Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Possibly missing warning for `unserialize('')` - may be confused with "false"

Geschlossen
  • Stimmt etwas nicht?
#23,780 5 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
45/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
c, php
Bereich
backend

Rechercherichtung

Start by reproducing the supplied PHP example, then read ext/standard/var.c around php_unserialize_with_options at the linked condition. Check existing unserialize behavior and tests before deciding whether empty input should warn; done means the expected behavior is agreed and covered by an appropriate regression test.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Bug Status: Verified
Description

The following code:

<?php

error_reporting(E_ALL);
ini_set('display_errors', '1');
ini_set('display_startup_errors', '1');

$a = 'b:0;'; // serialize(false);
$b = '';

var_dump($a === $b);
var_dump(unserialize($a) === unserialize($b));

Resulted in this output:

bool(false)
bool(true)

But I expected this output instead:

bool(false)

Warning: unserialize(): Empty input in /in/bjBq9 on line 11
bool(true)

Dear Developers, Artists,

Thank you for the marvel, art...

On 2026-09-18, at Libera IRC channel #php, a member ash_worksi raised this issue asking why no warning is raised in PHP, if compared to unserialize(' ');, for example.

My contention is the fact that it doesn't raise a warning like the description says. It's a very narrow edge case, but just like any "non-unserializable" string (...otherwise why would it return false?) it should raise the warning.

unserialize() returning false on it's own does not tell you whether the function failed to unserialize or if the value you unserialized was in fact false.

~ ash_worksi

Later, I tried searching for the actual reason it happens, and the condition involved is likely the following, in the function php_unserialize_with_options:

https://github.com/php/php-src/blob/13cec7c276033883e1e0ee22ea92fa1838b06dca/ext/standard/var.c#L1414-L1416

The condition explicitly checks if the string is empty, and returns "false" by design, and considering the first commits checked, it has been so for at least "20 years ago".

Image

I believe that for so much time, it was discussed already, but just in case, is it still actually expected?

Best and kind regards

PHP Version
PHP 8.5.10 (cli) (built: Sep 19 2026 00:23:53) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.10, Copyright (c), by Zend Technologies
Operating System

Kubuntu 26.10 (Docker)

Vorherrschende Sprache
C
Sterne
40.4k
Forks
8.2k
Ø Merge
2 T. 13 Std.
Gemergte PRs (30 T.)
154

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus php/php-src

Alle Issues in php/php-src

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.