php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #55011 serialize a private attribute give it a bad length string
Submitted: 2011-06-08 18:35 UTC Modified: 2011-06-08 21:46 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: nicolas dot giraud at maileva dot com Assigned:
Status: Not a bug Package: Class/Object related
PHP Version: 5.2.17 OS: Windows XP SP3
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: nicolas dot giraud at maileva dot com
New email:
PHP Version: OS:

 

 [2011-06-08 18:35 UTC] nicolas dot giraud at maileva dot com
Description:
------------
When you serialize an object with private or protected members, their length names are baddly calculated (maybe because of "These prepended values [which] have null bytes on either side" like the documentation says.
Anyway, this is a problem when you want to write your serialisation into a file and analyse it next.


Note that I'm not using PHP 5.2.17 but 5.2.3. But I haven't read a fix of this problem between both version.

Test script:
---------------
Here is an example:

class Ab {
    private $_i = 0;
    public function __construct() { $this->_i = 1; }
};

$oAB = new Ab();
$str = serialize($oAB);
echo $str;

Expected result:
----------------
O:2:"Ab":1:{s:4:"Ab_i";i:1;}

Actual result:
--------------
O:2:"Ab":1:{s:6:"Ab_i";i:1;}

Note the "s:6" instead of "s:4": this is why the unserialization from this string is impossible.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-06-08 21:46 UTC] scottmac@php.net
-Status: Open +Status: Bogus
 [2011-06-08 21:46 UTC] scottmac@php.net
The null bytes aren't shown by your browser, but they are there. You can 
unserialize() this value still and everything works.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed May 01 22:01:31 2024 UTC