(unserialize) now cleans up better on failure!

diff --git a/ext/standard/var.c b/ext/standard/var.c
index acd1cc07ed27201db2506df1f4262c921dad1a03..233d23b349a36e2c942b6a4de7cf31848cbf9718 100644 (file)
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -428,7 +428,6 @@ int php_var_unserialize(pval **rval, const char **p, const char *max)
                                (*p)++;
                        }
                        if (**p != ':' || *((*p) + 1) != '{') {
-                               pval_destructor(*rval);
                                return 0;
                        }
                        for ((*p) += 2; **p && **p != '}' && i > 0; i--) {
@@ -436,13 +435,11 @@ int php_var_unserialize(pval **rval, const char **p, const char *max)
                                pval *data = emalloc(sizeof(pval));
                                
                                if (!php_var_unserialize(&key, p, max)) {
-                                       pval_destructor(*rval);
                                    efree(key);
                                        efree(data);
                                        return 0;
                                }
                                if (!php_var_unserialize(&data, p, max)) {
-                                       pval_destructor(*rval);
                                        pval_destructor(key);
                                    efree(key);
                                        efree(data);
@@ -503,6 +500,7 @@ PHP_FUNCTION(unserialize)
                }
 
                if (!php_var_unserialize(&return_value, &p, p + (*buf)->value.str.len)) {
+                       zval_dtor(return_value);
                        php_error(E_NOTICE, "unserialize() failed at offset %d of %d bytes",p-(*buf)->value.str.val,(*buf)->value.str.len);
                        RETURN_FALSE;
                }