# Unserialize Bug

- Thread: https://externals.io/message/16269
- Original archive: https://news-web.php.net/php.internals/16269
- Started by Timm Friebe on 2005-05-17T18:25:59+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #16269 — Timm Friebe — 2005-05-17T18:25:59+00:00

URL: https://externals.io/message/16269#16269

Hi,
 `unserialize()` cannot unserialize objects whose names contain anything except
a-z, 0-9 and _, the parser allows those, though.

Example
=======
$ cat unserialize.php 
<?php
  class Über { }
  
  var_dump(unserialize(serialize(new Über())));
?>

Expected behaviour
==================
$ php unserialize.php 
object(über)(0) {
}

Actual behaviour
================
$ php unserialize.php 
bool(false)
PHP Notice:  `unserialize()`: Error at offset 5 of 15 bytes in
F:\Programme\cygwin\home\thekid\unserialize.php on line 4

Cause
=====
http://cvs.php.net/diff.php/php-src/ext/standard/var_unserializer.re?sa=1&r1
=1.40&r2=1.41&ty=u

Fix
===
Allow anything the parser allows, [a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*

- Timm

---

## #16270 — Derick Rethans — 2005-05-17T20:10:21+00:00

URL: https://externals.io/message/16269#16270 · In reply to: #16269

> Fix
> ===
> Allow anything the parser allows, [a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*

Do you have a patch? :)

regards,
Derick

-- 
Derick Rethans
http://derickrethans.nl | http://ez.no | http://xdebug.org

---

## #16273 — Christian Schneider — 2005-05-18T10:31:56+00:00

URL: https://externals.io/message/16269#16273 · In reply to: #16270

Derick Rethans wrote:
> 
> 
> > […]
> 
> Do you have a patch? :)

I attached a patch for ext/standard/var_unserializer.{c,re}

- Chris

---

## #16274 — Christian Schneider — 2005-05-18T10:33:55+00:00

URL: https://externals.io/message/16269#16274 · In reply to: #16270

Derick Rethans wrote:
> 
> 
> > […]
> 
> Do you have a patch? :)


Oops, and here a patch without the debug fprintf :-)

- Chris