From: Andrea Faulds Date: Wed, 26 Oct 2016 15:46:36 +0000 (+0100) Subject: Merge branch 'DedupNANINF' X-Git-Tag: php-7.2.0alpha1~1037 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d8f27b2be8498af2505be82f4a0691feea078dba;p=php Merge branch 'DedupNANINF' --- d8f27b2be8498af2505be82f4a0691feea078dba diff --cc ext/standard/var_unserializer.c index f3b997a6ef,3b76af90b7..4cf41e6eeb --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@@ -23,50 -23,8 +23,51 @@@ #include "php.h" #include "ext/standard/php_var.h" #include "php_incomplete_class.h" + #include "zend_portability.h" +struct php_unserialize_data { + void *first; + void *last; + void *first_dtor; + void *last_dtor; + HashTable *allowed_classes; +}; + +PHPAPI php_unserialize_data_t php_var_unserialize_init() { + php_unserialize_data_t d; + /* fprintf(stderr, "UNSERIALIZE_INIT == lock: %u, level: %u\n", BG(serialize_lock), BG(unserialize).level); */ + if (BG(serialize_lock) || !BG(unserialize).level) { + d = ecalloc(1, sizeof(struct php_unserialize_data)); + if (!BG(serialize_lock)) { + BG(unserialize).data = d; + BG(unserialize).level = 1; + } + } else { + d = BG(unserialize).data; + ++BG(unserialize).level; + } + return d; +} + +PHPAPI void php_var_unserialize_destroy(php_unserialize_data_t d) { + /* fprintf(stderr, "UNSERIALIZE_DESTROY == lock: %u, level: %u\n", BG(serialize_lock), BG(unserialize).level); */ + if (BG(serialize_lock) || BG(unserialize).level == 1) { + var_destroy(&d); + efree(d); + } + if (!BG(serialize_lock) && !--BG(unserialize).level) { + BG(unserialize).data = NULL; + } +} + +PHPAPI HashTable *php_var_unserialize_get_allowed_classes(php_unserialize_data_t d) { + return d->allowed_classes; +} +PHPAPI void php_var_unserialize_set_allowed_classes(php_unserialize_data_t d, HashTable *classes) { + d->allowed_classes = classes; +} + + /* {{{ reference-handling for unserializer: var_* */ #define VAR_ENTRIES_MAX 1024 #define VAR_ENTRIES_DBG 0 @@@ -283,7 -239,7 +284,7 @@@ static inline int unserialize_allowed_c #define YYMARKER marker - #line 291 "ext/standard/var_unserializer.re" -#line 247 "ext/standard/var_unserializer.re" ++#line 292 "ext/standard/var_unserializer.re" @@@ -589,7 -515,7 +590,7 @@@ static int php_var_unserialize_internal start = cursor; - #line 593 "ext/standard/var_unserializer.c" -#line 519 "ext/standard/var_unserializer.c" ++#line 594 "ext/standard/var_unserializer.c" { YYCTYPE yych; static const unsigned char yybm[] = { @@@ -630,29 -556,30 +631,30 @@@ yych = *YYCURSOR; switch (yych) { case 'C': - case 'O': goto yy4; + case 'O': goto yy13; case 'N': goto yy5; - case 'R': goto yy6; - case 'S': goto yy7; - case 'a': goto yy8; - case 'b': goto yy9; - case 'd': goto yy10; - case 'i': goto yy11; + case 'R': goto yy2; + case 'S': goto yy10; + case 'a': goto yy11; + case 'b': goto yy6; + case 'd': goto yy8; + case 'i': goto yy7; case 'o': goto yy12; - case 'r': goto yy13; - case 's': goto yy14; - case '}': goto yy15; - default: goto yy2; + case 'r': goto yy4; + case 's': goto yy9; + case '}': goto yy14; + default: goto yy16; } yy2: - ++YYCURSOR; + yych = *(YYMARKER = ++YYCURSOR); + if (yych == ':') goto yy95; yy3: - #line 959 "ext/standard/var_unserializer.re" -#line 885 "ext/standard/var_unserializer.re" ++#line 960 "ext/standard/var_unserializer.re" { return 0; } - #line 653 "ext/standard/var_unserializer.c" -#line 580 "ext/standard/var_unserializer.c" ++#line 655 "ext/standard/var_unserializer.c" yy4: yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy17; + if (yych == ':') goto yy89; goto yy3; yy5: yych = *++YYCURSOR; @@@ -688,21 -615,20 +690,20 @@@ yy12 goto yy3; yy13: yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy28; + if (yych == ':') goto yy17; goto yy3; yy14: - yych = *(YYMARKER = ++YYCURSOR); - if (yych == ':') goto yy29; - goto yy3; - yy15: ++YYCURSOR; - #line 953 "ext/standard/var_unserializer.re" -#line 879 "ext/standard/var_unserializer.re" ++#line 954 "ext/standard/var_unserializer.re" { /* this is the case where we have less data than planned */ php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } - #line 706 "ext/standard/var_unserializer.c" -#line 629 "ext/standard/var_unserializer.c" ++#line 704 "ext/standard/var_unserializer.c" + yy16: + yych = *++YYCURSOR; + goto yy3; yy17: yych = *++YYCURSOR; if (yybm[0+yych] & 128) { @@@ -713,117 -639,206 +714,206 @@@ yy18 YYCURSOR = YYMARKER; goto yy3; yy19: - ++YYCURSOR; - #line 648 "ext/standard/var_unserializer.re" - { - *p = YYCURSOR; - ZVAL_NULL(rval); - return 1; - } - #line 724 "ext/standard/var_unserializer.c" - yy21: yych = *++YYCURSOR; - if (yych <= ',') { - if (yych == '+') goto yy33; - goto yy18; - } else { - if (yych <= '-') goto yy33; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy34; - goto yy18; + if (yybm[0+yych] & 128) { + goto yy20; } - yy22: - yych = *++YYCURSOR; - if (yych == '+') goto yy36; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy37; goto yy18; - yy23: - yych = *++YYCURSOR; - if (yych == '+') goto yy39; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy40; - goto yy18; - yy24: - yych = *++YYCURSOR; + yy20: + ++YYCURSOR; + if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); + yych = *YYCURSOR; + if (yybm[0+yych] & 128) { + goto yy20; + } if (yych <= '/') goto yy18; - if (yych <= '1') goto yy42; - goto yy18; - yy25: + if (yych >= ';') goto yy18; yych = *++YYCURSOR; - if (yych <= '/') { - if (yych <= ',') { - if (yych == '+') goto yy43; - goto yy18; - } else { - if (yych <= '-') goto yy44; - if (yych <= '.') goto yy45; - goto yy18; + if (yych != '"') goto yy18; + ++YYCURSOR; -#line 734 "ext/standard/var_unserializer.re" ++#line 809 "ext/standard/var_unserializer.re" + { + size_t len, len2, len3, maxlen; + zend_long elements; + char *str; + zend_string *class_name; + zend_class_entry *ce; + int incomplete_class = 0; + + int custom_object = 0; + + zval user_func; + zval retval; + zval args[1]; + + if (!var_hash) return 0; + if (*start == 'C') { + custom_object = 1; + } + + len2 = len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len || len == 0) { + *p = start + 2; + return 0; + } + + str = (char*)YYCURSOR; + + YYCURSOR += len; + + if (*(YYCURSOR) != '"') { + *p = YYCURSOR; + return 0; + } + if (*(YYCURSOR+1) != ':') { + *p = YYCURSOR+1; + return 0; + } + + len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); + if (len3 != len) + { + *p = YYCURSOR + len3 - len; + return 0; + } + + class_name = zend_string_init(str, len, 0); + + do { - if(!unserialize_allowed_class(class_name, classes)) { ++ if(!unserialize_allowed_class(class_name, var_hash)) { + incomplete_class = 1; + ce = PHP_IC_ENTRY; + break; } - } else { - if (yych <= 'I') { - if (yych <= '9') goto yy46; - if (yych <= 'H') goto yy18; - goto yy48; - } else { - if (yych == 'N') goto yy49; - goto yy18; + + /* Try to find class directly */ + BG(serialize_lock)++; + ce = zend_lookup_class(class_name); + if (ce) { + BG(serialize_lock)--; + if (EG(exception)) { + zend_string_release(class_name); + return 0; + } + break; } + BG(serialize_lock)--; + + if (EG(exception)) { + zend_string_release(class_name); + return 0; + } + + /* Check for unserialize callback */ + if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) { + incomplete_class = 1; + ce = PHP_IC_ENTRY; + break; + } + + /* Call unserialize callback */ + ZVAL_STRING(&user_func, PG(unserialize_callback_func)); + + ZVAL_STR_COPY(&args[0], class_name); + BG(serialize_lock)++; + if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) { + BG(serialize_lock)--; + if (EG(exception)) { + zend_string_release(class_name); + zval_ptr_dtor(&user_func); + zval_ptr_dtor(&args[0]); + return 0; + } + php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func)); + incomplete_class = 1; + ce = PHP_IC_ENTRY; + zval_ptr_dtor(&user_func); + zval_ptr_dtor(&args[0]); + break; + } + BG(serialize_lock)--; + zval_ptr_dtor(&retval); + if (EG(exception)) { + zend_string_release(class_name); + zval_ptr_dtor(&user_func); + zval_ptr_dtor(&args[0]); + return 0; + } + + /* The callback function may have defined the class */ + if ((ce = zend_lookup_class(class_name)) == NULL) { + php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); + incomplete_class = 1; + ce = PHP_IC_ENTRY; + } + + zval_ptr_dtor(&user_func); + zval_ptr_dtor(&args[0]); + break; + } while (1); + + *p = YYCURSOR; + + if (custom_object) { + int ret; + + ret = object_custom(UNSERIALIZE_PASSTHRU, ce); + + if (ret && incomplete_class) { + php_store_class_name(rval, ZSTR_VAL(class_name), len2); + } + zend_string_release(class_name); + return ret; } - yy26: - yych = *++YYCURSOR; - if (yych <= ',') { - if (yych == '+') goto yy50; - goto yy18; - } else { - if (yych <= '-') goto yy50; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy51; - goto yy18; - } - yy27: - yych = *++YYCURSOR; - if (yych <= ',') { - if (yych == '+') goto yy53; - goto yy18; - } else { - if (yych <= '-') goto yy53; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy54; - goto yy18; + + elements = object_common1(UNSERIALIZE_PASSTHRU, ce); + + if (incomplete_class) { + php_store_class_name(rval, ZSTR_VAL(class_name), len2); } - yy28: + zend_string_release(class_name); + + return object_common2(UNSERIALIZE_PASSTHRU, elements); + } -#line 805 "ext/standard/var_unserializer.c" ++#line 880 "ext/standard/var_unserializer.c" + yy25: yych = *++YYCURSOR; if (yych <= ',') { - if (yych == '+') goto yy56; - goto yy18; + if (yych != '+') goto yy18; } else { - if (yych <= '-') goto yy56; + if (yych <= '-') goto yy26; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy57; + if (yych <= '9') goto yy27; goto yy18; } - yy29: + yy26: yych = *++YYCURSOR; - if (yych == '+') goto yy59; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy60; - goto yy18; - yy30: - yych = *++YYCURSOR; - if (yybm[0+yych] & 128) { - goto yy31; - } - goto yy18; - yy31: + if (yych >= ':') goto yy18; + yy27: ++YYCURSOR; if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); yych = *YYCURSOR; - if (yybm[0+yych] & 128) { - goto yy31; - } if (yych <= '/') goto yy18; - if (yych <= ':') goto yy62; + if (yych <= '9') goto yy27; + if (yych >= ';') goto yy18; + yych = *++YYCURSOR; + if (yych != '"') goto yy18; + ++YYCURSOR; -#line 727 "ext/standard/var_unserializer.re" ++#line 802 "ext/standard/var_unserializer.re" + { + if (!var_hash) return 0; + + return object_common2(UNSERIALIZE_PASSTHRU, + object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); + } -#line 837 "ext/standard/var_unserializer.c" ++#line 912 "ext/standard/var_unserializer.c" + yy32: + yych = *++YYCURSOR; + if (yych == '+') goto yy33; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy34; goto yy18; yy33: yych = *++YYCURSOR; @@@ -835,9 -850,42 +925,42 @@@ yy34 yych = *YYCURSOR; if (yych <= '/') goto yy18; if (yych <= '9') goto yy34; - if (yych == ';') goto yy63; + if (yych >= ';') goto yy18; + yych = *++YYCURSOR; + if (yych != '{') goto yy18; + ++YYCURSOR; -#line 703 "ext/standard/var_unserializer.re" ++#line 778 "ext/standard/var_unserializer.re" + { + zend_long elements = parse_iv(start + 2); + /* use iv() not uiv() in order to check data range */ + *p = YYCURSOR; + if (!var_hash) return 0; + + if (elements < 0) { + return 0; + } + + array_init_size(rval, elements); -//??? we can't convert from packed to hash during unserialization, because -//??? reference to some zvals might be keept in var_hash (to support references) + if (elements) { ++ /* we can't convert from packed to hash during unserialization, because ++ reference to some zvals might be keept in var_hash (to support references) */ + zend_hash_real_init(Z_ARRVAL_P(rval), 0); + } + + if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) { + return 0; + } + + return finish_nested_data(UNSERIALIZE_PASSTHRU); + } -#line 882 "ext/standard/var_unserializer.c" ++#line 957 "ext/standard/var_unserializer.c" + yy39: + yych = *++YYCURSOR; + if (yych == '+') goto yy40; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy41; goto yy18; - yy36: + yy40: yych = *++YYCURSOR; if (yych <= '/') goto yy18; if (yych >= ':') goto yy18; @@@ -846,10 -894,53 +969,53 @@@ yy41 if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); yych = *YYCURSOR; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy37; - if (yych <= ':') goto yy65; + if (yych <= '9') goto yy41; + if (yych >= ';') goto yy18; + yych = *++YYCURSOR; + if (yych != '"') goto yy18; + ++YYCURSOR; -#line 669 "ext/standard/var_unserializer.re" ++#line 744 "ext/standard/var_unserializer.re" + { + size_t len, maxlen; + zend_string *str; + + len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len) { + *p = start + 2; + return 0; + } + + if ((str = unserialize_str(&YYCURSOR, len, maxlen)) == NULL) { + return 0; + } + + if (*(YYCURSOR) != '"') { + zend_string_free(str); + *p = YYCURSOR; + return 0; + } + + if (*(YYCURSOR + 1) != ';') { + efree(str); + *p = YYCURSOR + 1; + return 0; + } + + YYCURSOR += 2; + *p = YYCURSOR; + + ZVAL_STR(rval, str); + return 1; + } -#line 937 "ext/standard/var_unserializer.c" ++#line 1012 "ext/standard/var_unserializer.c" + yy46: + yych = *++YYCURSOR; + if (yych == '+') goto yy47; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy48; goto yy18; - yy39: + yy47: yych = *++YYCURSOR; if (yych <= '/') goto yy18; if (yych >= ':') goto yy18; @@@ -858,34 -949,86 +1024,86 @@@ yy48 if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); yych = *YYCURSOR; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy40; - if (yych <= ':') goto yy66; - goto yy18; - yy42: + if (yych <= '9') goto yy48; + if (yych >= ';') goto yy18; yych = *++YYCURSOR; - if (yych == ';') goto yy67; - goto yy18; - yy43: + if (yych != '"') goto yy18; + ++YYCURSOR; -#line 637 "ext/standard/var_unserializer.re" ++#line 712 "ext/standard/var_unserializer.re" + { + size_t len, maxlen; + char *str; + + len = parse_uiv(start + 2); + maxlen = max - YYCURSOR; + if (maxlen < len) { + *p = start + 2; + return 0; + } + + str = (char*)YYCURSOR; + + YYCURSOR += len; + + if (*(YYCURSOR) != '"') { + *p = YYCURSOR; + return 0; + } + + if (*(YYCURSOR + 1) != ';') { + *p = YYCURSOR + 1; + return 0; + } + + YYCURSOR += 2; + *p = YYCURSOR; + + ZVAL_STRINGL(rval, str, len); + return 1; + } -#line 990 "ext/standard/var_unserializer.c" ++#line 1065 "ext/standard/var_unserializer.c" + yy53: yych = *++YYCURSOR; - if (yych == '.') goto yy45; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy46; + if (yych <= '/') { + if (yych <= ',') { + if (yych == '+') goto yy57; + goto yy18; + } else { + if (yych <= '-') goto yy55; + if (yych <= '.') goto yy60; + goto yy18; + } + } else { + if (yych <= 'I') { + if (yych <= '9') goto yy58; + if (yych <= 'H') goto yy18; + goto yy56; + } else { + if (yych != 'N') goto yy18; + } + } + yych = *++YYCURSOR; + if (yych == 'A') goto yy76; goto yy18; - yy44: + yy55: yych = *++YYCURSOR; if (yych <= '/') { - if (yych != '.') goto yy18; - } else { - if (yych <= '9') goto yy46; - if (yych == 'I') goto yy48; + if (yych == '.') goto yy60; goto yy18; + } else { + if (yych <= '9') goto yy58; + if (yych != 'I') goto yy18; } - yy45: + yy56: yych = *++YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy69; + if (yych == 'N') goto yy72; goto yy18; - yy46: + yy57: + yych = *++YYCURSOR; + if (yych == '.') goto yy60; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy58: ++YYCURSOR; if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4); yych = *YYCURSOR; @@@ -956,65 -1055,69 +1130,69 @@@ yy60 yych = *++YYCURSOR; if (yych <= '/') goto yy18; if (yych >= ':') goto yy18; - yy60: + yy61: ++YYCURSOR; - if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2); + if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4); yych = *YYCURSOR; - if (yych <= '/') goto yy18; - if (yych <= '9') goto yy60; - if (yych <= ':') goto yy81; - goto yy18; - yy62: - yych = *++YYCURSOR; - if (yych == '"') goto yy82; - goto yy18; + if (yych <= ';') { + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy61; + if (yych <= ':') goto yy18; + } else { + if (yych <= 'E') { + if (yych <= 'D') goto yy18; + goto yy65; + } else { + if (yych == 'e') goto yy65; + goto yy18; + } + } yy63: ++YYCURSOR; - #line 597 "ext/standard/var_unserializer.re" -#line 628 "ext/standard/var_unserializer.re" ++#line 703 "ext/standard/var_unserializer.re" { - zend_long id; - - *p = YYCURSOR; - if (!var_hash) return 0; - - id = parse_iv(start + 2) - 1; - if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { - return 0; - } - - zval_ptr_dtor(rval); - if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) { - ZVAL_UNDEF(rval); - return 1; - } - if (Z_ISREF_P(rval_ref)) { - ZVAL_COPY(rval, rval_ref); - } else { - ZVAL_NEW_REF(rval_ref, rval_ref); - ZVAL_COPY(rval, rval_ref); - } - + #if SIZEOF_ZEND_LONG == 4 + use_double: + #endif + *p = YYCURSOR; + ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL)); return 1; } - #line 1000 "ext/standard/var_unserializer.c" -#line 1087 "ext/standard/var_unserializer.c" ++#line 1162 "ext/standard/var_unserializer.c" yy65: yych = *++YYCURSOR; - if (yych == '"') goto yy84; - goto yy18; + if (yych <= ',') { + if (yych != '+') goto yy18; + } else { + if (yych <= '-') goto yy66; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy67; + goto yy18; + } yy66: yych = *++YYCURSOR; - if (yych == '{') goto yy86; - goto yy18; + if (yych <= ',') { + if (yych == '+') goto yy69; + goto yy18; + } else { + if (yych <= '-') goto yy69; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + } yy67: ++YYCURSOR; - #line 654 "ext/standard/var_unserializer.re" - { - *p = YYCURSOR; - ZVAL_BOOL(rval, parse_iv(start + 2)); - return 1; - } - #line 1017 "ext/standard/var_unserializer.c" + if (YYLIMIT <= YYCURSOR) YYFILL(1); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy67; + if (yych == ';') goto yy63; + goto yy18; yy69: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy67; + goto yy18; + yy70: ++YYCURSOR; if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4); yych = *YYCURSOR; @@@ -1031,40 -1135,57 +1210,57 @@@ goto yy18; } } - yy71: + yy72: + yych = *++YYCURSOR; + if (yych != 'F') goto yy18; + yy73: + yych = *++YYCURSOR; + if (yych != ';') goto yy18; ++YYCURSOR; - #line 702 "ext/standard/var_unserializer.re" -#line 612 "ext/standard/var_unserializer.re" ++#line 687 "ext/standard/var_unserializer.re" { - #if SIZEOF_ZEND_LONG == 4 - use_double: - #endif *p = YYCURSOR; - ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL)); + + if (!strncmp((char*)start + 2, "NAN", 3)) { + ZVAL_DOUBLE(rval, ZEND_NAN); + } else if (!strncmp((char*)start + 2, "INF", 3)) { + ZVAL_DOUBLE(rval, ZEND_INFINITY); + } else if (!strncmp((char*)start + 2, "-INF", 4)) { + ZVAL_DOUBLE(rval, -ZEND_INFINITY); + } else { + ZVAL_NULL(rval); + } + return 1; } - #line 1046 "ext/standard/var_unserializer.c" - yy73: -#line 1162 "ext/standard/var_unserializer.c" ++#line 1237 "ext/standard/var_unserializer.c" + yy76: + yych = *++YYCURSOR; + if (yych == 'N') goto yy73; + goto yy18; + yy77: yych = *++YYCURSOR; if (yych <= ',') { - if (yych == '+') goto yy88; - goto yy18; + if (yych != '+') goto yy18; } else { - if (yych <= '-') goto yy88; + if (yych <= '-') goto yy78; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy89; + if (yych <= '9') goto yy79; goto yy18; } - yy74: - yych = *++YYCURSOR; - if (yych == 'F') goto yy91; - goto yy18; - yy75: + yy78: yych = *++YYCURSOR; - if (yych == 'N') goto yy91; - goto yy18; - yy76: + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy79: + ++YYCURSOR; + if (YYLIMIT <= YYCURSOR) YYFILL(1); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy79; + if (yych != ';') goto yy18; ++YYCURSOR; - #line 660 "ext/standard/var_unserializer.re" -#line 586 "ext/standard/var_unserializer.re" ++#line 661 "ext/standard/var_unserializer.re" { #if SIZEOF_ZEND_LONG == 4 int digits = YYCURSOR - start - 3; @@@ -1090,206 -1211,61 +1286,61 @@@ ZVAL_LONG(rval, parse_iv(start + 2)); return 1; } - #line 1094 "ext/standard/var_unserializer.c" - yy78: -#line 1215 "ext/standard/var_unserializer.c" ++#line 1290 "ext/standard/var_unserializer.c" + yy83: yych = *++YYCURSOR; - if (yych == '"') goto yy92; - goto yy18; - yy79: + if (yych <= '/') goto yy18; + if (yych >= '2') goto yy18; + yych = *++YYCURSOR; + if (yych != ';') goto yy18; ++YYCURSOR; - #line 623 "ext/standard/var_unserializer.re" -#line 580 "ext/standard/var_unserializer.re" ++#line 655 "ext/standard/var_unserializer.re" { - zend_long id; - - *p = YYCURSOR; - if (!var_hash) return 0; - - id = parse_iv(start + 2) - 1; - if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { - return 0; - } - - if (rval_ref == rval) { - return 0; - } - - if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) { - ZVAL_UNDEF(rval); - return 1; - } - - ZVAL_COPY(rval, rval_ref); - + *p = YYCURSOR; + ZVAL_BOOL(rval, parse_iv(start + 2)); return 1; } - #line 1126 "ext/standard/var_unserializer.c" - yy81: - yych = *++YYCURSOR; - if (yych == '"') goto yy94; - goto yy18; - yy82: -#line 1229 "ext/standard/var_unserializer.c" ++#line 1304 "ext/standard/var_unserializer.c" + yy87: ++YYCURSOR; - #line 808 "ext/standard/var_unserializer.re" -#line 574 "ext/standard/var_unserializer.re" ++#line 649 "ext/standard/var_unserializer.re" { - size_t len, len2, len3, maxlen; - zend_long elements; - char *str; - zend_string *class_name; - zend_class_entry *ce; - int incomplete_class = 0; - - int custom_object = 0; - - zval user_func; - zval retval; - zval args[1]; - - if (!var_hash) return 0; - if (*start == 'C') { - custom_object = 1; - } - - len2 = len = parse_uiv(start + 2); - maxlen = max - YYCURSOR; - if (maxlen < len || len == 0) { - *p = start + 2; - return 0; - } - - str = (char*)YYCURSOR; - - YYCURSOR += len; - - if (*(YYCURSOR) != '"') { - *p = YYCURSOR; - return 0; - } - if (*(YYCURSOR+1) != ':') { - *p = YYCURSOR+1; - return 0; - } - - len3 = strspn(str, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\"); - if (len3 != len) - { - *p = YYCURSOR + len3 - len; - return 0; - } - - class_name = zend_string_init(str, len, 0); - - do { - if(!unserialize_allowed_class(class_name, var_hash)) { - incomplete_class = 1; - ce = PHP_IC_ENTRY; - break; - } - - /* Try to find class directly */ - BG(serialize_lock)++; - ce = zend_lookup_class(class_name); - if (ce) { - BG(serialize_lock)--; - if (EG(exception)) { - zend_string_release(class_name); - return 0; - } - break; - } - BG(serialize_lock)--; - - if (EG(exception)) { - zend_string_release(class_name); - return 0; - } - - /* Check for unserialize callback */ - if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) { - incomplete_class = 1; - ce = PHP_IC_ENTRY; - break; - } - - /* Call unserialize callback */ - ZVAL_STRING(&user_func, PG(unserialize_callback_func)); - - ZVAL_STR_COPY(&args[0], class_name); - BG(serialize_lock)++; - if (call_user_function_ex(CG(function_table), NULL, &user_func, &retval, 1, args, 0, NULL) != SUCCESS) { - BG(serialize_lock)--; - if (EG(exception)) { - zend_string_release(class_name); - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - return 0; - } - php_error_docref(NULL, E_WARNING, "defined (%s) but not found", Z_STRVAL(user_func)); - incomplete_class = 1; - ce = PHP_IC_ENTRY; - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - break; - } - BG(serialize_lock)--; - zval_ptr_dtor(&retval); - if (EG(exception)) { - zend_string_release(class_name); - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - return 0; - } - - /* The callback function may have defined the class */ - if ((ce = zend_lookup_class(class_name)) == NULL) { - php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func)); - incomplete_class = 1; - ce = PHP_IC_ENTRY; - } - - zval_ptr_dtor(&user_func); - zval_ptr_dtor(&args[0]); - break; - } while (1); - *p = YYCURSOR; - - if (custom_object) { - int ret; - - ret = object_custom(UNSERIALIZE_PASSTHRU, ce); - - if (ret && incomplete_class) { - php_store_class_name(rval, ZSTR_VAL(class_name), len2); - } - zend_string_release(class_name); - return ret; - } - - elements = object_common1(UNSERIALIZE_PASSTHRU, ce); - - if (incomplete_class) { - php_store_class_name(rval, ZSTR_VAL(class_name), len2); - } - zend_string_release(class_name); - - return object_common2(UNSERIALIZE_PASSTHRU, elements); + ZVAL_NULL(rval); + return 1; } - #line 1278 "ext/standard/var_unserializer.c" - yy84: -#line 1238 "ext/standard/var_unserializer.c" ++#line 1313 "ext/standard/var_unserializer.c" + yy89: + yych = *++YYCURSOR; + if (yych <= ',') { + if (yych != '+') goto yy18; + } else { + if (yych <= '-') goto yy90; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy91; + goto yy18; + } + yy90: + yych = *++YYCURSOR; + if (yych <= '/') goto yy18; + if (yych >= ':') goto yy18; + yy91: + ++YYCURSOR; + if (YYLIMIT <= YYCURSOR) YYFILL(1); + yych = *YYCURSOR; + if (yych <= '/') goto yy18; + if (yych <= '9') goto yy91; + if (yych != ';') goto yy18; ++YYCURSOR; - #line 743 "ext/standard/var_unserializer.re" -#line 549 "ext/standard/var_unserializer.re" ++#line 624 "ext/standard/var_unserializer.re" { - size_t len, maxlen; - zend_string *str; + zend_long id; - len = parse_uiv(start + 2); - maxlen = max - YYCURSOR; - if (maxlen < len) { - *p = start + 2; - return 0; - } + *p = YYCURSOR; + if (!var_hash) return 0; - if ((str = unserialize_str(&YYCURSOR, len, maxlen)) == NULL) { + id = parse_iv(start + 2) - 1; + if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { return 0; } @@@ -1299,51 -1273,20 +1348,20 @@@ return 0; } - if (*(YYCURSOR + 1) != ';') { - efree(str); - *p = YYCURSOR + 1; - return 0; + if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) { + ZVAL_UNDEF(rval); + return 1; } - YYCURSOR += 2; - *p = YYCURSOR; + ZVAL_COPY(rval, rval_ref); - ZVAL_STR(rval, str); return 1; } - #line 1315 "ext/standard/var_unserializer.c" - yy86: - ++YYCURSOR; - #line 777 "ext/standard/var_unserializer.re" - { - zend_long elements = parse_iv(start + 2); - /* use iv() not uiv() in order to check data range */ - *p = YYCURSOR; - if (!var_hash) return 0; - - if (elements < 0) { - return 0; - } - - array_init_size(rval, elements); - if (elements) { - /* we can't convert from packed to hash during unserialization, because - reference to some zvals might be keept in var_hash (to support references) */ - zend_hash_real_init(Z_ARRVAL_P(rval), 0); - } - - if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) { - return 0; - } - - return finish_nested_data(UNSERIALIZE_PASSTHRU); - } - #line 1342 "ext/standard/var_unserializer.c" - yy88: -#line 1286 "ext/standard/var_unserializer.c" ++#line 1361 "ext/standard/var_unserializer.c" + yy95: yych = *++YYCURSOR; if (yych <= ',') { - if (yych == '+') goto yy96; - goto yy18; + if (yych != '+') goto yy18; } else { if (yych <= '-') goto yy96; if (yych <= '/') goto yy18; @@@ -1354,43 -1302,18 +1377,18 @@@ yy97 if (YYLIMIT <= YYCURSOR) YYFILL(1); yych = *YYCURSOR; if (yych <= '/') goto yy18; - if (yych <= '9') goto yy89; - if (yych == ';') goto yy71; - goto yy18; - yy91: - yych = *++YYCURSOR; - if (yych == ';') goto yy97; - goto yy18; - yy92: - ++YYCURSOR; - #line 801 "ext/standard/var_unserializer.re" - { - if (!var_hash) return 0; - - return object_common2(UNSERIALIZE_PASSTHRU, - object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); - } - #line 1374 "ext/standard/var_unserializer.c" - yy94: + if (yych <= '9') goto yy97; + if (yych != ';') goto yy18; ++YYCURSOR; - #line 711 "ext/standard/var_unserializer.re" -#line 523 "ext/standard/var_unserializer.re" ++#line 598 "ext/standard/var_unserializer.re" { - size_t len, maxlen; - char *str; - - len = parse_uiv(start + 2); - maxlen = max - YYCURSOR; - if (maxlen < len) { - *p = start + 2; - return 0; - } - - str = (char*)YYCURSOR; + zend_long id; - YYCURSOR += len; + *p = YYCURSOR; + if (!var_hash) return 0; - if (*(YYCURSOR) != '"') { - *p = YYCURSOR; + id = parse_iv(start + 2) - 1; + if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) { return 0; } @@@ -1429,9 -1331,9 +1406,9 @@@ return 1; } - #line 1433 "ext/standard/var_unserializer.c" -#line 1335 "ext/standard/var_unserializer.c" ++#line 1410 "ext/standard/var_unserializer.c" } - #line 961 "ext/standard/var_unserializer.re" -#line 887 "ext/standard/var_unserializer.re" ++#line 962 "ext/standard/var_unserializer.re" return 0; diff --cc ext/standard/var_unserializer.re index 6d53cb6249,4920e2bc8d..4b6266cb1c --- a/ext/standard/var_unserializer.re +++ b/ext/standard/var_unserializer.re @@@ -21,50 -21,8 +21,51 @@@ #include "php.h" #include "ext/standard/php_var.h" #include "php_incomplete_class.h" + #include "zend_portability.h" +struct php_unserialize_data { + void *first; + void *last; + void *first_dtor; + void *last_dtor; + HashTable *allowed_classes; +}; + +PHPAPI php_unserialize_data_t php_var_unserialize_init() { + php_unserialize_data_t d; + /* fprintf(stderr, "UNSERIALIZE_INIT == lock: %u, level: %u\n", BG(serialize_lock), BG(unserialize).level); */ + if (BG(serialize_lock) || !BG(unserialize).level) { + d = ecalloc(1, sizeof(struct php_unserialize_data)); + if (!BG(serialize_lock)) { + BG(unserialize).data = d; + BG(unserialize).level = 1; + } + } else { + d = BG(unserialize).data; + ++BG(unserialize).level; + } + return d; +} + +PHPAPI void php_var_unserialize_destroy(php_unserialize_data_t d) { + /* fprintf(stderr, "UNSERIALIZE_DESTROY == lock: %u, level: %u\n", BG(serialize_lock), BG(unserialize).level); */ + if (BG(serialize_lock) || BG(unserialize).level == 1) { + var_destroy(&d); + efree(d); + } + if (!BG(serialize_lock) && !--BG(unserialize).level) { + BG(unserialize).data = NULL; + } +} + +PHPAPI HashTable *php_var_unserialize_get_allowed_classes(php_unserialize_data_t d) { + return d->allowed_classes; +} +PHPAPI void php_var_unserialize_set_allowed_classes(php_unserialize_data_t d, HashTable *classes) { + d->allowed_classes = classes; +} + + /* {{{ reference-handling for unserializer: var_* */ #define VAR_ENTRIES_MAX 1024 #define VAR_ENTRIES_DBG 0