com php-src: Merge branch 'PHP-5.6' into PHP-7.0: NEWS ext/standard/var_unserializer.c ext/standard/var_unseri alizer.re
| From: | Nikita Popov | Date: | Sun, 01 Jan 2017 13:12:26 +0000 |
| Subject: | com php-src: Merge branch 'PHP-5.6' into PHP-7.0: NEWS ext/standard/var_unserializer.c ext/standard/var_unseri alizer.re | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-96489@lists.php.net to get a copy of this message | ||
Commit: 9f560baef5eacbe3fdb6a23a2d4e1996a30a2d2c
Author: Nikita Popov <nikic@php.net> Sun, 1 Jan 2017 14:12:26 +0100
Parents: 3c977618e1f0a3821deeb56fc55e00fb22ed2402 a65ad951ad95944e357703caa2001f06a4225bf6
Branches: PHP-7.0 PHP-7.1 master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=9f560baef5eacbe3fdb6a23a2d4e1996a30a2d2c
Log:
Merge branch 'PHP-5.6' into PHP-7.0
Changed paths:
MM NEWS
MM ext/standard/var_unserializer.c
MM ext/standard/var_unserializer.re
diff --cc NEWS index 90c68e2,0bb1e67..649fda3 --- a/NEWS +++ b/NEWS @@@ -43,33 -14,14 +43,36 @@@ PH set). (cmb) - Standard: - . Fixed bug #73594 (dns_get_record does not populate $additional out parameter). - (Bruce Weirdan) ++ . Fixed bug #73594 (dns_get_record does not populate $additional out ++ parameter). (Bruce Weirdan) + . Fixed bug #70213 (Unserialize context shared on double class lookup). + (Taoguang Chen) + -08 Dec 2016, PHP 5.6.29 -- Mbstring: - . Fixed bug #73505 (string length overflow in mbfl_memory_device_output - function). (Stas) +- Zlib: + . Fixed bug #73373 (deflate_add does not verify that output was not truncated). + (Matt Bonneau) + +08 Dec 2016 PHP 7.0.14 + +- Core: + . Fixed memory leak(null coalescing operator with Spl hash). (Tyson Andre) + . Fixded bug #72736 (Slow performance when fetching large dataset with mysqli + / PDO). (Dmitry) + +- Calendar: + . Fix integer overflows (Joshua Rogers) + +- Date: + . Fixed bug #69587 (DateInterval properties and isset). (jhdxr) + +- DTrace: + . Disabled PHP call tracing by default (it makes significant overhead). + This may be enabled again using envirionment variable USE_ZEND_DTRACE=1. + (Dmitry) + +- JSON: + . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka) - Mysqlnd: . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb) diff --cc ext/standard/var_unserializer.c index 6b33d84,584e98e..d1eb7b4 --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@@ -592,30 -533,29 +591,29 @@@ static int php_var_unserialize_internal yych = *YYCURSOR; switch (yych) { case 'C': - case 'O': goto yy13; + case 'O': goto yy4; case 'N': goto yy5; - case 'R': goto yy2; - case 'S': goto yy10; - case 'a': goto yy11; - case 'b': goto yy6; - case 'd': goto yy8; - case 'i': goto yy7; + case 'R': goto yy6; + case 'S': goto yy7; + case 'a': goto yy8; + case 'b': goto yy9; + case 'd': goto yy10; + case 'i': goto yy11; case 'o': goto yy12; - case 'r': goto yy4; - case 's': goto yy9; - case '}': goto yy14; - default: goto yy16; + case 'r': goto yy13; + case 's': goto yy14; + case '}': goto yy15; + default: goto yy2; } yy2: - yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy95; + ++YYCURSOR; yy3: - #line 884 "ext/standard/var_unserializer.re" -#line 863 "ext/standard/var_unserializer.re" ++#line 922 "ext/standard/var_unserializer.re" { return 0; } - #line 580 "ext/standard/var_unserializer.c" -#line 556 "ext/standard/var_unserializer.c" ++#line 614 "ext/standard/var_unserializer.c" yy4: yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy89; + if (yych == ':') goto yy17; goto yy3; yy5: yych = *++YYCURSOR; @@@ -651,20 -591,21 +649,21 @@@ yy12 goto yy3; yy13: yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy17; + if (yych == ':') goto yy28; goto yy3; yy14: + yych = *(YYMARKER = ++YYCURSOR); + if (yych == ':') goto yy29; + goto yy3; + yy15: ++YYCURSOR; - #line 878 "ext/standard/var_unserializer.re" -#line 857 "ext/standard/var_unserializer.re" ++#line 916 "ext/standard/var_unserializer.re" { /* this is the case where we have less data than planned */ - php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); + php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } - #line 629 "ext/standard/var_unserializer.c" - yy16: - yych = *++YYCURSOR; - goto yy3; -#line 609 "ext/standard/var_unserializer.c" ++#line 667 "ext/standard/var_unserializer.c" yy17: yych = *++YYCURSOR; if (yybm[0+yych] & 128) { @@@ -675,184 -616,110 +674,109 @@@ yy18 YYCURSOR = YYMARKER; goto yy3; yy19: + ++YYCURSOR; -#line 544 "ext/standard/var_unserializer.re" ++#line 609 "ext/standard/var_unserializer.re" + { + *p = YYCURSOR; - INIT_PZVAL(*rval); - ZVAL_NULL(*rval); ++ ZVAL_NULL(rval); + return 1; + } -#line 628 "ext/standard/var_unserializer.c" ++#line 685 "ext/standard/var_unserializer.c" + yy21: yych = *++YYCURSOR; - if (yybm[0+yych] & 128) { - goto yy20; + if (yych <= ',') { + if (yych == '+') goto yy33; + goto yy18; + } else { + if (yych <= '-') goto yy33; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy34; + goto yy18; } + yy22: + yych = *++YYCURSOR; + if (yych == '+') goto yy36; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy37; goto yy18; - yy20: - ++YYCURSOR; - if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); - yych = *YYCURSOR; - if (yybm[0+yych] & 128) { - goto yy20; - } + yy23: + yych = *++YYCURSOR; + if (yych == '+') goto yy39; if (yych <= '/') goto yy18; - if (yych >= ';') goto yy18; + if (yych <= '9') goto yy40; + goto yy18; + yy24: yych = *++YYCURSOR; - if (yych != '"') goto yy18; - ++YYCURSOR; - #line 733 "ext/standard/var_unserializer.re" - { - size_t len, len2, len3, maxlen; - zend_long elements; - char *str; - zend_string *class_name; - zend_class_entry *ce; - int incomplete_class = 0; - - int custom_object = 0; - - zval user_func; - zval retval; - zval args[1]; - - if (!var_hash) return 0; - if (*start == 'C') { - custom_object = 1; - } - - len2 = len = parse_uiv(start + 2); - maxlen = max - YYCURSOR; - if (maxlen < len || len == 0) { - *p = start + 2; - return 0; - } - - str = (char*)YYCURSOR; - - YYCURSOR += len; - - if (*(YYCURSOR) != '"') { - *p = YYCURSOR; - return 0; - } - if (*(YYCURSOR+1) != ':') { - *p = YYCURSOR+1; - return 0; - } - - len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); - if (len3 != len) - { - *p = YYCURSOR + len3 - len; - return 0; - } - - class_name = zend_string_init(str, len, 0); - - do { - if(!unserialize_allowed_class(class_name, classes)) { - incomplete_class = 1; - ce = PHP_IC_ENTRY; - break; - } - - /* Try to find class directly */ - BG(serialize_lock)++; - ce = zend_lookup_class(class_name); - if (ce) { - BG(serialize_lock)--; - if (EG(exception)) { - zend_string_release(class_name); - return 0; - } - break; - } - BG(serialize_lock)--; - - if (EG(exception)) { - zend_string_release(class_name); - return 0; - } - - /* Check for unserialize callback */ - if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) { - incomplete_class = 1; - ce = PHP_IC_ENTRY; - break; - } - - /* Call unserialize callback */ - ZVAL_STRING(&user_func, PG(unserialize_callback_func)); - - ZVAL_STR_COPY(&args[0], class_name); - BG(serialize_lock)++; - if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) { - BG(serialize_lock)--; - if (EG(exception)) { - zend_string_release(class_name); - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - return 0; - } - php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func)); - incomplete_class = 1; - ce = PHP_IC_ENTRY; - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - break; - } - BG(serialize_lock)--; - zval_ptr_dtor(&retval); - if (EG(exception)) { - zend_string_release(class_name); - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - return 0; - } - - /* The callback function may have defined the class */ - if ((ce = zend_lookup_class(class_name)) == NULL) { - php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); - incomplete_class = 1; - ce = PHP_IC_ENTRY; + if (yych <= '/') goto yy18; + if (yych <= '1') goto yy42; + goto yy18; + yy25: + yych = *++YYCURSOR; + if (yych <= '/') { + if (yych <= ',') { + if (yych == '+') goto yy43; + goto yy18; + } else { + if (yych <= '-') goto yy44; + if (yych <= '.') goto yy45; + goto yy18; } - - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - break; - } while (1); - - *p = YYCURSOR; - - if (custom_object) { - int ret; - - ret = object_custom(UNSERIALIZE_PASSTHRU, ce); - - if (ret && incomplete_class) { - php_store_class_name(rval, ZSTR_VAL(class_name), len2); + } else { + if (yych <= 'I') { + if (yych <= '9') goto yy46; + if (yych <= 'H') goto yy18; + goto yy48; + } else { + if (yych == 'N') goto yy49; + goto yy18; } - zend_string_release(class_name); - return ret; } - - elements = object_common1(UNSERIALIZE_PASSTHRU, ce); - - if (incomplete_class) { - php_store_class_name(rval, ZSTR_VAL(class_name), len2); + yy26: + yych = *++YYCURSOR; + if (yych <= ',') { + if (yych == '+') goto yy50; + goto yy18; + } else { + if (yych <= '-') goto yy50; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy51; + goto yy18; } - zend_string_release(class_name); - - return object_common2(UNSERIALIZE_PASSTHRU, elements); - } - #line 805 "ext/standard/var_unserializer.c" - yy25: + yy27: yych = *++YYCURSOR; if (yych <= ',') { - if (yych != '+') goto yy18; + if (yych == '+') goto yy53; + goto yy18; } else { - if (yych <= '-') goto yy26; + if (yych <= '-') goto yy53; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy27; + if (yych <= '9') goto yy54; goto yy18; } - yy26: + yy28: + yych = *++YYCURSOR; + if (yych <= ',') { + if (yych == '+') goto yy56; + goto yy18; + } else { + if (yych <= '-') goto yy56; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy57; + goto yy18; + } + yy29: yych = *++YYCURSOR; + if (yych == '+') goto yy59; if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - yy27: + if (yych <= '9') goto yy60; + goto yy18; + yy30: + yych = *++YYCURSOR; + if (yybm[0+yych] & 128) { + goto yy31; + } + goto yy18; + yy31: ++YYCURSOR; if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); yych = *YYCURSOR; @@@ -1091,69 -824,97 +881,101 @@@ yy50 yych = *++YYCURSOR; if (yych <= '/') goto yy18; if (yych >= ':') goto yy18; - yy61: + yy51: ++YYCURSOR; - if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4); + if (YYLIMIT <= YYCURSOR) YYFILL(1); yych = *YYCURSOR; - if (yych <= ';') { - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy61; - if (yych <= ':') goto yy18; - } else { - if (yych <= 'E') { - if (yych <= 'D') goto yy18; - goto yy65; - } else { - if (yych == 'e') goto yy65; - goto yy18; - } - } + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy51; + if (yych == ';') goto yy76; + goto yy18; + yy53: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy54: + ++YYCURSOR; + if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy54; + if (yych <= ':') goto yy78; + goto yy18; + yy56: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy57: + ++YYCURSOR; + if (YYLIMIT <= YYCURSOR) YYFILL(1); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy57; + if (yych == ';') goto yy79; + goto yy18; + yy59: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy60: + ++YYCURSOR; + if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy60; + if (yych <= ':') goto yy81; + goto yy18; + yy62: + yych = *++YYCURSOR; + if (yych == '"') goto yy82; + goto yy18; yy63: ++YYCURSOR; - #line 627 "ext/standard/var_unserializer.re" -#line 500 "ext/standard/var_unserializer.re" ++#line 558 "ext/standard/var_unserializer.re" { - #if SIZEOF_ZEND_LONG == 4 - use_double: - #endif - *p = YYCURSOR; - ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL)); - long id; ++ zend_long id; + + *p = YYCURSOR; + if (!var_hash) return 0; + + id = parse_iv(start + 2) - 1; - if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) { ++ if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { + return 0; + } + - if (*rval != NULL) { - var_push_dtor_no_addref(var_hash, rval); ++ zval_ptr_dtor(rval); ++ if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) { ++ ZVAL_UNDEF(rval); ++ return 1; ++ } ++ if (Z_ISREF_P(rval_ref)) { ++ ZVAL_COPY(rval, rval_ref); ++ } else { ++ ZVAL_NEW_REF(rval_ref, rval_ref); ++ ZVAL_COPY(rval, rval_ref); + } - *rval = *rval_ref; - Z_ADDREF_PP(rval); - Z_SET_ISREF_PP(rval); + return 1; } - #line 1087 "ext/standard/var_unserializer.c" -#line 899 "ext/standard/var_unserializer.c" ++#line 961 "ext/standard/var_unserializer.c" yy65: yych = *++YYCURSOR; - if (yych <= ',') { - if (yych != '+') goto yy18; - } else { - if (yych <= '-') goto yy66; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy67; - goto yy18; - } + if (yych == '"') goto yy84; + goto yy18; yy66: yych = *++YYCURSOR; - if (yych <= ',') { - if (yych == '+') goto yy69; - goto yy18; - } else { - if (yych <= '-') goto yy69; - if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - } + if (yych == '{') goto yy86; + goto yy18; yy67: ++YYCURSOR; - if (YYLIMIT <= YYCURSOR) YYFILL(1); - yych = *YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy67; - if (yych == ';') goto yy63; - goto yy18; -#line 551 "ext/standard/var_unserializer.re" ++#line 615 "ext/standard/var_unserializer.re" + { + *p = YYCURSOR; - INIT_PZVAL(*rval); - ZVAL_BOOL(*rval, parse_iv(start + 2)); ++ ZVAL_BOOL(rval, parse_iv(start + 2)); + return 1; + } -#line 917 "ext/standard/var_unserializer.c" ++#line 978 "ext/standard/var_unserializer.c" yy69: - yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy67; - goto yy18; - yy70: ++YYCURSOR; if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4); yych = *YYCURSOR; @@@ -1171,59 -931,43 +992,42 @@@ goto yy18; } } - yy72: - yych = *++YYCURSOR; - if (yych != 'F') goto yy18; - yy73: - yych = *++YYCURSOR; - if (yych != ';') goto yy18; + yy71: ++YYCURSOR; - #line 611 "ext/standard/var_unserializer.re" -#line 600 "ext/standard/var_unserializer.re" ++#line 663 "ext/standard/var_unserializer.re" { -#if SIZEOF_LONG == 4 ++#if SIZEOF_ZEND_LONG == 4 + use_double: + #endif *p = YYCURSOR; - - if (!strncmp((char*)start + 2, "NAN", 3)) { - ZVAL_DOUBLE(rval, php_get_nan()); - } else if (!strncmp((char*)start + 2, "INF", 3)) { - ZVAL_DOUBLE(rval, php_get_inf()); - } else if (!strncmp((char*)start + 2, "-INF", 4)) { - ZVAL_DOUBLE(rval, -php_get_inf()); - } else { - ZVAL_NULL(rval); - } - - INIT_PZVAL(*rval); - ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL)); ++ ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL)); return 1; } - #line 1162 "ext/standard/var_unserializer.c" - yy76: - yych = *++YYCURSOR; - if (yych == 'N') goto yy73; - goto yy18; - yy77: -#line 947 "ext/standard/var_unserializer.c" ++#line 1007 "ext/standard/var_unserializer.c" + yy73: yych = *++YYCURSOR; if (yych <= ',') { - if (yych != '+') goto yy18; + if (yych == '+') goto yy88; + goto yy18; } else { - if (yych <= '-') goto yy78; + if (yych <= '-') goto yy88; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy79; + if (yych <= '9') goto yy89; goto yy18; } - yy78: + yy74: yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - yy79: - ++YYCURSOR; - if (YYLIMIT <= YYCURSOR) YYFILL(1); - yych = *YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy79; - if (yych != ';') goto yy18; + if (yych == 'F') goto yy91; + goto yy18; + yy75: + yych = *++YYCURSOR; + if (yych == 'N') goto yy91; + goto yy18; + yy76: ++YYCURSOR; - #line 585 "ext/standard/var_unserializer.re" -#line 558 "ext/standard/var_unserializer.re" ++#line 621 "ext/standard/var_unserializer.re" { -#if SIZEOF_LONG == 4 +#if SIZEOF_ZEND_LONG == 4 int digits = YYCURSOR - start - 3; if (start[2] == '-' || start[2] == '+') { @@@ -1244,58 -988,20 +1048,19 @@@ } #endif *p = YYCURSOR; - INIT_PZVAL(*rval); - ZVAL_LONG(*rval, parse_iv(start + 2)); + ZVAL_LONG(rval, parse_iv(start + 2)); return 1; } - #line 1215 "ext/standard/var_unserializer.c" - yy83: - yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych >= '2') goto yy18; -#line 996 "ext/standard/var_unserializer.c" ++#line 1055 "ext/standard/var_unserializer.c" + yy78: yych = *++YYCURSOR; - if (yych != ';') goto yy18; - ++YYCURSOR; - #line 579 "ext/standard/var_unserializer.re" - { - *p = YYCURSOR; - ZVAL_BOOL(rval, parse_iv(start + 2)); - return 1; - } - #line 1229 "ext/standard/var_unserializer.c" - yy87: - ++YYCURSOR; - #line 573 "ext/standard/var_unserializer.re" - { - *p = YYCURSOR; - ZVAL_NULL(rval); - return 1; - } - #line 1238 "ext/standard/var_unserializer.c" - yy89: - yych = *++YYCURSOR; - if (yych <= ',') { - if (yych != '+') goto yy18; - } else { - if (yych <= '-') goto yy90; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy91; - goto yy18; - } - yy90: - yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - yy91: - ++YYCURSOR; - if (YYLIMIT <= YYCURSOR) YYFILL(1); - yych = *YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy91; - if (yych != ';') goto yy18; + if (yych == '"') goto yy92; + goto yy18; + yy79: ++YYCURSOR; - #line 548 "ext/standard/var_unserializer.re" -#line 521 "ext/standard/var_unserializer.re" ++#line 584 "ext/standard/var_unserializer.re" { - long id; + zend_long id; *p = YYCURSOR; if (!var_hash) return 0; @@@ -1318,11 -1022,230 +1083,230 @@@ return 1; } - #line 1286 "ext/standard/var_unserializer.c" - yy95: -#line 1026 "ext/standard/var_unserializer.c" ++#line 1087 "ext/standard/var_unserializer.c" + yy81: + yych = *++YYCURSOR; + if (yych == '"') goto yy94; + goto yy18; + yy82: + ++YYCURSOR; -#line 708 "ext/standard/var_unserializer.re" ++#line 769 "ext/standard/var_unserializer.re" + { + size_t len, len2, len3, maxlen; - long elements; - char *class_name; ++ zend_long elements; ++ char *str; ++ zend_string *class_name; + zend_class_entry *ce; - zend_class_entry **pce; + int incomplete_class = 0; + + int custom_object = 0; + - zval *user_func; - zval *retval_ptr; - zval **args[1]; - zval *arg_func_name; ++ zval user_func; ++ zval retval; ++ zval args[1]; + + if (!var_hash) return 0; + if (*start == 'C') { + custom_object = 1; + } + - INIT_PZVAL(*rval); + len2 = len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len || len == 0) { + *p = start + 2; + return 0; + } + - class_name = (char*)YYCURSOR; ++ str = (char*)YYCURSOR; + + YYCURSOR += len; + + if (*(YYCURSOR) != '"') { + *p = YYCURSOR; + return 0; + } + if (*(YYCURSOR+1) != ':') { + *p = YYCURSOR+1; + return 0; + } + - len3 = strspn(class_name, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); ++ len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); + if (len3 != len) + { + *p = YYCURSOR + len3 - len; + return 0; + } + - class_name = estrndup(class_name, len); ++ class_name = zend_string_init(str, len, 0); + + do { ++ if(!unserialize_allowed_class(class_name, classes)) { ++ incomplete_class = 1; ++ ce = PHP_IC_ENTRY; ++ break; ++ } ++ + /* Try to find class directly */ + BG(serialize_lock)++; - if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { ++ ce = zend_lookup_class(class_name); ++ if (ce) { + BG(serialize_lock)--; + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + return 0; + } - ce = *pce; + break; + } + BG(serialize_lock)--; + + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + return 0; + } + + /* Check for unserialize callback */ + if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) { + incomplete_class = 1; + ce = PHP_IC_ENTRY; + break; + } + + /* Call unserialize callback */ - MAKE_STD_ZVAL(user_func); - ZVAL_STRING(user_func, PG(unserialize_callback_func), 1); - args[0] = &arg_func_name; - MAKE_STD_ZVAL(arg_func_name); - ZVAL_STRING(arg_func_name, class_name, 1); ++ ZVAL_STRING(&user_func, PG(unserialize_callback_func)); ++ ++ ZVAL_STR_COPY(&args[0], class_name); + BG(serialize_lock)++; - if (call_user_function_ex(CG(function_table), NULL, user_func, &retval_ptr, 1, args, 0, NULL TSRMLS_CC) != SUCCESS) { ++ if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) { + BG(serialize_lock)--; + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + return 0; + } - php_error_docref(NULL TSRMLS_CC, E_WARNING, "defined (%s) but not found", user_func->value.str.val); ++ php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func)); + incomplete_class = 1; + ce = PHP_IC_ENTRY; + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + break; + } + BG(serialize_lock)--; - if (retval_ptr) { - zval_ptr_dtor(&retval_ptr); - } ++ zval_ptr_dtor(&retval); + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + return 0; + } + + /* The callback function may have defined the class */ + BG(serialize_lock)++; - if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { - ce = *pce; - } else { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val); ++ if ((ce = zend_lookup_class(class_name)) == NULL) { ++ php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); + incomplete_class = 1; + ce = PHP_IC_ENTRY; + } + BG(serialize_lock)--; + + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + break; + } while (1); + + *p = YYCURSOR; + + if (custom_object) { + int ret; + + ret = object_custom(UNSERIALIZE_PASSTHRU, ce); + + if (ret && incomplete_class) { - php_store_class_name(*rval, class_name, len2); ++ php_store_class_name(rval, ZSTR_VAL(class_name), len2); + } - efree(class_name); ++ zend_string_release(class_name); + return ret; + } + + elements = object_common1(UNSERIALIZE_PASSTHRU, ce); + + if (incomplete_class) { - php_store_class_name(*rval, class_name, len2); ++ php_store_class_name(rval, ZSTR_VAL(class_name), len2); + } - efree(class_name); ++ zend_string_release(class_name); + + return object_common2(UNSERIALIZE_PASSTHRU, elements); + } -#line 1182 "ext/standard/var_unserializer.c" ++#line 1241 "ext/standard/var_unserializer.c" + yy84: + ++YYCURSOR; -#line 643 "ext/standard/var_unserializer.re" ++#line 704 "ext/standard/var_unserializer.re" + { + size_t len, maxlen; - char *str; ++ zend_string *str; + + len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len) { + *p = start + 2; + return 0; + } + - if ((str = unserialize_str(&YYCURSOR, &len, maxlen)) == NULL) { ++ if ((str = unserialize_str(&YYCURSOR, len, maxlen)) == NULL) { + return 0; + } + + if (*(YYCURSOR) != '"') { - efree(str); ++ zend_string_free(str); + *p = YYCURSOR; + return 0; + } + + if (*(YYCURSOR + 1) != ';') { + efree(str); + *p = YYCURSOR + 1; + return 0; + } + + YYCURSOR += 2; + *p = YYCURSOR; + - INIT_PZVAL(*rval); - ZVAL_STRINGL(*rval, str, len, 0); ++ ZVAL_STR(rval, str); + return 1; + } -#line 1220 "ext/standard/var_unserializer.c" ++#line 1278 "ext/standard/var_unserializer.c" + yy86: + ++YYCURSOR; -#line 678 "ext/standard/var_unserializer.re" ++#line 738 "ext/standard/var_unserializer.re" + { - long elements = parse_iv(start + 2); ++ zend_long elements = parse_iv(start + 2); + /* use iv() not uiv() in order to check data range */ + *p = YYCURSOR; + if (!var_hash) return 0; + + if (elements < 0) { + return 0; + } + - INIT_PZVAL(*rval); - - array_init_size(*rval, elements); ++ array_init_size(rval, elements); ++ if (elements) { ++ /* we can't convert from packed to hash during unserialization, because ++ reference to some zvals might be keept in var_hash (to support references) */ ++ zend_hash_real_init(Z_ARRVAL_P(rval), 0); ++ } + - if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_PP(rval), elements, 0)) { ++ if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) { + return 0; + } + + return finish_nested_data(UNSERIALIZE_PASSTHRU); + } -#line 1244 "ext/standard/var_unserializer.c" ++#line 1305 "ext/standard/var_unserializer.c" + yy88: yych = *++YYCURSOR; if (yych <= ',') { - if (yych != '+') goto yy18; + if (yych == '+') goto yy96; + goto yy18; } else { if (yych <= '-') goto yy96; if (yych <= '/') goto yy18; @@@ -1338,38 -1256,86 +1317,84 @@@ yy89 if (YYLIMIT <= YYCURSOR) YYFILL(1); yych = *YYCURSOR; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy97; - if (yych != ';') goto yy18; + if (yych <= '9') goto yy89; + if (yych == ';') goto yy71; + goto yy18; + yy91: + yych = *++YYCURSOR; + if (yych == ';') goto yy97; + goto yy18; + yy92: ++YYCURSOR; - #line 522 "ext/standard/var_unserializer.re" -#line 699 "ext/standard/var_unserializer.re" ++#line 762 "ext/standard/var_unserializer.re" { - zend_long id; + if (!var_hash) return 0; - *p = YYCURSOR; - if (!var_hash) return 0; - INIT_PZVAL(*rval); - + return object_common2(UNSERIALIZE_PASSTHRU, + object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); + } -#line 1278 "ext/standard/var_unserializer.c" ++#line 1337 "ext/standard/var_unserializer.c" + yy94: + ++YYCURSOR; -#line 610 "ext/standard/var_unserializer.re" ++#line 672 "ext/standard/var_unserializer.re" + { + size_t len, maxlen; + char *str; - id = parse_iv(start + 2) - 1; - if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { + len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len) { + *p = start + 2; return 0; } - zval_ptr_dtor(rval); - if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) { - ZVAL_UNDEF(rval); - return 1; + str = (char*)YYCURSOR; + + YYCURSOR += len; + + if (*(YYCURSOR) != '"') { + *p = YYCURSOR; + return 0; } - if (Z_ISREF_P(rval_ref)) { - ZVAL_COPY(rval, rval_ref); + + if (*(YYCURSOR + 1) != ';') { + *p = YYCURSOR + 1; + return 0; + } + + YYCURSOR += 2; + *p = YYCURSOR; + - INIT_PZVAL(*rval); - ZVAL_STRINGL(*rval, str, len, 1); ++ ZVAL_STRINGL(rval, str, len); + return 1; + } -#line 1314 "ext/standard/var_unserializer.c" ++#line 1372 "ext/standard/var_unserializer.c" + yy96: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy89; + goto yy18; + yy97: + ++YYCURSOR; -#line 585 "ext/standard/var_unserializer.re" ++#line 647 "ext/standard/var_unserializer.re" + { + *p = YYCURSOR; - INIT_PZVAL(*rval); + - if (!strncmp(start + 2, "NAN", 3)) { - ZVAL_DOUBLE(*rval, php_get_nan()); - } else if (!strncmp(start + 2, "INF", 3)) { - ZVAL_DOUBLE(*rval, php_get_inf()); - } else if (!strncmp(start + 2, "-INF", 4)) { - ZVAL_DOUBLE(*rval, -php_get_inf()); ++ if (!strncmp((char*)start + 2, "NAN", 3)) { ++ ZVAL_DOUBLE(rval, php_get_nan()); ++ } else if (!strncmp((char*)start + 2, "INF", 3)) { ++ ZVAL_DOUBLE(rval, php_get_inf()); ++ } else if (!strncmp((char*)start + 2, "-INF", 4)) { ++ ZVAL_DOUBLE(rval, -php_get_inf()); + } else { - ZVAL_NEW_REF(rval_ref, rval_ref); - ZVAL_COPY(rval, rval_ref); ++ ZVAL_NULL(rval); } return 1; } - #line 1335 "ext/standard/var_unserializer.c" -#line 1337 "ext/standard/var_unserializer.c" ++#line 1396 "ext/standard/var_unserializer.c" } - #line 886 "ext/standard/var_unserializer.re" -#line 865 "ext/standard/var_unserializer.re" ++#line 924 "ext/standard/var_unserializer.re" return 0; diff --cc ext/standard/var_unserializer.re index 9051894,9eeba79..978f401 --- a/ext/standard/var_unserializer.re +++ b/ext/standard/var_unserializer.re @@@ -876,14 -815,18 +876,16 @@@ object ":" uiv ":" ["] } /* The callback function may have defined the class */ + BG(serialize_lock)++; - if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { - ce = *pce; - } else { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val); + if ((ce = zend_lookup_class(class_name)) == NULL) { + php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); incomplete_class = 1; ce = PHP_IC_ENTRY; } + BG(serialize_lock)--; zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); + zval_ptr_dtor(&args[0]); break; } while (1);
diff --cc NEWS index 90c68e2,0bb1e67..649fda3 --- a/NEWS +++ b/NEWS @@@ -43,33 -14,14 +43,36 @@@ PH set). (cmb) - Standard: - . Fixed bug #73594 (dns_get_record does not populate $additional out parameter). - (Bruce Weirdan) ++ . Fixed bug #73594 (dns_get_record does not populate $additional out ++ parameter). (Bruce Weirdan) + . Fixed bug #70213 (Unserialize context shared on double class lookup). + (Taoguang Chen) + -08 Dec 2016, PHP 5.6.29 -- Mbstring: - . Fixed bug #73505 (string length overflow in mbfl_memory_device_output - function). (Stas) +- Zlib: + . Fixed bug #73373 (deflate_add does not verify that output was not truncated). + (Matt Bonneau) + +08 Dec 2016 PHP 7.0.14 + +- Core: + . Fixed memory leak(null coalescing operator with Spl hash). (Tyson Andre) + . Fixded bug #72736 (Slow performance when fetching large dataset with mysqli + / PDO). (Dmitry) + +- Calendar: + . Fix integer overflows (Joshua Rogers) + +- Date: + . Fixed bug #69587 (DateInterval properties and isset). (jhdxr) + +- DTrace: + . Disabled PHP call tracing by default (it makes significant overhead). + This may be enabled again using envirionment variable USE_ZEND_DTRACE=1. + (Dmitry) + +- JSON: + . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka) - Mysqlnd: . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb) diff --cc ext/standard/var_unserializer.c index 6b33d84,584e98e..d1eb7b4 --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@@ -592,30 -533,29 +591,29 @@@ static int php_var_unserialize_internal yych = *YYCURSOR; switch (yych) { case 'C': - case 'O': goto yy13; + case 'O': goto yy4; case 'N': goto yy5; - case 'R': goto yy2; - case 'S': goto yy10; - case 'a': goto yy11; - case 'b': goto yy6; - case 'd': goto yy8; - case 'i': goto yy7; + case 'R': goto yy6; + case 'S': goto yy7; + case 'a': goto yy8; + case 'b': goto yy9; + case 'd': goto yy10; + case 'i': goto yy11; case 'o': goto yy12; - case 'r': goto yy4; - case 's': goto yy9; - case '}': goto yy14; - default: goto yy16; + case 'r': goto yy13; + case 's': goto yy14; + case '}': goto yy15; + default: goto yy2; } yy2: - yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy95; + ++YYCURSOR; yy3: - #line 884 "ext/standard/var_unserializer.re" -#line 863 "ext/standard/var_unserializer.re" ++#line 922 "ext/standard/var_unserializer.re" { return 0; } - #line 580 "ext/standard/var_unserializer.c" -#line 556 "ext/standard/var_unserializer.c" ++#line 614 "ext/standard/var_unserializer.c" yy4: yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy89; + if (yych == ':') goto yy17; goto yy3; yy5: yych = *++YYCURSOR; @@@ -651,20 -591,21 +649,21 @@@ yy12 goto yy3; yy13: yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy17; + if (yych == ':') goto yy28; goto yy3; yy14: + yych = *(YYMARKER = ++YYCURSOR); + if (yych == ':') goto yy29; + goto yy3; + yy15: ++YYCURSOR; - #line 878 "ext/standard/var_unserializer.re" -#line 857 "ext/standard/var_unserializer.re" ++#line 916 "ext/standard/var_unserializer.re" { /* this is the case where we have less data than planned */ - php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); + php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } - #line 629 "ext/standard/var_unserializer.c" - yy16: - yych = *++YYCURSOR; - goto yy3; -#line 609 "ext/standard/var_unserializer.c" ++#line 667 "ext/standard/var_unserializer.c" yy17: yych = *++YYCURSOR; if (yybm[0+yych] & 128) { @@@ -675,184 -616,110 +674,109 @@@ yy18 YYCURSOR = YYMARKER; goto yy3; yy19: + ++YYCURSOR; -#line 544 "ext/standard/var_unserializer.re" ++#line 609 "ext/standard/var_unserializer.re" + { + *p = YYCURSOR; - INIT_PZVAL(*rval); - ZVAL_NULL(*rval); ++ ZVAL_NULL(rval); + return 1; + } -#line 628 "ext/standard/var_unserializer.c" ++#line 685 "ext/standard/var_unserializer.c" + yy21: yych = *++YYCURSOR; - if (yybm[0+yych] & 128) { - goto yy20; + if (yych <= ',') { + if (yych == '+') goto yy33; + goto yy18; + } else { + if (yych <= '-') goto yy33; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy34; + goto yy18; } + yy22: + yych = *++YYCURSOR; + if (yych == '+') goto yy36; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy37; goto yy18; - yy20: - ++YYCURSOR; - if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); - yych = *YYCURSOR; - if (yybm[0+yych] & 128) { - goto yy20; - } + yy23: + yych = *++YYCURSOR; + if (yych == '+') goto yy39; if (yych <= '/') goto yy18; - if (yych >= ';') goto yy18; + if (yych <= '9') goto yy40; + goto yy18; + yy24: yych = *++YYCURSOR; - if (yych != '"') goto yy18; - ++YYCURSOR; - #line 733 "ext/standard/var_unserializer.re" - { - size_t len, len2, len3, maxlen; - zend_long elements; - char *str; - zend_string *class_name; - zend_class_entry *ce; - int incomplete_class = 0; - - int custom_object = 0; - - zval user_func; - zval retval; - zval args[1]; - - if (!var_hash) return 0; - if (*start == 'C') { - custom_object = 1; - } - - len2 = len = parse_uiv(start + 2); - maxlen = max - YYCURSOR; - if (maxlen < len || len == 0) { - *p = start + 2; - return 0; - } - - str = (char*)YYCURSOR; - - YYCURSOR += len; - - if (*(YYCURSOR) != '"') { - *p = YYCURSOR; - return 0; - } - if (*(YYCURSOR+1) != ':') { - *p = YYCURSOR+1; - return 0; - } - - len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); - if (len3 != len) - { - *p = YYCURSOR + len3 - len; - return 0; - } - - class_name = zend_string_init(str, len, 0); - - do { - if(!unserialize_allowed_class(class_name, classes)) { - incomplete_class = 1; - ce = PHP_IC_ENTRY; - break; - } - - /* Try to find class directly */ - BG(serialize_lock)++; - ce = zend_lookup_class(class_name); - if (ce) { - BG(serialize_lock)--; - if (EG(exception)) { - zend_string_release(class_name); - return 0; - } - break; - } - BG(serialize_lock)--; - - if (EG(exception)) { - zend_string_release(class_name); - return 0; - } - - /* Check for unserialize callback */ - if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) { - incomplete_class = 1; - ce = PHP_IC_ENTRY; - break; - } - - /* Call unserialize callback */ - ZVAL_STRING(&user_func, PG(unserialize_callback_func)); - - ZVAL_STR_COPY(&args[0], class_name); - BG(serialize_lock)++; - if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) { - BG(serialize_lock)--; - if (EG(exception)) { - zend_string_release(class_name); - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - return 0; - } - php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func)); - incomplete_class = 1; - ce = PHP_IC_ENTRY; - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - break; - } - BG(serialize_lock)--; - zval_ptr_dtor(&retval); - if (EG(exception)) { - zend_string_release(class_name); - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - return 0; - } - - /* The callback function may have defined the class */ - if ((ce = zend_lookup_class(class_name)) == NULL) { - php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); - incomplete_class = 1; - ce = PHP_IC_ENTRY; + if (yych <= '/') goto yy18; + if (yych <= '1') goto yy42; + goto yy18; + yy25: + yych = *++YYCURSOR; + if (yych <= '/') { + if (yych <= ',') { + if (yych == '+') goto yy43; + goto yy18; + } else { + if (yych <= '-') goto yy44; + if (yych <= '.') goto yy45; + goto yy18; } - - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - break; - } while (1); - - *p = YYCURSOR; - - if (custom_object) { - int ret; - - ret = object_custom(UNSERIALIZE_PASSTHRU, ce); - - if (ret && incomplete_class) { - php_store_class_name(rval, ZSTR_VAL(class_name), len2); + } else { + if (yych <= 'I') { + if (yych <= '9') goto yy46; + if (yych <= 'H') goto yy18; + goto yy48; + } else { + if (yych == 'N') goto yy49; + goto yy18; } - zend_string_release(class_name); - return ret; } - - elements = object_common1(UNSERIALIZE_PASSTHRU, ce); - - if (incomplete_class) { - php_store_class_name(rval, ZSTR_VAL(class_name), len2); + yy26: + yych = *++YYCURSOR; + if (yych <= ',') { + if (yych == '+') goto yy50; + goto yy18; + } else { + if (yych <= '-') goto yy50; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy51; + goto yy18; } - zend_string_release(class_name); - - return object_common2(UNSERIALIZE_PASSTHRU, elements); - } - #line 805 "ext/standard/var_unserializer.c" - yy25: + yy27: yych = *++YYCURSOR; if (yych <= ',') { - if (yych != '+') goto yy18; + if (yych == '+') goto yy53; + goto yy18; } else { - if (yych <= '-') goto yy26; + if (yych <= '-') goto yy53; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy27; + if (yych <= '9') goto yy54; goto yy18; } - yy26: + yy28: + yych = *++YYCURSOR; + if (yych <= ',') { + if (yych == '+') goto yy56; + goto yy18; + } else { + if (yych <= '-') goto yy56; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy57; + goto yy18; + } + yy29: yych = *++YYCURSOR; + if (yych == '+') goto yy59; if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - yy27: + if (yych <= '9') goto yy60; + goto yy18; + yy30: + yych = *++YYCURSOR; + if (yybm[0+yych] & 128) { + goto yy31; + } + goto yy18; + yy31: ++YYCURSOR; if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); yych = *YYCURSOR; @@@ -1091,69 -824,97 +881,101 @@@ yy50 yych = *++YYCURSOR; if (yych <= '/') goto yy18; if (yych >= ':') goto yy18; - yy61: + yy51: ++YYCURSOR; - if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4); + if (YYLIMIT <= YYCURSOR) YYFILL(1); yych = *YYCURSOR; - if (yych <= ';') { - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy61; - if (yych <= ':') goto yy18; - } else { - if (yych <= 'E') { - if (yych <= 'D') goto yy18; - goto yy65; - } else { - if (yych == 'e') goto yy65; - goto yy18; - } - } + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy51; + if (yych == ';') goto yy76; + goto yy18; + yy53: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy54: + ++YYCURSOR; + if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy54; + if (yych <= ':') goto yy78; + goto yy18; + yy56: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy57: + ++YYCURSOR; + if (YYLIMIT <= YYCURSOR) YYFILL(1); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy57; + if (yych == ';') goto yy79; + goto yy18; + yy59: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy60: + ++YYCURSOR; + if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy60; + if (yych <= ':') goto yy81; + goto yy18; + yy62: + yych = *++YYCURSOR; + if (yych == '"') goto yy82; + goto yy18; yy63: ++YYCURSOR; - #line 627 "ext/standard/var_unserializer.re" -#line 500 "ext/standard/var_unserializer.re" ++#line 558 "ext/standard/var_unserializer.re" { - #if SIZEOF_ZEND_LONG == 4 - use_double: - #endif - *p = YYCURSOR; - ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL)); - long id; ++ zend_long id; + + *p = YYCURSOR; + if (!var_hash) return 0; + + id = parse_iv(start + 2) - 1; - if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) { ++ if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { + return 0; + } + - if (*rval != NULL) { - var_push_dtor_no_addref(var_hash, rval); ++ zval_ptr_dtor(rval); ++ if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) { ++ ZVAL_UNDEF(rval); ++ return 1; ++ } ++ if (Z_ISREF_P(rval_ref)) { ++ ZVAL_COPY(rval, rval_ref); ++ } else { ++ ZVAL_NEW_REF(rval_ref, rval_ref); ++ ZVAL_COPY(rval, rval_ref); + } - *rval = *rval_ref; - Z_ADDREF_PP(rval); - Z_SET_ISREF_PP(rval); + return 1; } - #line 1087 "ext/standard/var_unserializer.c" -#line 899 "ext/standard/var_unserializer.c" ++#line 961 "ext/standard/var_unserializer.c" yy65: yych = *++YYCURSOR; - if (yych <= ',') { - if (yych != '+') goto yy18; - } else { - if (yych <= '-') goto yy66; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy67; - goto yy18; - } + if (yych == '"') goto yy84; + goto yy18; yy66: yych = *++YYCURSOR; - if (yych <= ',') { - if (yych == '+') goto yy69; - goto yy18; - } else { - if (yych <= '-') goto yy69; - if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - } + if (yych == '{') goto yy86; + goto yy18; yy67: ++YYCURSOR; - if (YYLIMIT <= YYCURSOR) YYFILL(1); - yych = *YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy67; - if (yych == ';') goto yy63; - goto yy18; -#line 551 "ext/standard/var_unserializer.re" ++#line 615 "ext/standard/var_unserializer.re" + { + *p = YYCURSOR; - INIT_PZVAL(*rval); - ZVAL_BOOL(*rval, parse_iv(start + 2)); ++ ZVAL_BOOL(rval, parse_iv(start + 2)); + return 1; + } -#line 917 "ext/standard/var_unserializer.c" ++#line 978 "ext/standard/var_unserializer.c" yy69: - yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy67; - goto yy18; - yy70: ++YYCURSOR; if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4); yych = *YYCURSOR; @@@ -1171,59 -931,43 +992,42 @@@ goto yy18; } } - yy72: - yych = *++YYCURSOR; - if (yych != 'F') goto yy18; - yy73: - yych = *++YYCURSOR; - if (yych != ';') goto yy18; + yy71: ++YYCURSOR; - #line 611 "ext/standard/var_unserializer.re" -#line 600 "ext/standard/var_unserializer.re" ++#line 663 "ext/standard/var_unserializer.re" { -#if SIZEOF_LONG == 4 ++#if SIZEOF_ZEND_LONG == 4 + use_double: + #endif *p = YYCURSOR; - - if (!strncmp((char*)start + 2, "NAN", 3)) { - ZVAL_DOUBLE(rval, php_get_nan()); - } else if (!strncmp((char*)start + 2, "INF", 3)) { - ZVAL_DOUBLE(rval, php_get_inf()); - } else if (!strncmp((char*)start + 2, "-INF", 4)) { - ZVAL_DOUBLE(rval, -php_get_inf()); - } else { - ZVAL_NULL(rval); - } - - INIT_PZVAL(*rval); - ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL)); ++ ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL)); return 1; } - #line 1162 "ext/standard/var_unserializer.c" - yy76: - yych = *++YYCURSOR; - if (yych == 'N') goto yy73; - goto yy18; - yy77: -#line 947 "ext/standard/var_unserializer.c" ++#line 1007 "ext/standard/var_unserializer.c" + yy73: yych = *++YYCURSOR; if (yych <= ',') { - if (yych != '+') goto yy18; + if (yych == '+') goto yy88; + goto yy18; } else { - if (yych <= '-') goto yy78; + if (yych <= '-') goto yy88; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy79; + if (yych <= '9') goto yy89; goto yy18; } - yy78: + yy74: yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - yy79: - ++YYCURSOR; - if (YYLIMIT <= YYCURSOR) YYFILL(1); - yych = *YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy79; - if (yych != ';') goto yy18; + if (yych == 'F') goto yy91; + goto yy18; + yy75: + yych = *++YYCURSOR; + if (yych == 'N') goto yy91; + goto yy18; + yy76: ++YYCURSOR; - #line 585 "ext/standard/var_unserializer.re" -#line 558 "ext/standard/var_unserializer.re" ++#line 621 "ext/standard/var_unserializer.re" { -#if SIZEOF_LONG == 4 +#if SIZEOF_ZEND_LONG == 4 int digits = YYCURSOR - start - 3; if (start[2] == '-' || start[2] == '+') { @@@ -1244,58 -988,20 +1048,19 @@@ } #endif *p = YYCURSOR; - INIT_PZVAL(*rval); - ZVAL_LONG(*rval, parse_iv(start + 2)); + ZVAL_LONG(rval, parse_iv(start + 2)); return 1; } - #line 1215 "ext/standard/var_unserializer.c" - yy83: - yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych >= '2') goto yy18; -#line 996 "ext/standard/var_unserializer.c" ++#line 1055 "ext/standard/var_unserializer.c" + yy78: yych = *++YYCURSOR; - if (yych != ';') goto yy18; - ++YYCURSOR; - #line 579 "ext/standard/var_unserializer.re" - { - *p = YYCURSOR; - ZVAL_BOOL(rval, parse_iv(start + 2)); - return 1; - } - #line 1229 "ext/standard/var_unserializer.c" - yy87: - ++YYCURSOR; - #line 573 "ext/standard/var_unserializer.re" - { - *p = YYCURSOR; - ZVAL_NULL(rval); - return 1; - } - #line 1238 "ext/standard/var_unserializer.c" - yy89: - yych = *++YYCURSOR; - if (yych <= ',') { - if (yych != '+') goto yy18; - } else { - if (yych <= '-') goto yy90; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy91; - goto yy18; - } - yy90: - yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych >= ':') goto yy18; - yy91: - ++YYCURSOR; - if (YYLIMIT <= YYCURSOR) YYFILL(1); - yych = *YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy91; - if (yych != ';') goto yy18; + if (yych == '"') goto yy92; + goto yy18; + yy79: ++YYCURSOR; - #line 548 "ext/standard/var_unserializer.re" -#line 521 "ext/standard/var_unserializer.re" ++#line 584 "ext/standard/var_unserializer.re" { - long id; + zend_long id; *p = YYCURSOR; if (!var_hash) return 0; @@@ -1318,11 -1022,230 +1083,230 @@@ return 1; } - #line 1286 "ext/standard/var_unserializer.c" - yy95: -#line 1026 "ext/standard/var_unserializer.c" ++#line 1087 "ext/standard/var_unserializer.c" + yy81: + yych = *++YYCURSOR; + if (yych == '"') goto yy94; + goto yy18; + yy82: + ++YYCURSOR; -#line 708 "ext/standard/var_unserializer.re" ++#line 769 "ext/standard/var_unserializer.re" + { + size_t len, len2, len3, maxlen; - long elements; - char *class_name; ++ zend_long elements; ++ char *str; ++ zend_string *class_name; + zend_class_entry *ce; - zend_class_entry **pce; + int incomplete_class = 0; + + int custom_object = 0; + - zval *user_func; - zval *retval_ptr; - zval **args[1]; - zval *arg_func_name; ++ zval user_func; ++ zval retval; ++ zval args[1]; + + if (!var_hash) return 0; + if (*start == 'C') { + custom_object = 1; + } + - INIT_PZVAL(*rval); + len2 = len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len || len == 0) { + *p = start + 2; + return 0; + } + - class_name = (char*)YYCURSOR; ++ str = (char*)YYCURSOR; + + YYCURSOR += len; + + if (*(YYCURSOR) != '"') { + *p = YYCURSOR; + return 0; + } + if (*(YYCURSOR+1) != ':') { + *p = YYCURSOR+1; + return 0; + } + - len3 = strspn(class_name, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); ++ len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); + if (len3 != len) + { + *p = YYCURSOR + len3 - len; + return 0; + } + - class_name = estrndup(class_name, len); ++ class_name = zend_string_init(str, len, 0); + + do { ++ if(!unserialize_allowed_class(class_name, classes)) { ++ incomplete_class = 1; ++ ce = PHP_IC_ENTRY; ++ break; ++ } ++ + /* Try to find class directly */ + BG(serialize_lock)++; - if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { ++ ce = zend_lookup_class(class_name); ++ if (ce) { + BG(serialize_lock)--; + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + return 0; + } - ce = *pce; + break; + } + BG(serialize_lock)--; + + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + return 0; + } + + /* Check for unserialize callback */ + if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) { + incomplete_class = 1; + ce = PHP_IC_ENTRY; + break; + } + + /* Call unserialize callback */ - MAKE_STD_ZVAL(user_func); - ZVAL_STRING(user_func, PG(unserialize_callback_func), 1); - args[0] = &arg_func_name; - MAKE_STD_ZVAL(arg_func_name); - ZVAL_STRING(arg_func_name, class_name, 1); ++ ZVAL_STRING(&user_func, PG(unserialize_callback_func)); ++ ++ ZVAL_STR_COPY(&args[0], class_name); + BG(serialize_lock)++; - if (call_user_function_ex(CG(function_table), NULL, user_func, &retval_ptr, 1, args, 0, NULL TSRMLS_CC) != SUCCESS) { ++ if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) { + BG(serialize_lock)--; + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + return 0; + } - php_error_docref(NULL TSRMLS_CC, E_WARNING, "defined (%s) but not found", user_func->value.str.val); ++ php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func)); + incomplete_class = 1; + ce = PHP_IC_ENTRY; + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + break; + } + BG(serialize_lock)--; - if (retval_ptr) { - zval_ptr_dtor(&retval_ptr); - } ++ zval_ptr_dtor(&retval); + if (EG(exception)) { - efree(class_name); ++ zend_string_release(class_name); + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + return 0; + } + + /* The callback function may have defined the class */ + BG(serialize_lock)++; - if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { - ce = *pce; - } else { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val); ++ if ((ce = zend_lookup_class(class_name)) == NULL) { ++ php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); + incomplete_class = 1; + ce = PHP_IC_ENTRY; + } + BG(serialize_lock)--; + + zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); ++ zval_ptr_dtor(&args[0]); + break; + } while (1); + + *p = YYCURSOR; + + if (custom_object) { + int ret; + + ret = object_custom(UNSERIALIZE_PASSTHRU, ce); + + if (ret && incomplete_class) { - php_store_class_name(*rval, class_name, len2); ++ php_store_class_name(rval, ZSTR_VAL(class_name), len2); + } - efree(class_name); ++ zend_string_release(class_name); + return ret; + } + + elements = object_common1(UNSERIALIZE_PASSTHRU, ce); + + if (incomplete_class) { - php_store_class_name(*rval, class_name, len2); ++ php_store_class_name(rval, ZSTR_VAL(class_name), len2); + } - efree(class_name); ++ zend_string_release(class_name); + + return object_common2(UNSERIALIZE_PASSTHRU, elements); + } -#line 1182 "ext/standard/var_unserializer.c" ++#line 1241 "ext/standard/var_unserializer.c" + yy84: + ++YYCURSOR; -#line 643 "ext/standard/var_unserializer.re" ++#line 704 "ext/standard/var_unserializer.re" + { + size_t len, maxlen; - char *str; ++ zend_string *str; + + len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len) { + *p = start + 2; + return 0; + } + - if ((str = unserialize_str(&YYCURSOR, &len, maxlen)) == NULL) { ++ if ((str = unserialize_str(&YYCURSOR, len, maxlen)) == NULL) { + return 0; + } + + if (*(YYCURSOR) != '"') { - efree(str); ++ zend_string_free(str); + *p = YYCURSOR; + return 0; + } + + if (*(YYCURSOR + 1) != ';') { + efree(str); + *p = YYCURSOR + 1; + return 0; + } + + YYCURSOR += 2; + *p = YYCURSOR; + - INIT_PZVAL(*rval); - ZVAL_STRINGL(*rval, str, len, 0); ++ ZVAL_STR(rval, str); + return 1; + } -#line 1220 "ext/standard/var_unserializer.c" ++#line 1278 "ext/standard/var_unserializer.c" + yy86: + ++YYCURSOR; -#line 678 "ext/standard/var_unserializer.re" ++#line 738 "ext/standard/var_unserializer.re" + { - long elements = parse_iv(start + 2); ++ zend_long elements = parse_iv(start + 2); + /* use iv() not uiv() in order to check data range */ + *p = YYCURSOR; + if (!var_hash) return 0; + + if (elements < 0) { + return 0; + } + - INIT_PZVAL(*rval); - - array_init_size(*rval, elements); ++ array_init_size(rval, elements); ++ if (elements) { ++ /* we can't convert from packed to hash during unserialization, because ++ reference to some zvals might be keept in var_hash (to support references) */ ++ zend_hash_real_init(Z_ARRVAL_P(rval), 0); ++ } + - if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_PP(rval), elements, 0)) { ++ if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) { + return 0; + } + + return finish_nested_data(UNSERIALIZE_PASSTHRU); + } -#line 1244 "ext/standard/var_unserializer.c" ++#line 1305 "ext/standard/var_unserializer.c" + yy88: yych = *++YYCURSOR; if (yych <= ',') { - if (yych != '+') goto yy18; + if (yych == '+') goto yy96; + goto yy18; } else { if (yych <= '-') goto yy96; if (yych <= '/') goto yy18; @@@ -1338,38 -1256,86 +1317,84 @@@ yy89 if (YYLIMIT <= YYCURSOR) YYFILL(1); yych = *YYCURSOR; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy97; - if (yych != ';') goto yy18; + if (yych <= '9') goto yy89; + if (yych == ';') goto yy71; + goto yy18; + yy91: + yych = *++YYCURSOR; + if (yych == ';') goto yy97; + goto yy18; + yy92: ++YYCURSOR; - #line 522 "ext/standard/var_unserializer.re" -#line 699 "ext/standard/var_unserializer.re" ++#line 762 "ext/standard/var_unserializer.re" { - zend_long id; + if (!var_hash) return 0; - *p = YYCURSOR; - if (!var_hash) return 0; - INIT_PZVAL(*rval); - + return object_common2(UNSERIALIZE_PASSTHRU, + object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); + } -#line 1278 "ext/standard/var_unserializer.c" ++#line 1337 "ext/standard/var_unserializer.c" + yy94: + ++YYCURSOR; -#line 610 "ext/standard/var_unserializer.re" ++#line 672 "ext/standard/var_unserializer.re" + { + size_t len, maxlen; + char *str; - id = parse_iv(start + 2) - 1; - if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { + len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len) { + *p = start + 2; return 0; } - zval_ptr_dtor(rval); - if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) { - ZVAL_UNDEF(rval); - return 1; + str = (char*)YYCURSOR; + + YYCURSOR += len; + + if (*(YYCURSOR) != '"') { + *p = YYCURSOR; + return 0; } - if (Z_ISREF_P(rval_ref)) { - ZVAL_COPY(rval, rval_ref); + + if (*(YYCURSOR + 1) != ';') { + *p = YYCURSOR + 1; + return 0; + } + + YYCURSOR += 2; + *p = YYCURSOR; + - INIT_PZVAL(*rval); - ZVAL_STRINGL(*rval, str, len, 1); ++ ZVAL_STRINGL(rval, str, len); + return 1; + } -#line 1314 "ext/standard/var_unserializer.c" ++#line 1372 "ext/standard/var_unserializer.c" + yy96: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy89; + goto yy18; + yy97: + ++YYCURSOR; -#line 585 "ext/standard/var_unserializer.re" ++#line 647 "ext/standard/var_unserializer.re" + { + *p = YYCURSOR; - INIT_PZVAL(*rval); + - if (!strncmp(start + 2, "NAN", 3)) { - ZVAL_DOUBLE(*rval, php_get_nan()); - } else if (!strncmp(start + 2, "INF", 3)) { - ZVAL_DOUBLE(*rval, php_get_inf()); - } else if (!strncmp(start + 2, "-INF", 4)) { - ZVAL_DOUBLE(*rval, -php_get_inf()); ++ if (!strncmp((char*)start + 2, "NAN", 3)) { ++ ZVAL_DOUBLE(rval, php_get_nan()); ++ } else if (!strncmp((char*)start + 2, "INF", 3)) { ++ ZVAL_DOUBLE(rval, php_get_inf()); ++ } else if (!strncmp((char*)start + 2, "-INF", 4)) { ++ ZVAL_DOUBLE(rval, -php_get_inf()); + } else { - ZVAL_NEW_REF(rval_ref, rval_ref); - ZVAL_COPY(rval, rval_ref); ++ ZVAL_NULL(rval); } return 1; } - #line 1335 "ext/standard/var_unserializer.c" -#line 1337 "ext/standard/var_unserializer.c" ++#line 1396 "ext/standard/var_unserializer.c" } - #line 886 "ext/standard/var_unserializer.re" -#line 865 "ext/standard/var_unserializer.re" ++#line 924 "ext/standard/var_unserializer.re" return 0; diff --cc ext/standard/var_unserializer.re index 9051894,9eeba79..978f401 --- a/ext/standard/var_unserializer.re +++ b/ext/standard/var_unserializer.re @@@ -876,14 -815,18 +876,16 @@@ object ":" uiv ":" ["] } /* The callback function may have defined the class */ + BG(serialize_lock)++; - if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { - ce = *pce; - } else { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val); + if ((ce = zend_lookup_class(class_name)) == NULL) { + php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); incomplete_class = 1; ce = PHP_IC_ENTRY; } + BG(serialize_lock)--; zval_ptr_dtor(&user_func); - zval_ptr_dtor(&arg_func_name); + zval_ptr_dtor(&args[0]); break; } while (1);