php · hikari-no-yume · Sep 17, 2013 · Oct 15, 2013 · Oct 15, 2013 · Oct 15, 2013
diff --git a/NEWS b/NEWS
@@ -2,4 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 20??, PHP 5.7.0 
 
+- JSON:
+  . Fixed bug #64874 ("json_decode handles whitespace and case-sensitivity
+    incorrectly")
+
 <<< NOTE: Insert NEWS from last stable release here prior to actual release! >>>
diff --git a/UPGRADING b/UPGRADING
@@ -21,6 +21,14 @@ PHP X.Y UPGRADE NOTES
 ========================================
 
 
+- JSON:
+  Fixed bug #64874 ("json_decode handles whitespace and case-sensitivity
+  incorrectly")
+  This means that when a non-lowercase JSON text containing only JSON true,
+  false or null is passed to json_decode(), it will error. Please note however
+  that non-lowercase true, false or null have never been accepted inside JSON
+  arrays or JSON strings. This only applies to deserialising single values.
+
 ========================================
 2. New Features
 ========================================

@@ -712,14 +712,14 @@ PHP_JSON_API void php_json_decode_ex(zval *return_value, char *str, int str_len,
 
 		RETVAL_NULL();
 		if (trim_len == 4) {
-			if (!strncasecmp(trim, "null", trim_len)) {
+			if (!strncmp(trim, "null", trim_len)) {
 				/* We need to explicitly clear the error because its an actual NULL and not an error */
 				jp->error_code = PHP_JSON_ERROR_NONE;
 				RETVAL_NULL();
-			} else if (!strncasecmp(trim, "true", trim_len)) {
+			} else if (!strncmp(trim, "true", trim_len)) {
 				RETVAL_BOOL(1);
 			}
-		} else if (trim_len == 5 && !strncasecmp(trim, "false", trim_len)) {
+		} else if (trim_len == 5 && !strncmp(trim, "false", trim_len)) {
 			RETVAL_BOOL(0);
 		}
 

@@ -0,0 +1,41 @@
+--TEST--
+Case-sensitivity part of bug #64874 ("json_decode handles whitespace and case-sensitivity incorrectly")
+--SKIPIF--
+<?php if (!extension_loaded("json")) print "skip"; ?>
+--FILE--
+<?php
+function decode($json) {
+    var_dump(json_decode($json));
+    var_dump(json_last_error() !== 0);
+    echo "\n";
+}
+
+// Only lowercase should work
+decode('true');
+decode('True');
+decode('false');
+decode('False');
+decode('null');
+decode('Null');
+
+echo "Done\n";
+--EXPECT--
+bool(true)
+bool(false)
+
+NULL
+bool(true)
+
+bool(false)
+bool(false)
+
+NULL
+bool(true)
+
+NULL
+bool(false)
+
+NULL
+bool(true)
+
+Done