------ I was fuzzing PHP to find a bug in unserialize function and I got the following bug: Stack trace: #0 [internal function]: DateTime->__wakeup() #1 Command line code(1): unserialize('O:8:"DateTime":...') #2 {main} thrown in Command line code on line 1 You can reproduce that using the following command. echo -ne 'O:8:"DateTime":3:{s:4:"date";s:26:"2fe";01-one";s:10"Z.012345";s:13:"timezone_type";i:2;s:8:"timezone";s:1:"Z";}' | ./sapi/cli/php -r 'unserialize(file_get_contents("php://stdin"));' Test script: --------------- echo -ne 'O:8:"DateTime":3:{s:4:"date";s:26:"2fe";01-one";s:10"Z.012345";s:13:"timezone_type";i:2;s:8:"timezone";s:1:"Z";}' | ./sapi/cli/php -r 'unserialize(file_get_contents("php://stdin"));' ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79880&edit=1