php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #48840 serialized object: data loss in some use case
Submitted: 2009-07-07 19:45 UTC Modified: 2009-07-07 22:25 UTC
From: schindler dot andor at pokhalo dot hu Assigned:
Status: Not a bug Package: Class/Object related
PHP Version: 5.2.10 OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: schindler dot andor at pokhalo dot hu
New email:
PHP Version: OS:

 

 [2009-07-07 19:45 UTC] schindler dot andor at pokhalo dot hu 
Description:
------------
If i serialize a PHP object, then become some \0 characters in property's field name. This cause some problems, where others using char* instead of smart_str.

Example: If i try escape a serialized object's string with pg_escape_string() then i give a truncated string, because the PQescapeStringConn()/PQescapeString() terminate the processing at the \0 character.

Reproduce code:
---------------
class aClass
{
	private $a;
	public function __construct()
	{
		$this->a = 1;
	}
}

$obj = new aClass();
$str = serialize($obj);

// gives: 'O:6:"aClass":1:{s:9:"#aClass#a";i:1;}'
// (i marked \0's places with a #)
echo $str;

$conn = pg_connect('...');

// gives: 'O:6:"aClass":1:{s:9:"'
echo pg_escape_string($conn, $str);

Expected result:
----------------
I think it would be better, if the serialize don't give \0. I think, it's can not be problem, if serialize uses # or anything instead of \0.

Actual result:
--------------
See code.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-07-07 20:41 UTC] jani@php.net 
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php
 [2009-07-07 21:08 UTC] schindler dot andor at pokhalo dot hu 
And what can i do? base64_encode()/base64_decode() is ridiculous for this example. I can use pg_escape_bytea() too, but the result of serialized anything shouldn't to be a binary data.

I think a serialization method mustn't use special characters, so i think, it's a design bug.
 [2009-07-07 21:26 UTC] rasmus@php.net 
Hrm, I am not sure where you get the impression that serialization must produce non-binary data.  serialize() has always been for generating a way to freeze and store a PHP data object in a manner where it can be unserialized back to its original form.  That is also whatthe documentation says.  It has never promised to do more than that.  If your transport medium is not binary safe, then it is your responsibility to figure out how to encode the serialized blob for your specific medium.
 [2009-07-07 22:25 UTC] schindler dot andor at pokhalo dot hu 
As i seed, all tokens of a serialized data are only ascii characters except this \0 character (or the data, if it's not a string). (If it uses anything else, then i take back what i said). 

So, i don't understand, why can't be the serialize() function binary safe. It is possible to review the design of serialize(), maybe?

--

The another serialization formats which i need to use before was text based format. Ok, it's maybe just by an accident.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat May 04 12:01:31 2024 UTC