Drop invalid arrays

diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 613dd32c6f69f4bc92a6db54765c66909d6291d6..a774946d9178e3df2c97d3154e8700f4e979ddbf 100644 (file)
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -477,6 +477,10 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 "a:" uiv ":" "{" {
        int elements = parse_iv(start + 2);
 
+       if (elements < 0) {
+               return 0;
+       }
+
        *p = YYCURSOR;
 
        INIT_PZVAL(*rval);