php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #38376 unserialize between 64bit and 32bit systems
Submitted: 2006-08-08 09:05 UTC Modified: 2006-08-08 12:47 UTC
From: are at fronter dot com Assigned:
Status: Not a bug Package: Unknown/Other Function
PHP Version: 4.4.3 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: are at fronter dot com
New email:
PHP Version: OS:

 

 [2006-08-08 09:05 UTC] are at fronter dot com 
Description:
------------
We run 10 webserver behind a loadbalancer. Some of these are 32bit and some are 64bit.
When serializing an array containing the value 2147483648 on a 64bit machine it is stored as an integer. The serialized string is stored in a database. When unserializing on a 32bit machine this number becomes -2147483648. Something that surely breaks a lot of things.

We are now casting the number to float to get around this, but I would think that unserialize should convert the number to float if it can't fit into an int on the running architecture.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-08-08 12:05 UTC] tony2001@php.net 
Using numbers >= 2147483648 is expected to cause integer overflow on 32bit platforms.
 [2006-08-08 12:16 UTC] are at fronter dot com 
But PHP is in all other cases automaticly converting 
integer to float when the number gets too high. So why 
does it not do that in this case.

Does this mean that one can not mix 32 and 64 bit servers. 
Or does it mean that if you do, you must cast everything 
to float everywhere just to be sure?

When assigning with ex: "$i = (int)2147483648;" I can 
understand why it will be an overflow. But with "$i = 
2147483648;" it gets converted to float automaticly.
So when doing unserialize...why does it not do that.

Is there other functions besides serialize one can use to 
avoid this?
 [2006-08-08 12:47 UTC] tony2001@php.net 
Unserializing this string:
i:2147483648;
is the same as (int)2147483648.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Tue Jun 18 13:01:32 2024 UTC