Skip to content

Commit 3b43c1c

Browse files
committed
unserialize does not allow empty strings
1 parent 24b9ef2 commit 3b43c1c

File tree

2 files changed

+19
-5
lines changed

2 files changed

+19
-5
lines changed

ext/bcmath/bcmath.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1738,7 +1738,7 @@ PHP_METHOD(BcMath_Number, __unserialize)
17381738
ZEND_PARSE_PARAMETERS_END();
17391739

17401740
zval *zv = zend_hash_str_find(props, "value", sizeof("value")-1);
1741-
if (!zv || Z_TYPE_P(zv) != IS_STRING) {
1741+
if (!zv || Z_TYPE_P(zv) != IS_STRING || Z_STRLEN_P(zv) == 0) {
17421742
goto fail;
17431743
}
17441744

ext/bcmath/tests/number/unserialize_error.phpt

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,26 @@ try {
1111
echo $e->getMessage() . "\n";
1212
}
1313

14-
try {
15-
unserialize('O:13:"BcMath\Number":1:{s:5:"value";s:1:"a";}');
16-
} catch (Exception $e) {
17-
echo $e->getMessage();
14+
echo "\n";
15+
$cases = [
16+
'O:13:"BcMath\Number":1:{s:5:"value";s:1:"a";}',
17+
'O:13:"BcMath\Number":1:{s:5:"value";s:0:"";}',
18+
'O:13:"BcMath\Number":0:{}',
19+
'O:13:"BcMath\Number":1:{s:5:"value";i:1;}',
20+
];
21+
22+
foreach ($cases as $case) {
23+
try {
24+
unserialize($case);
25+
} catch (Exception $e) {
26+
echo $e->getMessage() . "\n";
27+
}
1828
}
1929
?>
2030
--EXPECT--
2131
Cannot modify readonly property BcMath\Number::$value
32+
33+
Invalid serialization data for BcMath\Number object
34+
Invalid serialization data for BcMath\Number object
35+
Invalid serialization data for BcMath\Number object
2236
Invalid serialization data for BcMath\Number object

0 commit comments

Comments
 (0)