- Fixed bug #25378 (Invalid data passed to unserialize() causes segfault)

diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 585d7774a940e762e8ec9d54c737e169d4e0e7a9..85a49980195fc4057b79202d7978924279bcca9f 100644 (file)
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -110,6 +110,7 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 
 
 /*!re2c
+uiv = [+]? [0-9]+;
 iv = [+-]? [0-9]+;
 nv = [+-]? ([0-9]* "." [0-9]+|[0-9]+ "." [0-9]*);
 nvexp = (iv | nv) [eE] [+-]? iv;
@@ -305,7 +306,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
        return 1;
 }
 
-"s:" iv ":" ["]        {
+"s:" uiv ":" ["]       {
        int len;
        char *str;
 
@@ -325,7 +326,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
        return 1;
 }
 
-"a:" iv ":" "{" {
+"a:" uiv ":" "{" {
        int elements = parse_iv(start + 2);
 
        *p = YYCURSOR;
@@ -351,7 +352,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
                        object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
 
-"O:" iv ":" ["]        {
+"O:" uiv ":" ["]       {
        int len;
        int elements;
        int len2;