Bug #44700 for PHP-Serialization: Deserialization bug

Tue Mar 31 10:16:45 2009 ribasushi [...] leporine.io - Ticket created

A warning Odd number of elements in hash assignment at /usr/share/perl5/PHP/Serialization.pm line 180. is generated when de-serializing the following string. I am not that versed in PHP to know if the string is botched or is it a problem with P::S. my $encoded_php = 'a:2:{s:15:"info_buyRequest";a:5:{s:4:"uenc";s:72:"aHR0cDovL3N0YWdpbmcucGNkaXJlY3QuY29tL21vbml0b3JzL2Jsc2FzeTIwMjB3aS5odG1s";s:7:"product";s:3:"663";s:15:"related_product";s:0:"";s:7:"options";a:3:{i:3980;s:5:"12553";i:3981;s:5:"12554";i:3982;s:5:"12555";}s:3:"qty";s:6:"1.0000";}s:7:"options";a:3:{i:0;a:8:{s:5:"label";s:27:"Dead Pixel Checking Service";s:5:"value";s:155:"I understand LCD technology might have slight imperfections. Even a high quality A Grade panel might have up to five dead pixels. Ship without pre-checking";s:9:"option_id";s:4:"3980";s:3:"sku";s:0:"";s:5:"price";N;s:10:"price_type";N;s:3:"raw";O:33:"Mage_Catalog_Model_Product_Option":15:{s:11:"'; Cheers

Tue Mar 31 10:20:01 2009 bobtfish [...] bobtfish.net - Correspondence added

On Tue Mar 31 10:16:45 2009, RIBASUSHI wrote: Show quoted text

> I am not that versed in PHP to know > if the string is botched or is it a problem with P::S.

Almost certainly a bug in P::S. This module is, unfortunately, almost unmaintained. Patches are, however, welcome.. Cheers t0m

Tue Mar 31 10:20:03 2009 The RT System itself - Status changed from 'new' to 'open'

Tue Mar 31 10:20:27 2009 bobtfish [...] bobtfish.net - Subject changed from (no value) to 'Deserialization bug'

Fri May 29 10:03:07 2009 http://isage.livejournal.com/ - Correspondence added

Your serialized string is incomplete: Show quoted text

>{s:11:"';

See? But anyway P::S should return an appropriate error.

Fri May 29 10:45:26 2009 bobtfish [...] bobtfish.net - Correspondence added

Subject:	Re: [rt.cpan.org #44700] Deserialization bug
Date:	Fri, 29 May 2009 15:44:31 +0100
To:	bug-PHP-Serialization [...] rt.cpan.org
From:	Tomas Doran <bobtfish [...] bobtfish.net>

http://isage.livejournal.com/ via RT wrote: Show quoted text

> Queue: PHP-Serialization > Ticket <URL: https://rt.cpan.org/Ticket/Display.html?id=44700 > > > Your serialized string is incomplete:

>> {s:11:"';

> See? > > But anyway P::S should return an appropriate error.

Correct in both cases. Patches welcome? :) Cheers t0m

Fri May 29 17:50:13 2009 http://isage.livejournal.com/ - Correspondence added

Show quoted text

> Correct in both cases. Patches welcome? :) > > Cheers > t0m

Ok, i've attached a patch, which makes it possible (i hope) to deserialize even an uncomplete string. To correctly handle incomplete strings (i.e. throw an appropriate error), module needs some preparsing or total rewrite with normal finite-state machine.

198,199c198,199 < < my %value = $self->_parse(); --- > my $ret=$self->_parse(); > my %value = $ret if (ref($ret) eq 'HASH');

Wed Jun 17 11:15:55 2009 bo [...] startsiden.no - Correspondence added

I've kinda done a rewrite, debugging something. Not very robust yet though, but I think it has better architecture.

Sat Jun 20 18:56:57 2009 bobtfish [...] bobtfish.net - Correspondence added

Fixed in the just shipped 0.32

Sat Jun 20 18:56:58 2009 bobtfish [...] bobtfish.net - Status changed from 'open' to 'resolved'