From c64376bda535c13630aba0f1b223a11eabcd9a2a Mon Sep 17 00:00:00 2001
From: Marcus Boerger <helly@php.net>
Date: Tue, 23 Mar 2004 20:54:00 +0000
Subject: [PATCH] Bugfix #27646: Cannot serialize/unserialize non-finite
 numeric values

---
 ext/standard/var_unserializer.c  | 326 ++++++++++++++++++++-----------
 ext/standard/var_unserializer.re |   2 +-
 2 files changed, 211 insertions(+), 117 deletions(-)

diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 97982c3a04..f9da74d4c3 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -1,6 +1,6 @@
-/* Generated by re2c 0.5 on Tue Feb  3 16:01:43 2004 */
-#line 1 "var_unserializer.re"
-/* 
+/* Generated by re2c 0.9.2 on Tue Mar 23 21:48:54 2004 */
+#line 1 "/usr/src/php5/ext/standard/var_unserializer.re"
+/*
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
@@ -111,7 +111,7 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 #define YYMARKER marker
 
 
-#line 118
+#line 118 "/usr/src/php5/ext/standard/var_unserializer.re"
 
 
 
@@ -252,6 +252,8 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 
 	
 	
+
+#line 7 "re2c-output.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept;
@@ -292,7 +294,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	goto yy0;
 yy1:	++YYCURSOR;
 yy0:
-	if((YYLIMIT - YYCURSOR) < 5) YYFILL(5);
+	if((YYLIMIT - YYCURSOR) < 6) YYFILL(6);
 	yych = *YYCURSOR;
 	if(yych <= 'd'){
 		if(yych <= 'R'){
@@ -331,6 +333,7 @@ yy0:
 			} else {
 				if(yych <= '}')	goto yy14;
 				if(yych <= '\277')	goto yy16;
+				goto yy2;
 			}
 		}
 	}
@@ -340,24 +343,26 @@ yy2:	YYCURSOR = YYMARKER;
 	}
 yy3:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy81;
+	if(yych == ':')	goto yy86;
+	goto yy4;
 yy4:
-#line 461
-	{ return 0; }
+#line 461 "/usr/src/php5/ext/standard/var_unserializer.re"
+{ return 0; }
+#line 102 "re2c-output.c"
 yy5:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy75;
+	if(yych == ':')	goto yy80;
 	goto yy4;
 yy6:	yych = *++YYCURSOR;
-	if(yych == ';')	goto yy73;
+	if(yych == ';')	goto yy78;
 	goto yy4;
 yy7:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy67;
+	if(yych == ':')	goto yy72;
 	goto yy4;
 yy8:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy61;
+	if(yych == ':')	goto yy66;
 	goto yy4;
 yy9:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -380,32 +385,39 @@ yy13:	yyaccept = 0;
 	if(yych == ':')	goto yy17;
 	goto yy4;
 yy14:	yych = *++YYCURSOR;
+	goto yy15;
 yy15:
-#line 455
-	{
+#line 455 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
+#line 147 "re2c-output.c"
 yy16:	yych = *++YYCURSOR;
 	goto yy4;
 yy17:	yych = *++YYCURSOR;
 	if(yybm[0+yych] & 128)	goto yy19;
 	if(yych != '+')	goto yy2;
+	goto yy18;
 yy18:	yych = *++YYCURSOR;
 	if(yybm[0+yych] & 128)	goto yy19;
 	goto yy2;
 yy19:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
+	goto yy20;
 yy20:	if(yybm[0+yych] & 128)	goto yy19;
 	if(yych != ':')	goto yy2;
+	goto yy21;
 yy21:	yych = *++YYCURSOR;
 	if(yych != '"')	goto yy2;
+	goto yy22;
 yy22:	yych = *++YYCURSOR;
+	goto yy23;
 yy23:
-#line 376
-	{
+#line 376 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	int len;
 	int elements;
 	int len2;
@@ -483,9 +495,11 @@ yy23:
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
+#line 249 "re2c-output.c"
 yy24:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
+		goto yy25;
 	} else {
 		if(yych <= '-')	goto yy25;
 		if(yych <= '/')	goto yy2;
@@ -495,24 +509,30 @@ yy24:	yych = *++YYCURSOR;
 yy25:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
+	goto yy26;
 yy26:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
+	goto yy27;
 yy27:	if(yych <= '/')	goto yy2;
 	if(yych <= '9')	goto yy26;
 	if(yych >= ';')	goto yy2;
+	goto yy28;
 yy28:	yych = *++YYCURSOR;
 	if(yych != '"')	goto yy2;
+	goto yy29;
 yy29:	yych = *++YYCURSOR;
+	goto yy30;
 yy30:
-#line 368
-	{
+#line 368 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 
 	INIT_PZVAL(*rval);
 	
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
+#line 286 "re2c-output.c"
 yy31:	yych = *++YYCURSOR;
 	if(yych == '+')	goto yy32;
 	if(yych <= '/')	goto yy2;
@@ -521,18 +541,23 @@ yy31:	yych = *++YYCURSOR;
 yy32:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
+	goto yy33;
 yy33:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
+	goto yy34;
 yy34:	if(yych <= '/')	goto yy2;
 	if(yych <= '9')	goto yy33;
 	if(yych >= ';')	goto yy2;
+	goto yy35;
 yy35:	yych = *++YYCURSOR;
 	if(yych != '{')	goto yy2;
+	goto yy36;
 yy36:	yych = *++YYCURSOR;
+	goto yy37;
 yy37:
-#line 350
-	{
+#line 350 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	int elements = parse_iv(start + 2);
 
 	*p = YYCURSOR;
@@ -549,6 +574,7 @@ yy37:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
+#line 328 "re2c-output.c"
 yy38:	yych = *++YYCURSOR;
 	if(yych == '+')	goto yy39;
 	if(yych <= '/')	goto yy2;
@@ -557,18 +583,23 @@ yy38:	yych = *++YYCURSOR;
 yy39:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
+	goto yy40;
 yy40:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
+	goto yy41;
 yy41:	if(yych <= '/')	goto yy2;
 	if(yych <= '9')	goto yy40;
 	if(yych >= ';')	goto yy2;
+	goto yy42;
 yy42:	yych = *++YYCURSOR;
 	if(yych != '"')	goto yy2;
+	goto yy43;
 yy43:	yych = *++YYCURSOR;
+	goto yy44;
 yy44:
-#line 330
-	{
+#line 330 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	int len;
 	char *str;
 
@@ -587,27 +618,40 @@ yy44:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
+#line 372 "re2c-output.c"
 yy45:	yych = *++YYCURSOR;
-	if(yych <= '-'){
-		if(yych == '+')	goto yy46;
-		if(yych <= ',')	goto yy2;
+	if(yych <= '/'){
+		if(yych <= ','){
+			if(yych != '+')	goto yy2;
+			goto yy46;
+		} else {
+			if(yych <= '-')	goto yy46;
+			if(yych <= '.')	goto yy49;
+			goto yy2;
+		}
 	} else {
-		if(yych <= '.')	goto yy49;
-		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy47;
-		goto yy2;
+		if(yych <= 'I'){
+			if(yych <= '9')	goto yy47;
+			if(yych <= 'H')	goto yy2;
+			goto yy51;
+		} else {
+			if(yych == 'N')	goto yy50;
+			goto yy2;
+		}
 	}
 yy46:	yych = *++YYCURSOR;
 	if(yych == '.')	goto yy49;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
+	goto yy47;
 yy47:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
+	goto yy48;
 yy48:	if(yych <= ':'){
 		if(yych <= '.'){
 			if(yych <= '-')	goto yy2;
-			goto yy59;
+			goto yy64;
 		} else {
 			if(yych <= '/')	goto yy2;
 			if(yych <= '9')	goto yy47;
@@ -615,173 +659,216 @@ yy48:	if(yych <= ':'){
 		}
 	} else {
 		if(yych <= 'E'){
-			if(yych <= ';')	goto yy52;
+			if(yych <= ';')	goto yy54;
 			if(yych <= 'D')	goto yy2;
-			goto yy54;
+			goto yy59;
 		} else {
-			if(yych == 'e')	goto yy54;
+			if(yych == 'e')	goto yy59;
 			goto yy2;
 		}
 	}
 yy49:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
-	if(yych >= ':')	goto yy2;
-yy50:	++YYCURSOR;
+	if(yych <= '9')	goto yy57;
+	goto yy2;
+yy50:	yych = *++YYCURSOR;
+	if(yych == 'A')	goto yy56;
+	goto yy2;
+yy51:	yych = *++YYCURSOR;
+	if(yych != 'N')	goto yy2;
+	goto yy52;
+yy52:	yych = *++YYCURSOR;
+	if(yych != 'F')	goto yy2;
+	goto yy53;
+yy53:	yych = *++YYCURSOR;
+	if(yych != ';')	goto yy2;
+	goto yy54;
+yy54:	yych = *++YYCURSOR;
+	goto yy55;
+yy55:
+#line 323 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
+	*p = YYCURSOR;
+	INIT_PZVAL(*rval);
+	ZVAL_DOUBLE(*rval, atof(start + 2));
+	return 1;
+}
+#line 447 "re2c-output.c"
+yy56:	yych = *++YYCURSOR;
+	if(yych == 'N')	goto yy53;
+	goto yy2;
+yy57:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy51:	if(yych <= ';'){
+	goto yy58;
+yy58:	if(yych <= ';'){
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy50;
+		if(yych <= '9')	goto yy57;
 		if(yych <= ':')	goto yy2;
+		goto yy54;
 	} else {
 		if(yych <= 'E'){
 			if(yych <= 'D')	goto yy2;
-			goto yy54;
+			goto yy59;
 		} else {
-			if(yych == 'e')	goto yy54;
-			goto yy2;
+			if(yych != 'e')	goto yy2;
+			goto yy59;
 		}
 	}
-yy52:	yych = *++YYCURSOR;
-yy53:
-#line 323
-	{
-	*p = YYCURSOR;
-	INIT_PZVAL(*rval);
-	ZVAL_DOUBLE(*rval, atof(start + 2));
-	return 1;
-}
-yy54:	yych = *++YYCURSOR;
+yy59:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
+		goto yy60;
 	} else {
-		if(yych <= '-')	goto yy55;
+		if(yych <= '-')	goto yy60;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy56;
+		if(yych <= '9')	goto yy61;
 		goto yy2;
 	}
-yy55:	yych = *++YYCURSOR;
+yy60:	yych = *++YYCURSOR;
 	if(yych <= ','){
-		if(yych == '+')	goto yy58;
+		if(yych == '+')	goto yy63;
 		goto yy2;
 	} else {
-		if(yych <= '-')	goto yy58;
+		if(yych <= '-')	goto yy63;
 		if(yych <= '/')	goto yy2;
 		if(yych >= ':')	goto yy2;
+		goto yy61;
 	}
-yy56:	++YYCURSOR;
+yy61:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy57:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy56;
-	if(yych == ';')	goto yy52;
+	goto yy62;
+yy62:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy61;
+	if(yych == ';')	goto yy54;
 	goto yy2;
-yy58:	yych = *++YYCURSOR;
+yy63:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy56;
+	if(yych <= '9')	goto yy61;
 	goto yy2;
-yy59:	++YYCURSOR;
+yy64:	++YYCURSOR;
 	if((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
 	yych = *YYCURSOR;
-yy60:	if(yych <= ';'){
+	goto yy65;
+yy65:	if(yych <= ';'){
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy59;
+		if(yych <= '9')	goto yy64;
 		if(yych <= ':')	goto yy2;
-		goto yy52;
+		goto yy54;
 	} else {
 		if(yych <= 'E'){
 			if(yych <= 'D')	goto yy2;
-			goto yy54;
+			goto yy59;
 		} else {
-			if(yych == 'e')	goto yy54;
+			if(yych == 'e')	goto yy59;
 			goto yy2;
 		}
 	}
-yy61:	yych = *++YYCURSOR;
+yy66:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
+		goto yy67;
 	} else {
-		if(yych <= '-')	goto yy62;
+		if(yych <= '-')	goto yy67;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy63;
+		if(yych <= '9')	goto yy68;
 		goto yy2;
 	}
-yy62:	yych = *++YYCURSOR;
+yy67:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-yy63:	++YYCURSOR;
+	goto yy68;
+yy68:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy64:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy63;
+	goto yy69;
+yy69:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy68;
 	if(yych != ';')	goto yy2;
-yy65:	yych = *++YYCURSOR;
-yy66:
-#line 316
-	{
+	goto yy70;
+yy70:	yych = *++YYCURSOR;
+	goto yy71;
+yy71:
+#line 316 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-yy67:	yych = *++YYCURSOR;
+#line 551 "re2c-output.c"
+yy72:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
+		goto yy73;
 	} else {
-		if(yych <= '-')	goto yy68;
+		if(yych <= '-')	goto yy73;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy69;
+		if(yych <= '9')	goto yy74;
 		goto yy2;
 	}
-yy68:	yych = *++YYCURSOR;
+yy73:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-yy69:	++YYCURSOR;
+	goto yy74;
+yy74:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy70:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy69;
+	goto yy75;
+yy75:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy74;
 	if(yych != ';')	goto yy2;
-yy71:	yych = *++YYCURSOR;
-yy72:
-#line 309
-	{
+	goto yy76;
+yy76:	yych = *++YYCURSOR;
+	goto yy77;
+yy77:
+#line 309 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-yy73:	yych = *++YYCURSOR;
-yy74:
-#line 302
-	{
+#line 584 "re2c-output.c"
+yy78:	yych = *++YYCURSOR;
+	goto yy79;
+yy79:
+#line 302 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-yy75:	yych = *++YYCURSOR;
+#line 595 "re2c-output.c"
+yy80:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
+		goto yy81;
 	} else {
-		if(yych <= '-')	goto yy76;
+		if(yych <= '-')	goto yy81;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy77;
+		if(yych <= '9')	goto yy82;
 		goto yy2;
 	}
-yy76:	yych = *++YYCURSOR;
+yy81:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-yy77:	++YYCURSOR;
+	goto yy82;
+yy82:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy78:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy77;
+	goto yy83;
+yy83:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy82;
 	if(yych != ';')	goto yy2;
-yy79:	yych = *++YYCURSOR;
-yy80:
-#line 281
-	{
+	goto yy84;
+yy84:	yych = *++YYCURSOR;
+	goto yy85;
+yy85:
+#line 281 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	int id;
 
  	*p = YYCURSOR;
@@ -801,28 +888,34 @@ yy80:
 	
 	return 1;
 }
-yy81:	yych = *++YYCURSOR;
+#line 642 "re2c-output.c"
+yy86:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
+		goto yy87;
 	} else {
-		if(yych <= '-')	goto yy82;
+		if(yych <= '-')	goto yy87;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy83;
+		if(yych <= '9')	goto yy88;
 		goto yy2;
 	}
-yy82:	yych = *++YYCURSOR;
+yy87:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-yy83:	++YYCURSOR;
+	goto yy88;
+yy88:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy84:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy83;
+	goto yy89;
+yy89:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy88;
 	if(yych != ';')	goto yy2;
-yy85:	yych = *++YYCURSOR;
-yy86:
-#line 260
-	{
+	goto yy90;
+yy90:	yych = *++YYCURSOR;
+	goto yy91;
+yy91:
+#line 260 "/usr/src/php5/ext/standard/var_unserializer.re"
+{
 	int id;
 
  	*p = YYCURSOR;
@@ -842,8 +935,9 @@ yy86:
 	
 	return 1;
 }
+#line 689 "re2c-output.c"
 }
-#line 463
+#line 463 "/usr/src/php5/ext/standard/var_unserializer.re"
 
 
 	return 0;
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 26bc774e3d..8f53eca0b6 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -320,7 +320,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	return 1;
 }
 
-"d:" (iv | nv | nvexp) ";"	{
+"d:" (iv | nv | nvexp | "NAN" | "INF") ";"	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_DOUBLE(*rval, atof(start + 2));
-- 
2.40.0