Search code examples
phpserializationcorruptiontruncation

Is it possible to mend a serialize string that has become corrupted due to truncation?


I have a massive multidimensional array that has been serialised by PHP. It has been stored in MySQL and the data field wasn't large enough... the end has been cut off.

I need to extract the data, but unserialize wont work.

Does anyone know of a solution that can close all the arrays and recalculate the string lengths to produce a new valid serialized string?

It's too much data to do by hand.


Solution

  • I think this is almost impossible. Before you can repair your array you need to know how it is damaged. How many childs missing? What was the content?

    Sorry imho you can't do it.

    Proof:

    <?php
    
    $serialized = serialize(
        [
            'one'   => 1,
            'two'   => 'nice',
            'three' => 'will be damaged'
        ]
    );
    
    var_dump($serialized); // a:3:{s:3:"one";i:1;s:3:"two";s:4:"nice";s:5:"three";s:15:"will be damaged";}
    
    var_dump(unserialize('a:3:{s:3:"one";i:1;s:3:"two";s:4:"nice";s:5:"tee";s:15:"will be damaged";}')); // please note 'tee'
    
    var_dump(unserialize('a:3:{s:3:"one";i:1;s:3:"two";s:4:"nice";s:5:"three";s:')); // serialized string is truncated
    

    Link: https://ideone.com/uvISQu

    Even if you can recalculate length of your keys/values, you cannot trust the data retrieved from this source, because you cannot recalculate the value of these. Eg. if the serialized data is an object, your properties won't be accessible anymore.