From 17b34be04f5cc2a5f83d73eba7cd41cbc3ebb7b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 4 Oct 2016 13:17:07 +0200 Subject: [PATCH] Correctly parse string length when checking serialized data MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/core.lib.php | 2 +- test/libraries/core/PMA_safeUnserialize_test.php | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/libraries/core.lib.php b/libraries/core.lib.php index e5997a5608..ef79c916d3 100644 --- a/libraries/core.lib.php +++ b/libraries/core.lib.php @@ -1088,7 +1088,7 @@ function PMA_safeUnserialize($data) case 's': /* string */ // parse sting length - $strlen = intval($data[$i + 2]); + $strlen = intval(substr($data, $i + 2)); // string start $i = strpos($data, ':', $i + 2); if ($i === false) { diff --git a/test/libraries/core/PMA_safeUnserialize_test.php b/test/libraries/core/PMA_safeUnserialize_test.php index f2710c0792..f589361b93 100644 --- a/test/libraries/core/PMA_safeUnserialize_test.php +++ b/test/libraries/core/PMA_safeUnserialize_test.php @@ -44,6 +44,7 @@ class PMA_safeUnserialize_test extends PHPUnit_Framework_TestCase array('b:0;', false), array('O:1:"a":1:{s:5:"value";s:3:"100";}', null), array('O:8:"stdClass":1:{s:5:"field";O:8:"stdClass":0:{}}', null), + array('a:2:{i:0;s:90:"1234567890;a345678901234567890123456789012345678901234567890123456789012345678901234567890";i:1;O:8:"stdClass":0:{}}', null), array(serialize(array(1, 2, 3)), array(1, 2, 3)), array(serialize('string""'), 'string""'), array(serialize(array('foo' => 'bar')), array('foo' => 'bar')),