[PHP-BUG] Bug #74300 [NEW]: unserialize accepts two plus/minus signs for float number exponent part

From:             xKhorasan+php at gmail dot com
Operating system: All
PHP version:      7.0Git-2017-03-23 (Git)
Package:          *General Issues
Bug Type:         Bug
Bug description:unserialize accepts two plus/minus signs for float number exponent part

Description:
------------
tested PHP version: PHP 7.0.18-dev (macOS Sierra 10.12.3)
configure option: --without-iconv

According to `ext/standard/var_unsrializer.re`, serialized float number
is defined as `"d:" (iv | nv | nvexp) ";"`.
https://github.com/php/php-src/blob/fd4025069d561b4196851c2e9a85b5bfdfe1465a/ext/standard/var_unserializer.re#L731

And `nvexp` is defined as following:
> iv = [+-]? [0-9]+;
> nv = [+-]? ([0-9]* "." [0-9]+|[0-9]+ "." [0-9]*);
> nvexp = (iv | nv) [eE] [+-]? iv;
https://github.com/php/php-src/blob/fd4025069d561b4196851c2e9a85b5bfdfe1465a/ext/standard/var_unserializer.re#L320-L322

Since `nvexp` exponent part, i.e. `[+-]? iv`, contains optional
plus/minus sign (`[+-]?`) and `iv`, and `iv` may contain plus/minus
sign, `nvexp` may contain two plus/minus signs for exponent part.

In addition, if exponent part of serialized float number contains two
plus/minus signs, the information of the exponent part is not used
during unserializing.


Test script:
---------------
<?php
error_reporting(E_ALL);
var_dump(unserialize('d:2e+2;'));
var_dump(unserialize('d:2e++2;'));
var_dump(unserialize('d:2e+++2;'));


Expected result:
----------------
float(200)

Notice: unserialize(): Error at offset 0 of 8 bytes in %s on line %d
bool(false)

Notice: unserialize(): Error at offset 0 of 9 bytes in %s on line %d
bool(false)


Actual result:
--------------
float(200)
float(2)

Notice: unserialize(): Error at offset 0 of 9 bytes in %s on line %d
bool(false)


-- 
Edit bug report at https://bugs.php.net/bug.php?id=74300&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=74300&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=74300&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=74300&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=74300&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=74300&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=74300&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=74300&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=74300&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=74300&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=74300&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=74300&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=74300&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=74300&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74300&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=74300&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=74300&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=74300&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=74300&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=74300&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=74300&r=mysqlcfg