php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #39488 unserialize does not convert array keys to proper type
Submitted: 2006-11-13 07:08 UTC Modified: 2006-11-13 08:15 UTC
From: michaelw at darkhorse dot com Assigned:
Status: Not a bug Package: *General Issues
PHP Version: 5.2.0 OS: os x
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: michaelw at darkhorse dot com
New email:
PHP Version: OS:

 

 [2006-11-13 07:08 UTC] michaelw at darkhorse dot com
Description:
------------
When dealing with an incorrectly formatted serialized array (such as from a source other than PHP like a javascript, or hand-coded), unserialize() does not check and convert array keys that are stored as strings but should be integers.

This makes it impossible to recover the value through any sort of type-casting.


Reproduce code:
---------------
$badly_serialized_array = 'a:1:{s:1:"0";s:1:"a";}';
$back_to_an_array = unserialize($badly_serialized_array);
echo $back_to_an_array[0];
echo $back_to_an_array['0'];
$v = (string)'0';
echo $back_to_an_array[$v];


Expected result:
----------------
a
a
a

Actual result:
--------------
nothing
nothing
nothing

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-11-13 08:15 UTC] helly@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

Your data is corrupt.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sat Dec 06 11:00:02 2025 UTC