From: Dmitry Stogov <dmitry@zend.com>
Date: Thu, 9 Nov 2017 11:20:09 +0000 (+0300)
Subject: Optimized parse_iv2()
X-Git-Tag: php-7.3.0alpha1~1064
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2205631209843dcb7020d62bfd69c733c5ac46d2;p=php

Optimized parse_iv2()
---

diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 4a797e69c7..34140a2bb2 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.14.3 */
+/* Generated by re2c 0.16 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
@@ -324,22 +324,43 @@ static inline int unserialize_allowed_class(
 
 static inline zend_long parse_iv2(const unsigned char *p, const unsigned char **q)
 {
-	zend_long result = 0;
-	char *end;
+	zend_ulong result = 0;
+	zend_ulong neg = 0;
+	const unsigned char *start;
 
-	errno = 0;
-	result = ZEND_STRTOL((const char*)p, &end, 0);
+	if (*p == '-') {
+		neg = 1;
+		p++;
+	} else if (UNEXPECTED(*p == '+')) {
+		p++;
+	}
+
+	while (UNEXPECTED(*p == '0')) {
+		p++;
+	}
+
+	start = p;
+
+	while (*p >= '0' && *p <= '9') {
+		result = result * 10 + ((zend_ulong)(*p) - '0');
+		p++;
+	}
 
 	if (q) {
-		*q = (const unsigned char *)end;
+		*q = p;
 	}
 
-	if (errno) {
-		php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
-		return result;
+	/* number too long or overflow */
+	if (UNEXPECTED(p - start > MAX_LENGTH_OF_LONG - 1)
+	 || (SIZEOF_ZEND_LONG == 4
+	 	&& UNEXPECTED(p - start == MAX_LENGTH_OF_LONG - 1)
+	 	&& UNEXPECTED(*start > '2'))
+	 || UNEXPECTED(result - neg > ZEND_LONG_MAX)) {
+		php_error_docref(NULL, E_WARNING, "Numerical result out of range");
+		return (!neg) ? ZEND_LONG_MAX : ZEND_LONG_MIN;
 	}
 
-	return result;
+	return (!neg) ? (zend_long)result : -(zend_long)result;
 }
 
 static inline zend_long parse_iv(const unsigned char *p)
@@ -644,7 +665,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 	start = cursor;
 
 
-#line 648 "ext/standard/var_unserializer.c"
+#line 669 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -681,521 +702,375 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 		  0,   0,   0,   0,   0,   0,   0,   0, 
 		  0,   0,   0,   0,   0,   0,   0,   0, 
 	};
-
 	if ((YYLIMIT - YYCURSOR) < 7) YYFILL(7);
 	yych = *YYCURSOR;
 	switch (yych) {
 	case 'C':
-	case 'O':	goto yy13;
+	case 'O':	goto yy4;
 	case 'N':	goto yy5;
-	case 'R':	goto yy2;
-	case 'S':	goto yy10;
-	case 'a':	goto yy11;
-	case 'b':	goto yy6;
-	case 'd':	goto yy8;
-	case 'i':	goto yy7;
+	case 'R':	goto yy6;
+	case 'S':	goto yy7;
+	case 'a':	goto yy8;
+	case 'b':	goto yy9;
+	case 'd':	goto yy10;
+	case 'i':	goto yy11;
 	case 'o':	goto yy12;
-	case 'r':	goto yy4;
-	case 's':	goto yy9;
-	case '}':	goto yy14;
-	default:	goto yy16;
+	case 'r':	goto yy13;
+	case 's':	goto yy14;
+	case '}':	goto yy15;
+	default:	goto yy2;
 	}
 yy2:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy88;
+	++YYCURSOR;
 yy3:
-#line 1039 "ext/standard/var_unserializer.re"
+#line 1066 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 710 "ext/standard/var_unserializer.c"
+#line 729 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy83;
+	if (yych == ':') goto yy17;
 	goto yy3;
 yy5:
 	yych = *++YYCURSOR;
-	if (yych == ';') goto yy81;
+	if (yych == ';') goto yy19;
 	goto yy3;
 yy6:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy77;
+	if (yych == ':') goto yy21;
 	goto yy3;
 yy7:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy71;
+	if (yych == ':') goto yy22;
 	goto yy3;
 yy8:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy48;
+	if (yych == ':') goto yy23;
 	goto yy3;
 yy9:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy42;
+	if (yych == ':') goto yy24;
 	goto yy3;
 yy10:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy36;
+	if (yych == ':') goto yy25;
 	goto yy3;
 yy11:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy30;
+	if (yych == ':') goto yy26;
 	goto yy3;
 yy12:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy24;
+	if (yych == ':') goto yy27;
 	goto yy3;
 yy13:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy17;
+	if (yych == ':') goto yy28;
 	goto yy3;
 yy14:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy29;
+	goto yy3;
+yy15:
 	++YYCURSOR;
-#line 1033 "ext/standard/var_unserializer.re"
+#line 1060 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 759 "ext/standard/var_unserializer.c"
-yy16:
-	yych = *++YYCURSOR;
-	goto yy3;
+#line 782 "ext/standard/var_unserializer.c"
 yy17:
 	yych = *++YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy19;
+		goto yy30;
 	}
 yy18:
 	YYCURSOR = YYMARKER;
 	goto yy3;
 yy19:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
-	yych = *YYCURSOR;
-	if (yybm[0+yych] & 128) {
-		goto yy19;
-	}
+#line 723 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	ZVAL_NULL(rval);
+	return 1;
+}
+#line 799 "ext/standard/var_unserializer.c"
+yy21:
+	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy32;
+	goto yy18;
+yy22:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
-	++YYCURSOR;
-#line 881 "ext/standard/var_unserializer.re"
-	{
-	size_t len, len2, len3, maxlen;
-	zend_long elements;
-	char *str;
-	zend_string *class_name;
-	zend_class_entry *ce;
-	int incomplete_class = 0;
-
-	int custom_object = 0;
-
-	zval user_func;
-	zval retval;
-	zval args[1];
-
-    if (!var_hash) return 0;
-	if (*start == 'C') {
-		custom_object = 1;
-	}
-
-	len2 = len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len || len == 0) {
-		*p = start + 2;
-		return 0;
-	}
-
-	str = (char*)YYCURSOR;
-
-	YYCURSOR += len;
-
-	if (*(YYCURSOR) != '"') {
-		*p = YYCURSOR;
-		return 0;
-	}
-	if (*(YYCURSOR+1) != ':') {
-		*p = YYCURSOR+1;
-		return 0;
-	}
-
-	len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\");
-	if (len3 != len)
-	{
-		*p = YYCURSOR + len3 - len;
-		return 0;
-	}
-
-	class_name = zend_string_init(str, len, 0);
-
-	do {
-		if(!unserialize_allowed_class(class_name, var_hash)) {
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
-			break;
-		}
-
-		/* Try to find class directly */
-		BG(serialize_lock)++;
-		ce = zend_lookup_class(class_name);
-		if (ce) {
-			BG(serialize_lock)--;
-			if (EG(exception)) {
-				zend_string_release(class_name);
-				return 0;
-			}
-			break;
-		}
-		BG(serialize_lock)--;
-
-		if (EG(exception)) {
-			zend_string_release(class_name);
-			return 0;
-		}
-
-		/* Check for unserialize callback */
-		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
-			break;
-		}
-
-		/* Call unserialize callback */
-		ZVAL_STRING(&user_func, PG(unserialize_callback_func));
-
-		ZVAL_STR_COPY(&args[0], class_name);
-		BG(serialize_lock)++;
-		if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) {
-			BG(serialize_lock)--;
-			if (EG(exception)) {
-				zend_string_release(class_name);
-				zval_ptr_dtor(&user_func);
-				zval_ptr_dtor(&args[0]);
-				return 0;
-			}
-			php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func));
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
-			zval_ptr_dtor(&user_func);
-			zval_ptr_dtor(&args[0]);
-			break;
-		}
-		BG(serialize_lock)--;
-		zval_ptr_dtor(&retval);
-		if (EG(exception)) {
-			zend_string_release(class_name);
-			zval_ptr_dtor(&user_func);
-			zval_ptr_dtor(&args[0]);
-			return 0;
-		}
-
-		/* The callback function may have defined the class */
-		BG(serialize_lock)++;
-		if ((ce = zend_lookup_class(class_name)) == NULL) {
-			php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func));
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy34;
+	goto yy18;
+yy23:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy36;
+	goto yy18;
+yy24:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '0') goto yy38;
+	if (yych <= '1') goto yy39;
+	goto yy18;
+yy25:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych <= ',') {
+			if (yych == '+') goto yy40;
+			goto yy18;
+		} else {
+			if (yych <= '-') goto yy41;
+			if (yych <= '.') goto yy42;
+			goto yy18;
 		}
-		BG(serialize_lock)--;
-
-		zval_ptr_dtor(&user_func);
-		zval_ptr_dtor(&args[0]);
-		break;
-	} while (1);
-
-	*p = YYCURSOR;
-
-	if (custom_object) {
-		int ret;
-
-		ret = object_custom(UNSERIALIZE_PASSTHRU, ce);
-
-		if (ret && incomplete_class) {
-			php_store_class_name(rval, ZSTR_VAL(class_name), len2);
+	} else {
+		if (yych <= 'I') {
+			if (yych <= '9') goto yy43;
+			if (yych <= 'H') goto yy18;
+			goto yy45;
+		} else {
+			if (yych == 'N') goto yy46;
+			goto yy18;
 		}
-		zend_string_release(class_name);
-		return ret;
-	}
-
-	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
-
-	if (elements < 0) {
-	   zend_string_release(class_name);
-	   return 0;
 	}
-
-	if (incomplete_class) {
-		php_store_class_name(rval, ZSTR_VAL(class_name), len2);
+yy26:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy47;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy47;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy48;
+		goto yy18;
 	}
-	zend_string_release(class_name);
-
-	return object_common2(UNSERIALIZE_PASSTHRU, elements);
-}
-#line 935 "ext/standard/var_unserializer.c"
-yy24:
+yy27:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy25:
+	if (yych <= '9') goto yy50;
+	goto yy18;
+yy28:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy52;
+	goto yy18;
+yy29:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy54;
+	goto yy18;
+yy30:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
+	if (yybm[0+yych] & 128) {
+		goto yy30;
+	}
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy25;
-	if (yych >= ';') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych <= ':') goto yy56;
+	goto yy18;
+yy32:
 	++YYCURSOR;
-#line 870 "ext/standard/var_unserializer.re"
-	{
-	zend_long elements;
-    if (!var_hash) return 0;
-
-	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
-	if (elements < 0 || elements >= HT_MAX_SIZE) {
-		return 0;
-	}
-	return object_common2(UNSERIALIZE_PASSTHRU, elements);
-}
-#line 961 "ext/standard/var_unserializer.c"
-yy30:
-	yych = *++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy31:
+	if (yych <= '9') goto yy32;
+	if (yych == ';') goto yy57;
+	goto yy18;
+yy34:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy31;
-	if (yych >= ';') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != '{') goto yy18;
+	if (yych <= '9') goto yy34;
+	if (yych <= ':') goto yy59;
+	goto yy18;
+yy36:
 	++YYCURSOR;
-#line 837 "ext/standard/var_unserializer.re"
-	{
-	zend_long elements = parse_iv(start + 2);
-	/* use iv() not uiv() in order to check data range */
-	*p = YYCURSOR;
-    if (!var_hash) return 0;
-
-	if (elements < 0 || elements >= HT_MAX_SIZE) {
-		return 0;
-	}
-
-	if (elements) {
-		array_init_size(rval, elements);
-		/* we can't convert from packed to hash during unserialization, because
-		   reference to some zvals might be keept in var_hash (to support references) */
-		zend_hash_real_init(Z_ARRVAL_P(rval), 0);
+	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy36;
+	if (yych <= ':') goto yy60;
+	goto yy18;
+yy38:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy61;
+	goto yy18;
+yy39:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy63;
+	goto yy18;
+yy40:
+	yych = *++YYCURSOR;
+	if (yych == '.') goto yy42;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy43;
+	goto yy18;
+yy41:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych != '.') goto yy18;
 	} else {
-		ZVAL_EMPTY_ARRAY(rval);
-		return finish_nested_data(UNSERIALIZE_PASSTHRU);
+		if (yych <= '9') goto yy43;
+		if (yych == 'I') goto yy45;
+		goto yy18;
 	}
-
-	/* The array may contain references to itself, in which case we'll be modifying an
-	 * rc>1 array. This is okay, since the array is, ostensibly, only visible to
-	 * unserialize (in practice unserialization handlers also see it). Ideally we should
-	 * prohibit "r:" references to non-objects, as we only generate them for objects. */
-	HT_ALLOW_COW_VIOLATION(Z_ARRVAL_P(rval));
-
-	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) {
-		return 0;
+yy42:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy65;
+	goto yy18;
+yy43:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
+	yych = *YYCURSOR;
+	if (yych <= ':') {
+		if (yych <= '.') {
+			if (yych <= '-') goto yy18;
+			goto yy65;
+		} else {
+			if (yych <= '/') goto yy18;
+			if (yych <= '9') goto yy43;
+			goto yy18;
+		}
+	} else {
+		if (yych <= 'E') {
+			if (yych <= ';') goto yy67;
+			if (yych <= 'D') goto yy18;
+			goto yy69;
+		} else {
+			if (yych == 'e') goto yy69;
+			goto yy18;
+		}
 	}
-
-	return finish_nested_data(UNSERIALIZE_PASSTHRU);
-}
-#line 1009 "ext/standard/var_unserializer.c"
-yy36:
+yy45:
+	yych = *++YYCURSOR;
+	if (yych == 'N') goto yy70;
+	goto yy18;
+yy46:
+	yych = *++YYCURSOR;
+	if (yych == 'A') goto yy71;
+	goto yy18;
+yy47:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy37:
+yy48:
+	++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy48;
+	if (yych == ';') goto yy72;
+	goto yy18;
+yy50:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy37;
-	if (yych >= ';') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych <= '9') goto yy50;
+	if (yych <= ':') goto yy74;
+	goto yy18;
+yy52:
 	++YYCURSOR;
-#line 803 "ext/standard/var_unserializer.re"
-	{
-	size_t len, maxlen;
-	zend_string *str;
-
-	len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len) {
-		*p = start + 2;
-		return 0;
-	}
-
-	if ((str = unserialize_str(&YYCURSOR, len, maxlen)) == NULL) {
-		return 0;
-	}
-
-	if (*(YYCURSOR) != '"') {
-		zend_string_free(str);
-		*p = YYCURSOR;
-		return 0;
-	}
-
-	if (*(YYCURSOR + 1) != ';') {
-		efree(str);
-		*p = YYCURSOR + 1;
-		return 0;
-	}
-
-	YYCURSOR += 2;
-	*p = YYCURSOR;
-
-	ZVAL_STR(rval, str);
-	return 1;
-}
-#line 1058 "ext/standard/var_unserializer.c"
-yy42:
-	yych = *++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy43:
+	if (yych <= '9') goto yy52;
+	if (yych == ';') goto yy75;
+	goto yy18;
+yy54:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy43;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy54;
+	if (yych <= ':') goto yy77;
+	goto yy18;
+yy56:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych == '"') goto yy78;
+	goto yy18;
+yy57:
 	++YYCURSOR;
-#line 765 "ext/standard/var_unserializer.re"
+#line 673 "ext/standard/var_unserializer.re"
 	{
-	size_t len, maxlen;
-	char *str;
-
-	len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len) {
-		*p = start + 2;
-		return 0;
-	}
-
-	str = (char*)YYCURSOR;
+	zend_long id;
 
-	YYCURSOR += len;
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
 
-	if (*(YYCURSOR) != '"') {
-		*p = YYCURSOR;
+	id = parse_uiv(start + 2) - 1;
+	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
 		return 0;
 	}
 
-	if (*(YYCURSOR + 1) != ';') {
-		*p = YYCURSOR + 1;
+	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
 		return 0;
 	}
 
-	YYCURSOR += 2;
-	*p = YYCURSOR;
-
-	if (len == 0) {
-		ZVAL_EMPTY_STRING(rval);
-	} else if (len == 1) {
-		ZVAL_INTERNED_STR(rval, ZSTR_CHAR((zend_uchar)*str));
+	if (Z_ISREF_P(rval_ref)) {
+		ZVAL_COPY(rval, rval_ref);
 	} else {
-		ZVAL_STRINGL(rval, str, len);
+		ZVAL_NEW_REF(rval_ref, rval_ref);
+		ZVAL_COPY(rval, rval_ref);
 	}
+
 	return 1;
 }
-#line 1111 "ext/standard/var_unserializer.c"
-yy48:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych <= ',') {
-			if (yych == '+') goto yy52;
-			goto yy18;
-		} else {
-			if (yych <= '-') goto yy50;
-			if (yych <= '.') goto yy55;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'I') {
-			if (yych <= '9') goto yy53;
-			if (yych <= 'H') goto yy18;
-			goto yy51;
-		} else {
-			if (yych != 'N') goto yy18;
-		}
-	}
+#line 1028 "ext/standard/var_unserializer.c"
+yy59:
 	yych = *++YYCURSOR;
-	if (yych == 'A') goto yy70;
+	if (yych == '"') goto yy80;
 	goto yy18;
-yy50:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych == '.') goto yy55;
-		goto yy18;
-	} else {
-		if (yych <= '9') goto yy53;
-		if (yych != 'I') goto yy18;
-	}
-yy51:
+yy60:
 	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy66;
+	if (yych == '{') goto yy82;
 	goto yy18;
-yy52:
-	yych = *++YYCURSOR;
-	if (yych == '.') goto yy55;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy53:
+yy61:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
-	yych = *YYCURSOR;
-	if (yych <= ':') {
-		if (yych <= '.') {
-			if (yych <= '-') goto yy18;
-			goto yy64;
-		} else {
-			if (yych <= '/') goto yy18;
-			if (yych <= '9') goto yy53;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'E') {
-			if (yych <= ';') goto yy58;
-			if (yych <= 'D') goto yy18;
-			goto yy60;
-		} else {
-			if (yych == 'e') goto yy60;
-			goto yy18;
-		}
-	}
-yy55:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy56:
+#line 729 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	ZVAL_FALSE(rval);
+	return 1;
+}
+#line 1045 "ext/standard/var_unserializer.c"
+yy63:
+	++YYCURSOR;
+#line 735 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	ZVAL_TRUE(rval);
+	return 1;
+}
+#line 1054 "ext/standard/var_unserializer.c"
+yy65:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
 	yych = *YYCURSOR;
 	if (yych <= ';') {
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy56;
+		if (yych <= '9') goto yy65;
 		if (yych <= ':') goto yy18;
 	} else {
 		if (yych <= 'E') {
 			if (yych <= 'D') goto yy18;
-			goto yy60;
+			goto yy69;
 		} else {
-			if (yych == 'e') goto yy60;
+			if (yych == 'e') goto yy69;
 			goto yy18;
 		}
 	}
-yy58:
+yy67:
 	++YYCURSOR;
-#line 756 "ext/standard/var_unserializer.re"
+#line 783 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 use_double:
@@ -1204,225 +1079,411 @@ use_double:
 	ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1208 "ext/standard/var_unserializer.c"
-yy60:
+#line 1083 "ext/standard/var_unserializer.c"
+yy69:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
-		if (yych != '+') goto yy18;
+		if (yych == '+') goto yy84;
+		goto yy18;
 	} else {
-		if (yych <= '-') goto yy61;
+		if (yych <= '-') goto yy84;
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy62;
+		if (yych <= '9') goto yy85;
 		goto yy18;
 	}
-yy61:
+yy70:
 	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy62:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy62;
-	if (yych == ';') goto yy58;
+	if (yych == 'F') goto yy87;
+	goto yy18;
+yy71:
+	yych = *++YYCURSOR;
+	if (yych == 'N') goto yy87;
 	goto yy18;
-yy64:
+yy72:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
-	yych = *YYCURSOR;
-	if (yych <= ';') {
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy64;
-		if (yych <= ':') goto yy18;
-		goto yy58;
-	} else {
-		if (yych <= 'E') {
-			if (yych <= 'D') goto yy18;
-			goto yy60;
+#line 741 "ext/standard/var_unserializer.re"
+	{
+#if SIZEOF_ZEND_LONG == 4
+	int digits = YYCURSOR - start - 3;
+
+	if (start[2] == '-' || start[2] == '+') {
+		digits--;
+	}
+
+	/* Use double for large zend_long values that were serialized on a 64-bit system */
+	if (digits >= MAX_LENGTH_OF_LONG - 1) {
+		if (digits == MAX_LENGTH_OF_LONG - 1) {
+			int cmp = strncmp((char*)YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
+
+			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
+				goto use_double;
+			}
 		} else {
-			if (yych == 'e') goto yy60;
-			goto yy18;
+			goto use_double;
 		}
 	}
-yy66:
-	yych = *++YYCURSOR;
-	if (yych != 'F') goto yy18;
-yy67:
+#endif
+	*p = YYCURSOR;
+	ZVAL_LONG(rval, parse_iv(start + 2));
+	return 1;
+}
+#line 1131 "ext/standard/var_unserializer.c"
+yy74:
 	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
+	if (yych == '"') goto yy88;
+	goto yy18;
+yy75:
 	++YYCURSOR;
-#line 740 "ext/standard/var_unserializer.re"
+#line 698 "ext/standard/var_unserializer.re"
 	{
-	*p = YYCURSOR;
+	zend_long id;
 
-	if (!strncmp((char*)start + 2, "NAN", 3)) {
-		ZVAL_DOUBLE(rval, ZEND_NAN);
-	} else if (!strncmp((char*)start + 2, "INF", 3)) {
-		ZVAL_DOUBLE(rval, ZEND_INFINITY);
-	} else if (!strncmp((char*)start + 2, "-INF", 4)) {
-		ZVAL_DOUBLE(rval, -ZEND_INFINITY);
-	} else {
-		ZVAL_NULL(rval);
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
+
+	id = parse_uiv(start + 2) - 1;
+	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
+		return 0;
+	}
+
+	if (rval_ref == rval) {
+		return 0;
 	}
 
+	ZVAL_DEREF(rval_ref);
+	if (Z_TYPE_P(rval_ref) != IS_OBJECT) {
+		return 0;
+	}
+
+	ZVAL_COPY(rval, rval_ref);
+
 	return 1;
 }
-#line 1272 "ext/standard/var_unserializer.c"
-yy70:
+#line 1163 "ext/standard/var_unserializer.c"
+yy77:
 	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy67;
+	if (yych == '"') goto yy90;
 	goto yy18;
-yy71:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy72;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy73;
-		goto yy18;
-	}
-yy72:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy73:
+yy78:
 	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy73;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-#line 714 "ext/standard/var_unserializer.re"
+#line 908 "ext/standard/var_unserializer.re"
 	{
-#if SIZEOF_ZEND_LONG == 4
-	int digits = YYCURSOR - start - 3;
+	size_t len, len2, len3, maxlen;
+	zend_long elements;
+	char *str;
+	zend_string *class_name;
+	zend_class_entry *ce;
+	int incomplete_class = 0;
 
-	if (start[2] == '-' || start[2] == '+') {
-		digits--;
+	int custom_object = 0;
+
+	zval user_func;
+	zval retval;
+	zval args[1];
+
+    if (!var_hash) return 0;
+	if (*start == 'C') {
+		custom_object = 1;
 	}
 
-	/* Use double for large zend_long values that were serialized on a 64-bit system */
-	if (digits >= MAX_LENGTH_OF_LONG - 1) {
-		if (digits == MAX_LENGTH_OF_LONG - 1) {
-			int cmp = strncmp((char*)YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
+	len2 = len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len || len == 0) {
+		*p = start + 2;
+		return 0;
+	}
 
-			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
-				goto use_double;
+	str = (char*)YYCURSOR;
+
+	YYCURSOR += len;
+
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
+		return 0;
+	}
+	if (*(YYCURSOR+1) != ':') {
+		*p = YYCURSOR+1;
+		return 0;
+	}
+
+	len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\");
+	if (len3 != len)
+	{
+		*p = YYCURSOR + len3 - len;
+		return 0;
+	}
+
+	class_name = zend_string_init(str, len, 0);
+
+	do {
+		if(!unserialize_allowed_class(class_name, var_hash)) {
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			break;
+		}
+
+		/* Try to find class directly */
+		BG(serialize_lock)++;
+		ce = zend_lookup_class(class_name);
+		if (ce) {
+			BG(serialize_lock)--;
+			if (EG(exception)) {
+				zend_string_release(class_name);
+				return 0;
 			}
-		} else {
-			goto use_double;
+			break;
 		}
-	}
-#endif
+		BG(serialize_lock)--;
+
+		if (EG(exception)) {
+			zend_string_release(class_name);
+			return 0;
+		}
+
+		/* Check for unserialize callback */
+		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			break;
+		}
+
+		/* Call unserialize callback */
+		ZVAL_STRING(&user_func, PG(unserialize_callback_func));
+
+		ZVAL_STR_COPY(&args[0], class_name);
+		BG(serialize_lock)++;
+		if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) {
+			BG(serialize_lock)--;
+			if (EG(exception)) {
+				zend_string_release(class_name);
+				zval_ptr_dtor(&user_func);
+				zval_ptr_dtor(&args[0]);
+				return 0;
+			}
+			php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func));
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			zval_ptr_dtor(&user_func);
+			zval_ptr_dtor(&args[0]);
+			break;
+		}
+		BG(serialize_lock)--;
+		zval_ptr_dtor(&retval);
+		if (EG(exception)) {
+			zend_string_release(class_name);
+			zval_ptr_dtor(&user_func);
+			zval_ptr_dtor(&args[0]);
+			return 0;
+		}
+
+		/* The callback function may have defined the class */
+		BG(serialize_lock)++;
+		if ((ce = zend_lookup_class(class_name)) == NULL) {
+			php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func));
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+		}
+		BG(serialize_lock)--;
+
+		zval_ptr_dtor(&user_func);
+		zval_ptr_dtor(&args[0]);
+		break;
+	} while (1);
+
 	*p = YYCURSOR;
-	ZVAL_LONG(rval, parse_iv(start + 2));
-	return 1;
+
+	if (custom_object) {
+		int ret;
+
+		ret = object_custom(UNSERIALIZE_PASSTHRU, ce);
+
+		if (ret && incomplete_class) {
+			php_store_class_name(rval, ZSTR_VAL(class_name), len2);
+		}
+		zend_string_release(class_name);
+		return ret;
+	}
+
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
+
+	if (elements < 0) {
+	   zend_string_release(class_name);
+	   return 0;
+	}
+
+	if (incomplete_class) {
+		php_store_class_name(rval, ZSTR_VAL(class_name), len2);
+	}
+	zend_string_release(class_name);
+
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 1325 "ext/standard/var_unserializer.c"
-yy77:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= '2') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
+#line 1322 "ext/standard/var_unserializer.c"
+yy80:
 	++YYCURSOR;
-#line 708 "ext/standard/var_unserializer.re"
+#line 830 "ext/standard/var_unserializer.re"
 	{
+	size_t len, maxlen;
+	zend_string *str;
+
+	len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len) {
+		*p = start + 2;
+		return 0;
+	}
+
+	if ((str = unserialize_str(&YYCURSOR, len, maxlen)) == NULL) {
+		return 0;
+	}
+
+	if (*(YYCURSOR) != '"') {
+		zend_string_free(str);
+		*p = YYCURSOR;
+		return 0;
+	}
+
+	if (*(YYCURSOR + 1) != ';') {
+		efree(str);
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
+	YYCURSOR += 2;
 	*p = YYCURSOR;
-	ZVAL_BOOL(rval, parse_iv(start + 2));
+
+	ZVAL_STR(rval, str);
 	return 1;
 }
-#line 1339 "ext/standard/var_unserializer.c"
-yy81:
+#line 1359 "ext/standard/var_unserializer.c"
+yy82:
 	++YYCURSOR;
-#line 702 "ext/standard/var_unserializer.re"
+#line 864 "ext/standard/var_unserializer.re"
 	{
+	zend_long elements = parse_iv(start + 2);
+	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
-	ZVAL_NULL(rval);
-	return 1;
-}
-#line 1348 "ext/standard/var_unserializer.c"
-yy83:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy84:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy84;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-#line 677 "ext/standard/var_unserializer.re"
-	{
-	zend_long id;
-
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
+    if (!var_hash) return 0;
 
-	id = parse_uiv(start + 2) - 1;
-	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
+	if (elements < 0 || elements >= HT_MAX_SIZE) {
 		return 0;
 	}
 
-	if (rval_ref == rval) {
-		return 0;
+	if (elements) {
+		array_init_size(rval, elements);
+		/* we can't convert from packed to hash during unserialization, because
+		   reference to some zvals might be keept in var_hash (to support references) */
+		zend_hash_real_init(Z_ARRVAL_P(rval), 0);
+	} else {
+		ZVAL_EMPTY_ARRAY(rval);
+		return finish_nested_data(UNSERIALIZE_PASSTHRU);
 	}
 
-	ZVAL_DEREF(rval_ref);
-	if (Z_TYPE_P(rval_ref) != IS_OBJECT) {
+	/* The array may contain references to itself, in which case we'll be modifying an
+	 * rc>1 array. This is okay, since the array is, ostensibly, only visible to
+	 * unserialize (in practice unserialization handlers also see it). Ideally we should
+	 * prohibit "r:" references to non-objects, as we only generate them for objects. */
+	HT_ALLOW_COW_VIOLATION(Z_ARRVAL_P(rval));
+
+	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) {
 		return 0;
 	}
 
-	ZVAL_COPY(rval, rval_ref);
-
-	return 1;
+	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 1386 "ext/standard/var_unserializer.c"
-yy88:
+#line 1395 "ext/standard/var_unserializer.c"
+yy84:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy89:
+yy85:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy89;
-	if (yych != ';') goto yy18;
+	if (yych <= '9') goto yy85;
+	if (yych == ';') goto yy67;
+	goto yy18;
+yy87:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy92;
+	goto yy18;
+yy88:
 	++YYCURSOR;
-#line 652 "ext/standard/var_unserializer.re"
+#line 897 "ext/standard/var_unserializer.re"
 	{
-	zend_long id;
+	zend_long elements;
+    if (!var_hash) return 0;
 
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
+	if (elements < 0 || elements >= HT_MAX_SIZE) {
+		return 0;
+	}
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
+}
+#line 1425 "ext/standard/var_unserializer.c"
+yy90:
+	++YYCURSOR;
+#line 792 "ext/standard/var_unserializer.re"
+	{
+	size_t len, maxlen;
+	char *str;
 
-	id = parse_uiv(start + 2) - 1;
-	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
+	len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len) {
+		*p = start + 2;
 		return 0;
 	}
 
-	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
+	str = (char*)YYCURSOR;
+
+	YYCURSOR += len;
+
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
 		return 0;
 	}
 
-	if (Z_ISREF_P(rval_ref)) {
-		ZVAL_COPY(rval, rval_ref);
+	if (*(YYCURSOR + 1) != ';') {
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
+	YYCURSOR += 2;
+	*p = YYCURSOR;
+
+	if (len == 0) {
+		ZVAL_EMPTY_STRING(rval);
+	} else if (len == 1) {
+		ZVAL_INTERNED_STR(rval, ZSTR_CHAR((zend_uchar)*str));
 	} else {
-		ZVAL_NEW_REF(rval_ref, rval_ref);
-		ZVAL_COPY(rval, rval_ref);
+		ZVAL_STRINGL(rval, str, len);
+	}
+	return 1;
+}
+#line 1466 "ext/standard/var_unserializer.c"
+yy92:
+	++YYCURSOR;
+#line 767 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+
+	if (!strncmp((char*)start + 2, "NAN", 3)) {
+		ZVAL_DOUBLE(rval, ZEND_NAN);
+	} else if (!strncmp((char*)start + 2, "INF", 3)) {
+		ZVAL_DOUBLE(rval, ZEND_INFINITY);
+	} else if (!strncmp((char*)start + 2, "-INF", 4)) {
+		ZVAL_DOUBLE(rval, -ZEND_INFINITY);
+	} else {
+		ZVAL_NULL(rval);
 	}
 
 	return 1;
 }
-#line 1424 "ext/standard/var_unserializer.c"
+#line 1485 "ext/standard/var_unserializer.c"
 }
-#line 1041 "ext/standard/var_unserializer.re"
+#line 1068 "ext/standard/var_unserializer.re"
 
 
 	return 0;
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 90f13ae01a..86d3502746 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -328,22 +328,43 @@ object = [OC];
 
 static inline zend_long parse_iv2(const unsigned char *p, const unsigned char **q)
 {
-	zend_long result = 0;
-	char *end;
+	zend_ulong result = 0;
+	zend_ulong neg = 0;
+	const unsigned char *start;
 
-	errno = 0;
-	result = ZEND_STRTOL((const char*)p, &end, 0);
+	if (*p == '-') {
+		neg = 1;
+		p++;
+	} else if (UNEXPECTED(*p == '+')) {
+		p++;
+	}
+
+	while (UNEXPECTED(*p == '0')) {
+		p++;
+	}
+
+	start = p;
+
+	while (*p >= '0' && *p <= '9') {
+		result = result * 10 + ((zend_ulong)(*p) - '0');
+		p++;
+	}
 
 	if (q) {
-		*q = (const unsigned char *)end;
+		*q = p;
 	}
 
-	if (errno) {
-		php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
-		return result;
+	/* number too long or overflow */
+	if (UNEXPECTED(p - start > MAX_LENGTH_OF_LONG - 1)
+	 || (SIZEOF_ZEND_LONG == 4
+	 	&& UNEXPECTED(p - start == MAX_LENGTH_OF_LONG - 1)
+	 	&& UNEXPECTED(*start > '2'))
+	 || UNEXPECTED(result - neg > ZEND_LONG_MAX)) {
+		php_error_docref(NULL, E_WARNING, "Numerical result out of range");
+		return (!neg) ? ZEND_LONG_MAX : ZEND_LONG_MIN;
 	}
 
-	return result;
+	return (!neg) ? (zend_long)result : -(zend_long)result;
 }
 
 static inline zend_long parse_iv(const unsigned char *p)
@@ -705,9 +726,15 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 	return 1;
 }
 
-"b:" [01] ";"	{
+"b:0;"	{
+	*p = YYCURSOR;
+	ZVAL_FALSE(rval);
+	return 1;
+}
+
+"b:1;"	{
 	*p = YYCURSOR;
-	ZVAL_BOOL(rval, parse_iv(start + 2));
+	ZVAL_TRUE(rval);
 	return 1;
 }