Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object...

diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index c1892058796455e95f6a53c2305661689a52b7ac..ad7887bd287feafebbf8f163401800d01d790c13 100644 (file)
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -772,6 +772,9 @@ SPL_METHOD(SplObjectStorage, unserialize)
        --p; /* for ';' */
        count = Z_LVAL_P(pcount);
 
+       ZVAL_UNDEF(&entry);
+       ZVAL_UNDEF(&inf);
+
        while (count-- > 0) {
                spl_SplObjectStorageElement *pelement;
                zend_string *hash;
@@ -787,18 +790,17 @@ SPL_METHOD(SplObjectStorage, unserialize)
                if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
                        goto outexcept;
                }
-               if (Z_TYPE(entry) != IS_OBJECT) {
-                       zval_ptr_dtor(&entry);
-                       goto outexcept;
-               }
                if (*p == ',') { /* new version has inf */
                        ++p;
                        if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) {
                                zval_ptr_dtor(&entry);
                                goto outexcept;
                        }
-               } else {
-                       ZVAL_UNDEF(&inf);
+               }
+               if (Z_TYPE(entry) != IS_OBJECT) {
+                       zval_ptr_dtor(&entry);
+                       zval_ptr_dtor(&inf);
+                       goto outexcept;
                }
 
                hash = spl_object_storage_get_hash(intern, getThis(), &entry);