Fixed bug #37947 (zend_ptr_stack reallocation problem)

1 files changed, 14 insertions, 18 deletions

diff --git a/ext/standard/var.c b/ext/standard/var.c
index db9fd60473..7a81013889 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -881,32 +881,28 @@ PHP_FUNCTION(serialize)
 
 PHP_FUNCTION(unserialize)
 {
-	zval **buf;
+	char *buf;
+	int buf_len;
+	const unsigned char *p;
 	php_unserialize_data_t var_hash;
 	
-	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &buf) == FAILURE) {
-		WRONG_PARAM_COUNT;
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
+		RETURN_FALSE;
 	}
 
-	if (Z_TYPE_PP(buf) == IS_STRING) {
-		const unsigned char *p = (unsigned char*)Z_STRVAL_PP(buf);
-
-		if (Z_STRLEN_PP(buf) == 0) {
-			RETURN_FALSE;
-		}
+	if (buf_len == 0) {
+		RETURN_FALSE;
+	}
 
-		PHP_VAR_UNSERIALIZE_INIT(var_hash);
-		if (!php_var_unserialize(&return_value, &p, p + Z_STRLEN_PP(buf),  &var_hash TSRMLS_CC)) {
-			PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
-			zval_dtor(return_value);
-			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Error at offset %ld of %d bytes", (long)((char*)p - Z_STRVAL_PP(buf)), Z_STRLEN_PP(buf));
-			RETURN_FALSE;
-		}
+	p = (const unsigned char*)buf;
+	PHP_VAR_UNSERIALIZE_INIT(var_hash);
+	if (!php_var_unserialize(&return_value, &p, p + buf_len,  &var_hash TSRMLS_CC)) {
 		PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
-	} else {
-		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Argument is not a string");
+		zval_dtor(return_value);
+		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Error at offset %ld of %d bytes", (long)((char*)p - buf), buf_len);
 		RETURN_FALSE;
 	}
+	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 }
 
 /* }}} */