php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #68938 json_decode() decodes empty string without error
Submitted: 2015-01-28 21:51 UTC Modified: 2015-02-02 11:13 UTC
Votes:3
Avg. Score:4.3 ± 0.9
Reproduced:3 of 3 (100.0%)
Same Version:2 (66.7%)
Same OS:3 (100.0%)
From: jeremy at bat-country dot us Assigned: aharvey (profile)
Status: Closed Package: JSON related
PHP Version: 5.6.5 OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: jeremy at bat-country dot us
New email:
PHP Version: OS:

 

 [2015-01-28 21:51 UTC] jeremy at bat-country dot us
Description:
------------
PHP's json_decode() function accepts an empty string as JSON data and returns NULL without setting json_last_error(). An empty string is not valid JSON; see productions in RFC 4627 <https://tools.ietf.org/html/rfc4627> and RFC 7159 <https://tools.ietf.org/html/rfc7159>, or try decoding an empty string using builtin JSON parsers in Python, Go, or V8: all of them raise syntax errors.

To be consistent with other errors, trying to decode an empty string should return NULL but set json_last_error() to indicate a syntax error. For example, this is what happens when json_decode(" ") is called.

This affects PHP 5.4.32 on RHEL 5, PHP 5.6.5 built from the Git tag on Mac OS X 10.9, and probably any other configuration with the JSON extension.

It looks like this behavior was discovered during the course of bug #54484 <https://bugs.php.net/bug.php?id=54484> but never fixed. I've included a patch that fixes it, a regression test, and an update to the test for bug #54484.

Test script:
---------------
--TEST--
Bug #XXXXX (json_decode() decodes empty string without indicating error)
--SKIPIF--
<?php if (!extension_loaded("json")) print "skip"; ?>
--FILE--
<?php
json_decode("");
var_dump(json_last_error());
?>
--EXPECT--
int(4)


Actual result:
--------------
int(0)

Patches

json-decode-empty-string-error.diff (last revision 2015-01-28 21:51 UTC by jeremy at bat-country dot us)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-02-02 11:13 UTC] aharvey@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: aharvey
 [2015-02-02 11:13 UTC] aharvey@php.net
Sorry; I dropped the ball on the original bug report, so the least I can do is merge in your quite correct patch. Thanks!
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Mon Mar 31 23:01:30 2025 UTC