- MFH

diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 48b0bfc280ed09f76b065b4b96eb0826622b1bbd..66c6fc5e9e11d1ebf897179518f0604b4225a194 100644 (file)
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.9.4 on Wed Mar  2 01:25:31 2005 */
+/* Generated by re2c 0.9.4 on Thu Mar 10 02:54:37 2005 */
 #line 1 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
@@ -29,7 +29,7 @@
 
 typedef struct {
        zval *data[VAR_ENTRIES_MAX];
-       int used_slots;
+       long used_slots;
        void *next;
 } var_entries;
 
@@ -82,7 +82,7 @@ static inline void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 
 PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **nzval)
 {
-       int i;
+       long i;
        var_entries *var_hash = var_hashx->first;
        
        while (var_hash) {
@@ -96,7 +96,7 @@ PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **n
        }
 }
 
-static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
+static int var_access(php_unserialize_data_t *var_hashx, long id, zval ***store)
 {
        var_entries *var_hash = var_hashx->first;
        
@@ -117,7 +117,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
 PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 {
        void *next;
-       int i;
+       long i;
        var_entries *var_hash = var_hashx->first;
        
        while (var_hash) {
@@ -210,7 +210,7 @@ static inline size_t parse_uiv(const unsigned char *p)
 #define UNSERIALIZE_PARAMETER zval **rval, const unsigned char **p, const unsigned char *max, php_unserialize_data_t *var_hash TSRMLS_DC
 #define UNSERIALIZE_PASSTHRU rval, p, max, var_hash TSRMLS_CC
 
-static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, int elements)
+static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long elements)
 {
        while (elements-- > 0) {
                zval *key, *data, **old_data;
@@ -279,7 +279,7 @@ static inline int finish_nested_data(UNSERIALIZE_PARAMETER)
 
 static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
-       int elements;
+       long elements;
 
        elements = parse_iv2((*p) + 2, p);
 
@@ -289,7 +289,7 @@ static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
        return elements;
 }
 
-static inline int object_common2(UNSERIALIZE_PARAMETER, int elements)
+static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
 {
        zval *retval_ptr = NULL;
        zval fname;
@@ -420,7 +420,7 @@ yy3:        yyaccept = 0;
        if(yych == ':') goto yy87;
        goto yy4;
 yy4:
-#line 585 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
+#line 589 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 { return 0; }
 #line 102 "<stdout>"
 yy5:   yyaccept = 0;
@@ -461,7 +461,7 @@ yy13:       yyaccept = 0;
 yy14:  ++YYCURSOR;
        goto yy15;
 yy15:
-#line 579 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
+#line 583 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 {
        /* this is the case where we have less data than planned */
        php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
@@ -490,10 +490,10 @@ yy21:     yych = *++YYCURSOR;
 yy22:  ++YYCURSOR;
        goto yy23;
 yy23:
-#line 479 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
+#line 483 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 {
        size_t len, len2, len3, maxlen;
-       int elements;
+       long elements;
        char *class_name;
        zend_class_entry *ce;
        zend_class_entry **pce;
@@ -619,7 +619,7 @@ yy28:       yych = *++YYCURSOR;
 yy29:  ++YYCURSOR;
        goto yy30;
 yy30:
-#line 471 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
+#line 475 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 {
 
        INIT_PZVAL(*rval);
@@ -653,14 +653,18 @@ yy36:     ++YYCURSOR;
 yy37:
 #line 449 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 {
-       int elements = parse_iv(start + 2);
-
+       long elements = parse_iv(start + 2);
+       /* use iv() not uiv() in order to check data range */
        *p = YYCURSOR;
 
        if (elements < 0) {
                return 0;
        }
 
+       if (elements < 0) {
+               return 0;
+       }
+
        INIT_PZVAL(*rval);
        Z_TYPE_PP(rval) = IS_ARRAY;
        ALLOC_HASHTABLE(Z_ARRVAL_PP(rval));
@@ -673,7 +677,7 @@ yy37:
 
        return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 356 "<stdout>"
+#line 360 "<stdout>"
 yy38:  yych = *++YYCURSOR;
        if(yych == '+') goto yy39;
        if(yych <= '/') goto yy2;
@@ -725,7 +729,7 @@ yy44:
        ZVAL_STRINGL(*rval, str, len, 1);
        return 1;
 }
-#line 409 "<stdout>"
+#line 413 "<stdout>"
 yy45:  yych = *++YYCURSOR;
        if(yych <= '/'){
                if(yych <= ','){
@@ -818,10 +822,10 @@ yy56:
 {
        *p = YYCURSOR;
        INIT_PZVAL(*rval);
-       ZVAL_DOUBLE(*rval, zend_strtod(start + 2, NULL));
+       ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
        return 1;
 }
-#line 507 "<stdout>"
+#line 511 "<stdout>"
 yy57:  yych = *++YYCURSOR;
        if(yych <= ','){
                if(yych != '+') goto yy2;
@@ -896,7 +900,7 @@ yy67:
 
        return 1;
 }
-#line 584 "<stdout>"
+#line 588 "<stdout>"
 yy68:  yych = *++YYCURSOR;
        if(yych == 'N') goto yy65;
        goto yy2;
@@ -932,7 +936,7 @@ yy74:
        ZVAL_LONG(*rval, parse_iv(start + 2));
        return 1;
 }
-#line 621 "<stdout>"
+#line 625 "<stdout>"
 yy75:  yych = *++YYCURSOR;
        if(yych <= '/') goto yy2;
        if(yych >= '2') goto yy2;
@@ -950,7 +954,7 @@ yy78:
        ZVAL_BOOL(*rval, parse_iv(start + 2));
        return 1;
 }
-#line 639 "<stdout>"
+#line 643 "<stdout>"
 yy79:  ++YYCURSOR;
        goto yy80;
 yy80:
@@ -961,7 +965,7 @@ yy80:
        ZVAL_NULL(*rval);
        return 1;
 }
-#line 650 "<stdout>"
+#line 654 "<stdout>"
 yy81:  yych = *++YYCURSOR;
        if(yych <= ','){
                if(yych != '+') goto yy2;
@@ -989,7 +993,7 @@ yy85:       ++YYCURSOR;
 yy86:
 #line 355 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 {
-       int id;
+       long id;
 
        *p = YYCURSOR;
        if (!var_hash) return 0;
@@ -1010,7 +1014,7 @@ yy86:
        
        return 1;
 }
-#line 700 "<stdout>"
+#line 704 "<stdout>"
 yy87:  yych = *++YYCURSOR;
        if(yych <= ','){
                if(yych != '+') goto yy2;
@@ -1038,7 +1042,7 @@ yy91:     ++YYCURSOR;
 yy92:
 #line 334 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 {
-       int id;
+       long id;
 
        *p = YYCURSOR;
        if (!var_hash) return 0;
@@ -1057,9 +1061,9 @@ yy92:
        
        return 1;
 }
-#line 748 "<stdout>"
+#line 752 "<stdout>"
 }
-#line 587 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
+#line 591 "/usr/src/php/php_5_0/ext/standard/var_unserializer.re"
 
 
        return 0;

diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 2cee004f0e093dc413f7037b2b96cbaffe444d79..821b50b97c276def3ca4672b25cd3f1c0c15eb5c 100644 (file)
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -27,7 +27,7 @@
 
 typedef struct {
        zval *data[VAR_ENTRIES_MAX];
-       int used_slots;
+       long used_slots;
        void *next;
 } var_entries;
 
@@ -80,7 +80,7 @@ static inline void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 
 PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **nzval)
 {
-       int i;
+       long i;
        var_entries *var_hash = var_hashx->first;
        
        while (var_hash) {
@@ -94,7 +94,7 @@ PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **n
        }
 }
 
-static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
+static int var_access(php_unserialize_data_t *var_hashx, long id, zval ***store)
 {
        var_entries *var_hash = var_hashx->first;
        
@@ -115,7 +115,7 @@ static int var_access(php_unserialize_data_t *var_hashx, int id, zval ***store)
 PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 {
        void *next;
-       int i;
+       long i;
        var_entries *var_hash = var_hashx->first;
        
        while (var_hash) {
@@ -213,7 +213,7 @@ static inline size_t parse_uiv(const unsigned char *p)
 #define UNSERIALIZE_PARAMETER zval **rval, const unsigned char **p, const unsigned char *max, php_unserialize_data_t *var_hash TSRMLS_DC
 #define UNSERIALIZE_PASSTHRU rval, p, max, var_hash TSRMLS_CC
 
-static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, int elements)
+static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long elements)
 {
        while (elements-- > 0) {
                zval *key, *data, **old_data;
@@ -282,7 +282,7 @@ static inline int finish_nested_data(UNSERIALIZE_PARAMETER)
 
 static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
-       int elements;
+       long elements;
 
        elements = parse_iv2((*p) + 2, p);
 
@@ -292,7 +292,7 @@ static inline int object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
        return elements;
 }
 
-static inline int object_common2(UNSERIALIZE_PARAMETER, int elements)
+static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
 {
        zval *retval_ptr = NULL;
        zval fname;
@@ -332,7 +332,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 /*!re2c
 
 "R:" iv ";"            {
-       int id;
+       long id;
 
        *p = YYCURSOR;
        if (!var_hash) return 0;
@@ -353,7 +353,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 }
 
 "r:" iv ";"            {
-       int id;
+       long id;
 
        *p = YYCURSOR;
        if (!var_hash) return 0;
@@ -414,7 +414,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 "d:" (iv | nv | nvexp) ";"     {
        *p = YYCURSOR;
        INIT_PZVAL(*rval);
-       ZVAL_DOUBLE(*rval, zend_strtod(start + 2, NULL));
+       ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
        return 1;
 }
 
@@ -447,14 +447,18 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 }
 
 "a:" uiv ":" "{" {
-       int elements = parse_iv(start + 2);
-
+       long elements = parse_iv(start + 2);
+       /* use iv() not uiv() in order to check data range */
        *p = YYCURSOR;
 
        if (elements < 0) {
                return 0;
        }
 
+       if (elements < 0) {
+               return 0;
+       }
+
        INIT_PZVAL(*rval);
        Z_TYPE_PP(rval) = IS_ARRAY;
        ALLOC_HASHTABLE(Z_ARRVAL_PP(rval));
@@ -478,7 +482,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 
 "O:" uiv ":" ["]       {
        size_t len, len2, len3, maxlen;
-       int elements;
+       long elements;
        char *class_name;
        zend_class_entry *ce;
        zend_class_entry **pce;