MFH

4 files changed, 82 insertions, 10 deletions

diff --git a/TSRM/tsrm_virtual_cwd.c b/TSRM/tsrm_virtual_cwd.c
index f5a842a683..4704080119 100644
--- a/TSRM/tsrm_virtual_cwd.c
+++ b/TSRM/tsrm_virtual_cwd.c
@@ -885,7 +885,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC)
 	dir_length = CWDG(cwd).cwd_length;
 	dir = CWDG(cwd).cwd;
 
-	ptr = command_line = (char *) malloc(command_length + sizeof("cd '' ; ") + dir_length +1+1);
+	ptr = command_line = (char *) malloc(command_length + sizeof("cd '' ; ") + dir_length +extra+1+1);
 	if (!command_line) {
 		return NULL;
 	}
diff --git a/ext/standard/php_var.h b/ext/standard/php_var.h
index c17929afa6..b3c4dd5494 100644
--- a/ext/standard/php_var.h
+++ b/ext/standard/php_var.h
@@ -41,6 +41,7 @@ PHPAPI void php_debug_zval_dump(zval **struc, int level TSRMLS_DC);
 
 struct php_unserialize_data {
 	void *first;
+	void *first_dtor;
 };
 
 typedef struct php_unserialize_data php_unserialize_data_t;
@@ -54,7 +55,8 @@ PHPAPI int php_var_unserialize(zval **rval, const unsigned char **p, const unsig
    zend_hash_destroy(&(var_hash))
 
 #define PHP_VAR_UNSERIALIZE_INIT(var_hash) \
-	(var_hash).first = 0
+	(var_hash).first = 0; \
+	(var_hash).first_dtor = 0
 #define PHP_VAR_UNSERIALIZE_DESTROY(var_hash) \
 	var_destroy(&(var_hash))
 
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index b97508b27e..18c405b649 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -56,6 +56,29 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)
 	var_hash->data[var_hash->used_slots++] = *rval;
 }
 
+static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)
+{
+	var_entries *var_hash = var_hashx->first, *prev = NULL;
+
+	while (var_hash && var_hash->used_slots == VAR_ENTRIES_MAX) {
+		prev = var_hash;
+		var_hash = var_hash->next;
+	}
+
+	if (!var_hash) {
+		var_hash = emalloc(sizeof(var_entries));
+		var_hash->used_slots = 0;
+		var_hash->next = 0;
+
+		if (!var_hashx->first)
+			var_hashx->first = var_hash;
+		else
+			prev->next = var_hash;
+	}
+
+	var_hash->data[var_hash->used_slots++] = *rval;
+}
+
 PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **nzval)
 {
 	int i;
@@ -93,6 +116,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
 PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 {
 	void *next;
+	int i;
 	var_entries *var_hash = var_hashx->first;
 	
 	while (var_hash) {
@@ -100,6 +124,17 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 		efree(var_hash);
 		var_hash = next;
 	}
+	
+	var_hash = var_hashx->first_dtor;
+	
+	while (var_hash) {
+		for (i = 0; i < var_hash->used_slots; i++) {
+			zval_ptr_dtor(&var_hash->data[i]);
+		}
+		next = var_hash->next;
+		efree(var_hash);
+		var_hash = next;
+	}
 }
 
 /* }}} */
@@ -205,14 +240,14 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, int
 
 		switch (Z_TYPE_P(key)) {
 			case IS_LONG:
-				if (zend_hash_index_find(ht, Z_LVAL_P(key), (void **)&old_data)) {
-					var_replace(var_hash, old_data, rval);
+				if (zend_hash_index_find(ht, Z_LVAL_P(key), (void **)&old_data)==SUCCESS) {
+					var_push_dtor(var_hash, old_data);
 				}
 				zend_hash_index_update(ht, Z_LVAL_P(key), &data, sizeof(data), NULL);
 				break;
 			case IS_STRING:
-				if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)) {
-					var_replace(var_hash, old_data, rval);
+				if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+					var_push_dtor(var_hash, old_data);
 				}
 				zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
 				break;
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index f9a8d6427c..f354291815 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -54,6 +54,29 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)
 	var_hash->data[var_hash->used_slots++] = *rval;
 }
 
+static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)
+{
+	var_entries *var_hash = var_hashx->first, *prev = NULL;
+
+	while (var_hash && var_hash->used_slots == VAR_ENTRIES_MAX) {
+		prev = var_hash;
+		var_hash = var_hash->next;
+	}
+
+	if (!var_hash) {
+		var_hash = emalloc(sizeof(var_entries));
+		var_hash->used_slots = 0;
+		var_hash->next = 0;
+
+		if (!var_hashx->first)
+			var_hashx->first = var_hash;
+		else
+			prev->next = var_hash;
+	}
+
+	var_hash->data[var_hash->used_slots++] = *rval;
+}
+
 PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **nzval)
 {
 	int i;
@@ -91,6 +114,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
 PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 {
 	void *next;
+	int i;
 	var_entries *var_hash = var_hashx->first;
 	
 	while (var_hash) {
@@ -98,6 +122,17 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 		efree(var_hash);
 		var_hash = next;
 	}
+	
+	var_hash = var_hashx->first_dtor;
+	
+	while (var_hash) {
+		for (i = 0; i < var_hash->used_slots; i++) {
+			zval_ptr_dtor(&var_hash->data[i]);
+		}
+		next = var_hash->next;
+		efree(var_hash);
+		var_hash = next;
+	}
 }
 
 /* }}} */
@@ -208,14 +243,14 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, int
 
 		switch (Z_TYPE_P(key)) {
 			case IS_LONG:
-				if (zend_hash_index_find(ht, Z_LVAL_P(key), (void **)&old_data)) {
-					var_replace(var_hash, old_data, rval);
+				if (zend_hash_index_find(ht, Z_LVAL_P(key), (void **)&old_data)==SUCCESS) {
+					var_push_dtor(var_hash, old_data);
 				}
 				zend_hash_index_update(ht, Z_LVAL_P(key), &data, sizeof(data), NULL);
 				break;
 			case IS_STRING:
-				if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)) {
-					var_replace(var_hash, old_data, rval);
+				if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+					var_push_dtor(var_hash, old_data);
 				}
 				zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
 				break;