Bug #79880 [Fbk->Opn]: Fatal error: Uncaught Error: Invalid serialization data for DateTime object

Edit report at https://bugs.php.net/bug.php?id=79880&edit=1 ID: 79880 User updated by: isharafa at unb dot ca Reported by: isharafa at unb dot ca Summary: Fatal error: Uncaught Error: Invalid serialization data for DateTime object -Status: Feedback +Status: Open Type: Bug Package: Date/time related Operating System: Ubuntu PHP Version: 7.4.8 Block user comment: N Private report: N New Comment: Yes. Previous Comments: ------------------------------------------------------------------------ [2020-07-21 23:39:21] requinix@php.net What's the bug? You're crafting a custom serialized string (which is already a bad thing) containing an invalid date string that DateTime would have rejected (so the object shouldn't even exist in the first place) and when you try to unserialize it you get an exception (as opposed to a crash). ------------------------------------------------------------------------ [2020-07-21 22:10:59] isharafa at unb dot ca Description: ------------ I was fuzzing PHP to find a bug in unserialize function and I got the following bug: Stack trace: #0 [internal function]: DateTime->__wakeup() #1 Command line code(1): unserialize('O:8:"DateTime":...') #2 {main} thrown in Command line code on line 1 You can reproduce that using the following command. echo -ne 'O:8:"DateTime":3:{s:4:"date";s:26:"2fe";01-one";s:10"Z.012345";s:13:"timezone_type";i:2;s:8:"timezone";s:1:"Z";}' | ./sapi/cli/php -r 'unserialize(file_get_contents("php://stdin"));' Test script: --------------- echo -ne 'O:8:"DateTime":3:{s:4:"date";s:26:"2fe";01-one";s:10"Z.012345";s:13:"timezone_type";i:2;s:8:"timezone";s:1:"Z";}' | ./sapi/cli/php -r 'unserialize(file_get_contents("php://stdin"));' ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79880&edit=1