- MFH

2 files changed, 60 insertions, 52 deletions

diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index cdf6ca5c8a..f6173147a2 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -1,5 +1,5 @@
-/* Generated by re2c 0.9.4 on Tue Mar  1 23:56:03 2005 */
-#line 1 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+/* Generated by re2c 0.9.4 on Thu Mar 10 02:59:20 2005 */
+#line 1 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 /*
    +----------------------------------------------------------------------+
    | PHP Version 4                                                        |
@@ -29,7 +29,7 @@
 
 typedef struct {
 	zval *data[VAR_ENTRIES_MAX];
-	int used_slots;
+	long used_slots;
 	void *next;
 } var_entries;
 
@@ -82,7 +82,7 @@ static inline void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 
 PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **nzval)
 {
-	int i;
+	long i;
 	var_entries *var_hash = var_hashx->first;
 	
 	while (var_hash) {
@@ -96,7 +96,7 @@ PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **n
 	}
 }
 
-static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
+static int var_access(php_unserialize_data_t *var_hashx, long id, zval ***store)
 {
 	var_entries *var_hash = var_hashx->first;
 	
@@ -117,7 +117,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
 PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 {
 	void *next;
-	int i;
+	long i;
 	var_entries *var_hash = var_hashx->first;
 	
 	while (var_hash) {
@@ -147,7 +147,7 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 #define YYMARKER marker
 
 
-#line 154 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 154 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 
 
 
@@ -210,7 +210,7 @@ static inline size_t parse_uiv(const unsigned char *p)
 #define UNSERIALIZE_PARAMETER zval **rval, const unsigned char **p, const unsigned char *max, php_unserialize_data_t *var_hash TSRMLS_DC
 #define UNSERIALIZE_PASSTHRU rval, p, max, var_hash TSRMLS_CC
 
-static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, int elements)
+static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long elements)
 {
 	while (elements-- > 0) {
 		zval *key, *data, **old_data;
@@ -279,7 +279,7 @@ static inline int finish_nested_data(UNSERIALIZE_PARAMETER)
 
 static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
-	int elements;
+	long elements;
 
 	elements = parse_iv2((*p) + 2, p);
 
@@ -289,7 +289,7 @@ static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 	return elements;
 }
 
-static inline int object_common2(UNSERIALIZE_PARAMETER, int elements)
+static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
 {
 	zval *retval_ptr = NULL;
 	zval fname;
@@ -432,7 +432,7 @@ yy3:	yyaccept = 0;
 	if(yych == ':')	goto yy87;
 	goto yy4;
 yy4:
-#line 586 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 590 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 { return 0; }
 #line 102 "<stdout>"
 yy5:	yyaccept = 0;
@@ -473,7 +473,7 @@ yy13:	yyaccept = 0;
 yy14:	++YYCURSOR;
 	goto yy15;
 yy15:
-#line 580 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 584 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
@@ -502,10 +502,10 @@ yy21:	yych = *++YYCURSOR;
 yy22:	++YYCURSOR;
 	goto yy23;
 yy23:
-#line 491 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 495 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	size_t len, len2, len3, maxlen;
-	int elements;
+	long elements;
 	char *class_name;
 	zend_class_entry *ce;
 	int incomplete_class = 0;
@@ -620,7 +620,7 @@ yy28:	yych = *++YYCURSOR;
 yy29:	++YYCURSOR;
 	goto yy30;
 yy30:
-#line 483 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 487 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 
 	INIT_PZVAL(*rval);
@@ -652,16 +652,20 @@ yy35:	yych = *++YYCURSOR;
 yy36:	++YYCURSOR;
 	goto yy37;
 yy37:
-#line 461 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 461 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
-	int elements = parse_iv(start + 2);
-
+	long elements = parse_iv(start + 2);
+	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
 
 	if (elements < 0) {
 		return 0;
 	}
 
+	if (elements < 0) {
+		return 0;
+	}
+
 	INIT_PZVAL(*rval);
 	Z_TYPE_PP(rval) = IS_ARRAY;
 	ALLOC_HASHTABLE(Z_ARRVAL_PP(rval));
@@ -674,7 +678,7 @@ yy37:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 345 "<stdout>"
+#line 349 "<stdout>"
 yy38:	yych = *++YYCURSOR;
 	if(yych == '+')	goto yy39;
 	if(yych <= '/')	goto yy2;
@@ -698,7 +702,7 @@ yy42:	yych = *++YYCURSOR;
 yy43:	++YYCURSOR;
 	goto yy44;
 yy44:
-#line 433 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 433 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	size_t len, maxlen;
 	char *str;
@@ -726,7 +730,7 @@ yy44:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 398 "<stdout>"
+#line 402 "<stdout>"
 yy45:	yych = *++YYCURSOR;
 	if(yych <= '/'){
 		if(yych <= ','){
@@ -815,14 +819,14 @@ yy54:	if(yych <= ';'){
 yy55:	++YYCURSOR;
 	goto yy56;
 yy56:
-#line 426 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 426 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
-	ZVAL_DOUBLE(*rval, zend_strtod(start + 2, NULL));
+	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 496 "<stdout>"
+#line 500 "<stdout>"
 yy57:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
@@ -882,7 +886,7 @@ yy65:	yych = *++YYCURSOR;
 yy66:	++YYCURSOR;
 	goto yy67;
 yy67:
-#line 411 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 411 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -897,7 +901,7 @@ yy67:
 
 	return 1;
 }
-#line 573 "<stdout>"
+#line 577 "<stdout>"
 yy68:	yych = *++YYCURSOR;
 	if(yych == 'N')	goto yy65;
 	goto yy2;
@@ -926,14 +930,14 @@ yy72:	if(yych <= '/')	goto yy2;
 yy73:	++YYCURSOR;
 	goto yy74;
 yy74:
-#line 404 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 404 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 610 "<stdout>"
+#line 614 "<stdout>"
 yy75:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= '2')	goto yy2;
@@ -944,25 +948,25 @@ yy76:	yych = *++YYCURSOR;
 yy77:	++YYCURSOR;
 	goto yy78;
 yy78:
-#line 397 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 397 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 628 "<stdout>"
+#line 632 "<stdout>"
 yy79:	++YYCURSOR;
 	goto yy80;
 yy80:
-#line 390 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 390 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 639 "<stdout>"
+#line 643 "<stdout>"
 yy81:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
@@ -988,9 +992,9 @@ yy84:	if(yych <= '/')	goto yy2;
 yy85:	++YYCURSOR;
 	goto yy86;
 yy86:
-#line 367 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 367 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
-	int id;
+	long id;
 
  	*p = YYCURSOR;
 	if (!var_hash) return 0;
@@ -1011,7 +1015,7 @@ yy86:
 	
 	return 1;
 }
-#line 689 "<stdout>"
+#line 693 "<stdout>"
 yy87:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
@@ -1037,9 +1041,9 @@ yy90:	if(yych <= '/')	goto yy2;
 yy91:	++YYCURSOR;
 	goto yy92;
 yy92:
-#line 346 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 346 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 {
-	int id;
+	long id;
 
  	*p = YYCURSOR;
 	if (!var_hash) return 0;
@@ -1058,9 +1062,9 @@ yy92:
 	
 	return 1;
 }
-#line 737 "<stdout>"
+#line 741 "<stdout>"
 }
-#line 588 "/usr/src/php/php_4_3/ext/standard/var_unserializer.re"
+#line 592 "/usr/src/PHP_4_3_0/ext/standard/var_unserializer.re"
 
 
 	return 0;
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 8e3c5a19b6..5e38dfb4b1 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -27,7 +27,7 @@
 
 typedef struct {
 	zval *data[VAR_ENTRIES_MAX];
-	int used_slots;
+	long used_slots;
 	void *next;
 } var_entries;
 
@@ -80,7 +80,7 @@ static inline void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 
 PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **nzval)
 {
-	int i;
+	long i;
 	var_entries *var_hash = var_hashx->first;
 	
 	while (var_hash) {
@@ -94,7 +94,7 @@ PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **n
 	}
 }
 
-static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
+static int var_access(php_unserialize_data_t *var_hashx, long id, zval ***store)
 {
 	var_entries *var_hash = var_hashx->first;
 	
@@ -115,7 +115,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
 PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 {
 	void *next;
-	int i;
+	long i;
 	var_entries *var_hash = var_hashx->first;
 	
 	while (var_hash) {
@@ -213,7 +213,7 @@ static inline size_t parse_uiv(const unsigned char *p)
 #define UNSERIALIZE_PARAMETER zval **rval, const unsigned char **p, const unsigned char *max, php_unserialize_data_t *var_hash TSRMLS_DC
 #define UNSERIALIZE_PASSTHRU rval, p, max, var_hash TSRMLS_CC
 
-static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, int elements)
+static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long elements)
 {
 	while (elements-- > 0) {
 		zval *key, *data, **old_data;
@@ -282,7 +282,7 @@ static inline int finish_nested_data(UNSERIALIZE_PARAMETER)
 
 static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
-	int elements;
+	long elements;
 
 	elements = parse_iv2((*p) + 2, p);
 
@@ -292,7 +292,7 @@ static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 	return elements;
 }
 
-static inline int object_common2(UNSERIALIZE_PARAMETER, int elements)
+static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
 {
 	zval *retval_ptr = NULL;
 	zval fname;
@@ -344,7 +344,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 /*!re2c
 
 "R:" iv ";"		{
-	int id;
+	long id;
 
  	*p = YYCURSOR;
 	if (!var_hash) return 0;
@@ -365,7 +365,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 }
 
 "r:" iv ";"		{
-	int id;
+	long id;
 
  	*p = YYCURSOR;
 	if (!var_hash) return 0;
@@ -426,7 +426,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 "d:" (iv | nv | nvexp) ";"	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
-	ZVAL_DOUBLE(*rval, zend_strtod(start + 2, NULL));
+	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
 
@@ -459,14 +459,18 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 }
 
 "a:" uiv ":" "{" {
-	int elements = parse_iv(start + 2);
-
+	long elements = parse_iv(start + 2);
+	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
 
 	if (elements < 0) {
 		return 0;
 	}
 
+	if (elements < 0) {
+		return 0;
+	}
+
 	INIT_PZVAL(*rval);
 	Z_TYPE_PP(rval) = IS_ARRAY;
 	ALLOC_HASHTABLE(Z_ARRVAL_PP(rval));
@@ -490,7 +494,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 
 "O:" uiv ":" ["]	{
 	size_t len, len2, len3, maxlen;
-	int elements;
+	long elements;
 	char *class_name;
 	zend_class_entry *ce;
 	int incomplete_class = 0;