Edit report at https://bugs.php.net/bug.php?id=62852&edit=1
ID: 62852 Updated by: tstarl...@php.net Reported by: kasper at webmasteren dot eu Summary: Unserialize Invalid Date causes crash -Status: Closed +Status: Re-Opened Type: Bug Package: Reproducible crash Operating System: windows, linux PHP Version: Irrelevant Assigned To: laruence Block user comment: N Private report: N New Comment: The suggested patch does not fix the bug. Throwing an exception does not ensure destruction of the object. For example, you can override __wakeup() in a derived class and put a reference to the half-initialised object in a global value before calling DateTime::__wakeup(). Full test case at http://tstarling.com/stuff/bad-date.phps It segfaults for me on today's git master. It looks to me like either dateobj->time should be fully initialised, or it should be set back to NULL so that DATE_CHECK_INITIALIZED() etc. will guard accesses. In my opinion, throwing an exception from unserialize() is an unnecessary b/c break and should be reverted. Previous Comments: ------------------------------------------------------------------------ [2012-08-19 10:36:32] larue...@php.net This bug has been fixed in SVN. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. ------------------------------------------------------------------------ [2012-08-19 10:32:23] larue...@php.net Automatic comment on behalf of reeze....@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=46a3f257724df7b85cc8c3e6374c36ed9ee783b4 Log: Fixed bug #62852 (Unserialize invalid DateTime causes crash) ------------------------------------------------------------------------ [2012-08-19 10:31:21] larue...@php.net Automatic comment on behalf of reeze....@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=46a3f257724df7b85cc8c3e6374c36ed9ee783b4 Log: Fixed bug #62852 (Unserialize invalid DateTime causes crash) ------------------------------------------------------------------------ [2012-08-19 10:30:36] larue...@php.net Automatic comment on behalf of reeze....@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=46a3f257724df7b85cc8c3e6374c36ed9ee783b4 Log: Fixed bug #62852 (Unserialize invalid DateTime causes crash) ------------------------------------------------------------------------ [2012-08-19 08:08:17] reeze dot xia at gmail dot com Hi, I'v sent pull request to fix this: https://github.com/php/php-src/pull/168 when unserialize it didn't check whether the date is valid. Thanks ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=62852 -- Edit this bug report at https://bugs.php.net/bug.php?id=62852&edit=1
