File php-4.3.9-CAN-2004-1019.patch of Package php4

File php-4.3.9-CAN-2004-1019.patch of Package php4 (Revision 30ac6666b53c1c2141e0566b638a9ae3)

Currently displaying revision 30ac6666b53c1c2141e0566b638a9ae3, show latest

--- php-4.3.9/ext/standard/var_unserializer.c.can1019
+++ php-4.3.9/ext/standard/var_unserializer.c
@@ -1,4 +1,24 @@
-/* Generated by re2c 0.9.2 on Sat Mar 27 01:58:46 2004 */
+/* Generated by re2c 0.5 on Thu Nov 18 17:11:01 2004 */
+#line 1 "/home/rei/php4/ext/standard/var_unserializer.re"
+/*
+   +----------------------------------------------------------------------+
+   | PHP Version 4                                                        |
+   +----------------------------------------------------------------------+
+   | Copyright (c) 1997-2003 The PHP Group                                |
+   +----------------------------------------------------------------------+
+   | This source file is subject to version 2.02 of the PHP license,      |
+   | that is bundled with this package in the file LICENSE, and is        |
+   | available at through the world-wide-web at                           |
+   | http://www.php.net/license/2_02.txt.                                 |
+   | If you did not receive a copy of the PHP license and are unable to   |
+   | obtain it through the world-wide-web, please send a note to          |
+   | license@php.net so we can mail you a copy immediately.               |
+   +----------------------------------------------------------------------+
+   | Authors: Sascha Schumann <sascha@schumann.cx>                        |
+   +----------------------------------------------------------------------+
+*/
+
+/* $Id: var_unserializer.c,v 1.18.4.14 2004/12/03 16:09:19 sesser Exp $ */
 
 #include "php.h"
 #include "ext/standard/php_var.h"
@@ -63,7 +83,7 @@
 
 	if (!var_hash) return !SUCCESS;
 
-	if (id >= var_hash->used_slots) return !SUCCESS;
+	if (id < 0 || id >= var_hash->used_slots) return !SUCCESS;
 
 	*store = &var_hash->data[id];
 
@@ -91,11 +111,12 @@
 #define YYMARKER marker
 
 
+#line 118
 
 
 
 
-static inline int parse_iv2(const char *p, const char **q)
+static inline int parse_iv2(const unsigned char *p, const unsigned char **q)
 {
 	char cursor;
 	int result = 0;
@@ -110,7 +131,7 @@
 	}
 	
 	while (1) {
-		cursor = *p;
+		cursor = (char)*p;
 		if (cursor >= '0' && cursor <= '9') {
 			result = result * 10 + cursor - '0';
 		} else {
@@ -123,18 +144,40 @@
 	return result;
 }
 
-static inline int parse_iv(const char *p)
+static inline int parse_iv(const unsigned char *p)
 {
 	return parse_iv2(p, NULL);
 }
 
-#define UNSERIALIZE_PARAMETER zval **rval, const char **p, const char *max, php_unserialize_data_t *var_hash TSRMLS_DC
+/* no need to check for length - re2c already did */
+static inline size_t parse_uiv(const unsigned char *p)
+{
+	unsigned char cursor;
+	size_t result = 0;
+
+	if (*p == '+') {
+		p++;
+	}
+	
+	while (1) {
+		cursor = *p;
+		if (cursor >= '0' && cursor <= '9') {
+			result = result * 10 + (size_t)(cursor - (unsigned char)'0');
+		} else {
+			break;
+		}
+		p++;
+	}
+	return result;
+}
+
+#define UNSERIALIZE_PARAMETER zval **rval, const unsigned char **p, const unsigned char *max, php_unserialize_data_t *var_hash TSRMLS_DC
 #define UNSERIALIZE_PASSTHRU rval, p, max, var_hash TSRMLS_CC
 
 static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, int elements)
 {
 	while (elements-- > 0) {
-		zval *key, *data;
+		zval *key, *data, *old_data;
 
 		ALLOC_INIT_ZVAL(key);
 
@@ -144,6 +187,12 @@
 			return 0;
 		}
 
+		if (Z_TYPE_P(key) != IS_LONG && Z_TYPE_P(key) != IS_STRING) {
+			zval_dtor(key);
+			FREE_ZVAL(key);
+			return 0;
+		}
+
 		ALLOC_INIT_ZVAL(data);
 
 		if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
@@ -156,16 +205,26 @@
 
 		switch (Z_TYPE_P(key)) {
 			case IS_LONG:
+				if (zend_hash_index_find(ht, Z_LVAL_P(key), (void **)&old_data)) {
+					var_replace(var_hash, old_data, rval);
+				}
 				zend_hash_index_update(ht, Z_LVAL_P(key), &data, sizeof(data), NULL);
 				break;
 			case IS_STRING:
+				if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)) {
+					var_replace(var_hash, old_data, rval);
+				}
 				zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof(data), NULL);
 				break;
-
 		}
 		
 		zval_dtor(key);
 		FREE_ZVAL(key);
+
+		if (elements && *(*p-1) != ';' &&  *(*p-1) != '}') {
+			(*p)--;
+			return 0;
+		}
 	}
 
 	return 1;
@@ -214,6 +273,20 @@
 
 }
 
+static char *str_tolower_copy(char *dest, const char *source, unsigned int length)
+{
+	register unsigned char *str = (unsigned char*)source;
+	register unsigned char *result = (unsigned char*)dest;
+	register unsigned char *end = str + length;
+
+	while (str < end) {
+		*result++ = tolower((int)*str++);
+	}
+	*result = *end;
+
+	return dest;
+}
+
 PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 {
 	const unsigned char *cursor, *limit, *marker, *start;
@@ -229,7 +302,6 @@
 
 	
 	
-
 {
 	YYCTYPE yych;
 	unsigned int yyaccept;
@@ -275,40 +347,40 @@
 	if(yych <= 'd'){
 		if(yych <= 'R'){
 			if(yych <= 'N'){
-				if(yych <= 'M')	goto yy15;
-				goto yy5;
+				if(yych <= 'M')	goto yy16;
+				goto yy6;
 			} else {
-				if(yych <= 'O')	goto yy12;
-				if(yych <= 'Q')	goto yy15;
+				if(yych <= 'O')	goto yy13;
+				if(yych <= 'Q')	goto yy16;
 				goto yy3;
 			}
 		} else {
 			if(yych <= 'a'){
-				if(yych <= '`')	goto yy15;
-				goto yy10;
+				if(yych <= '`')	goto yy16;
+				goto yy11;
 			} else {
-				if(yych <= 'b')	goto yy6;
-				if(yych <= 'c')	goto yy15;
-				goto yy8;
+				if(yych <= 'b')	goto yy7;
+				if(yych <= 'c')	goto yy16;
+				goto yy9;
 			}
 		}
 	} else {
-		if(yych <= 'r'){
+		if(yych <= 'q'){
 			if(yych <= 'i'){
-				if(yych <= 'h')	goto yy15;
-				goto yy7;
+				if(yych <= 'h')	goto yy16;
+				goto yy8;
 			} else {
-				if(yych == 'o')	goto yy11;
-				goto yy15;
+				if(yych == 'o')	goto yy12;
+				goto yy16;
 			}
 		} else {
 			if(yych <= '|'){
-				if(yych <= 's')	goto yy9;
-				goto yy15;
+				if(yych <= 'r')	goto yy5;
+				if(yych <= 's')	goto yy10;
+				goto yy16;
 			} else {
-				if(yych <= '}')	goto yy13;
-				if(yych <= '\277')	goto yy15;
-				goto yy2;
+				if(yych <= '}')	goto yy14;
+				if(yych <= '\277')	goto yy16;
 			}
 		}
 	}
@@ -318,75 +390,74 @@
 	}
 yy3:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy82;
-	goto yy4;
+	if(yych == ':')	goto yy87;
 yy4:
-{ return 0; }
-yy5:	yych = *++YYCURSOR;
-	if(yych == ';')	goto yy80;
-	goto yy4;
-yy6:	yyaccept = 0;
+#line 532
+	{ return 0; }
+yy5:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy74;
+	if(yych == ':')	goto yy81;
+	goto yy4;
+yy6:	yych = *++YYCURSOR;
+	if(yych == ';')	goto yy79;
 	goto yy4;
 yy7:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy68;
+	if(yych == ':')	goto yy75;
 	goto yy4;
 yy8:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy44;
+	if(yych == ':')	goto yy69;
 	goto yy4;
 yy9:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy37;
+	if(yych == ':')	goto yy45;
 	goto yy4;
 yy10:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy30;
+	if(yych == ':')	goto yy38;
 	goto yy4;
 yy11:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy23;
+	if(yych == ':')	goto yy31;
 	goto yy4;
 yy12:	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if(yych == ':')	goto yy16;
+	if(yych == ':')	goto yy24;
 	goto yy4;
-yy13:	yych = *++YYCURSOR;
-	goto yy14;
-yy14:
-{
+yy13:	yyaccept = 0;
+	yych = *(YYMARKER = ++YYCURSOR);
+	if(yych == ':')	goto yy17;
+	goto yy4;
+yy14:	yych = *++YYCURSOR;
+yy15:
+#line 526
+	{
 	/* this is the case where we have less data than planned */
-	zend_error(E_NOTICE, "Unexpected end of serialized data");
+	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-yy15:	yych = *++YYCURSOR;
-	goto yy4;
 yy16:	yych = *++YYCURSOR;
-	if(yybm[0+yych] & 128)	goto yy18;
-	if(yych != '+')	goto yy2;
-	goto yy17;
+	goto yy4;
 yy17:	yych = *++YYCURSOR;
-	if(yybm[0+yych] & 128)	goto yy18;
+	if(yybm[0+yych] & 128)	goto yy19;
+	if(yych != '+')	goto yy2;
+yy18:	yych = *++YYCURSOR;
+	if(yybm[0+yych] & 128)	goto yy19;
 	goto yy2;
-yy18:	++YYCURSOR;
+yy19:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy19;
-yy19:	if(yybm[0+yych] & 128)	goto yy18;
+yy20:	if(yybm[0+yych] & 128)	goto yy19;
 	if(yych != ':')	goto yy2;
-	goto yy20;
-yy20:	yych = *++YYCURSOR;
-	if(yych != '"')	goto yy2;
-	goto yy21;
 yy21:	yych = *++YYCURSOR;
-	goto yy22;
-yy22:
-{
-	int len;
+	if(yych != '"')	goto yy2;
+yy22:	yych = *++YYCURSOR;
+yy23:
+#line 445
+	{
+	size_t len, len2, maxlen;
 	int elements;
-	int len2;
 	char *class_name;
 	zend_class_entry *ce;
 	int incomplete_class = 0;
@@ -397,20 +468,30 @@
 	zval *arg_func_name;
 	
 	INIT_PZVAL(*rval);
-	len2 = len = parse_iv(start + 2);
-	if (len == 0)
+	len2 = len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len || len == 0) {
+		*p = start + 2;
 		return 0;
+	}
+
+	class_name = (char*)YYCURSOR;
 
-	class_name = estrndup(YYCURSOR, len);
 	YYCURSOR += len;
 
-	while (len-- > 0) {
-		if (class_name[len] >= 'A' && class_name[len] <= 'Z') {
-			class_name[len] = class_name[len] - 'A' + 'a';
-		}
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
+		return 0;
 	}
-
-	if (zend_hash_find(CG(class_table), class_name, len2 + 1, (void **) &ce) != SUCCESS) {
+	if (*(YYCURSOR+1) != ':') {
+		*p = YYCURSOR+1;
+		return 0;
+	}
+	
+	class_name = str_tolower_copy((char *)emalloc(len+1), class_name, len);
+	class_name[len] = '\0';
+	
+	if (zend_hash_find(CG(class_table), class_name, len + 1, (void **) &ce) != SUCCESS) {
 		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
 			incomplete_class = 1;
 			ce = PHP_IC_ENTRY;
@@ -427,7 +508,7 @@
 				incomplete_class = 1;
 				ce = PHP_IC_ENTRY;
 			} else {
-				if (zend_hash_find(CG(class_table), class_name, len2 + 1, (void **) &ce) != SUCCESS) {
+				if (zend_hash_find(CG(class_table), class_name, len + 1, (void **) &ce) != SUCCESS) {
 					zend_error(E_WARNING, "'unserialize_callback_func' (%s) hasn't defined the class it was called for", user_func->value.str.val);
 					incomplete_class = 1;
 					ce = PHP_IC_ENTRY;
@@ -435,7 +516,6 @@
 #ifdef ZEND_ENGINE_2
 					ce = *(zend_class_entry **)ce; /* Bad hack, TBF! */
 #endif	
-					efree(class_name);
 				}
 			}
 		}
@@ -443,7 +523,6 @@
 #ifdef ZEND_ENGINE_2
 		ce = *(zend_class_entry **)ce; /* Bad hack, TBF! */
 #endif	
-		efree(class_name);
 	}
 
 	*p = YYCURSOR;
@@ -451,70 +530,61 @@
 
 	if (incomplete_class) {
 		php_store_class_name(*rval, class_name, len2 TSRMLS_CC);
-		efree(class_name);
 	}
+	efree(class_name);
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-yy23:	yych = *++YYCURSOR;
+yy24:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
-		goto yy24;
 	} else {
-		if(yych <= '-')	goto yy24;
+		if(yych <= '-')	goto yy25;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy25;
+		if(yych <= '9')	goto yy26;
 		goto yy2;
 	}
-yy24:	yych = *++YYCURSOR;
+yy25:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-	goto yy25;
-yy25:	++YYCURSOR;
+yy26:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy26;
-yy26:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy25;
+yy27:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy26;
 	if(yych >= ';')	goto yy2;
-	goto yy27;
-yy27:	yych = *++YYCURSOR;
-	if(yych != '"')	goto yy2;
-	goto yy28;
 yy28:	yych = *++YYCURSOR;
-	goto yy29;
-yy29:
-{
+	if(yych != '"')	goto yy2;
+yy29:	yych = *++YYCURSOR;
+yy30:
+#line 437
+	{
 
 	INIT_PZVAL(*rval);
 	
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-yy30:	yych = *++YYCURSOR;
-	if(yych == '+')	goto yy31;
+yy31:	yych = *++YYCURSOR;
+	if(yych == '+')	goto yy32;
 	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy32;
+	if(yych <= '9')	goto yy33;
 	goto yy2;
-yy31:	yych = *++YYCURSOR;
+yy32:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-	goto yy32;
-yy32:	++YYCURSOR;
+yy33:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy33;
-yy33:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy32;
+yy34:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy33;
 	if(yych >= ';')	goto yy2;
-	goto yy34;
-yy34:	yych = *++YYCURSOR;
-	if(yych != '{')	goto yy2;
-	goto yy35;
 yy35:	yych = *++YYCURSOR;
-	goto yy36;
-yy36:
-{
+	if(yych != '{')	goto yy2;
+yy36:	yych = *++YYCURSOR;
+yy37:
+#line 419
+	{
 	int elements = parse_iv(start + 2);
 
 	*p = YYCURSOR;
@@ -531,205 +601,196 @@
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-yy37:	yych = *++YYCURSOR;
-	if(yych == '+')	goto yy38;
+yy38:	yych = *++YYCURSOR;
+	if(yych == '+')	goto yy39;
 	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy39;
+	if(yych <= '9')	goto yy40;
 	goto yy2;
-yy38:	yych = *++YYCURSOR;
+yy39:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-	goto yy39;
-yy39:	++YYCURSOR;
+yy40:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy40;
-yy40:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy39;
+yy41:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy40;
 	if(yych >= ';')	goto yy2;
-	goto yy41;
-yy41:	yych = *++YYCURSOR;
-	if(yych != '"')	goto yy2;
-	goto yy42;
 yy42:	yych = *++YYCURSOR;
-	goto yy43;
-yy43:
-{
-	int len;
+	if(yych != '"')	goto yy2;
+yy43:	yych = *++YYCURSOR;
+yy44:
+#line 391
+	{
+	size_t len, maxlen;
 	char *str;
 
-	len = parse_iv(start + 2);
+	len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len) {
+		*p = start + 2;
+		return 0;
+	}
 
-	if (len == 0) {
-		str = empty_string;
-	} else {
-		str = estrndup(YYCURSOR, len);
+	str = (char*)YYCURSOR;
+
+	YYCURSOR += len;
+
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
+		return 0;
 	}
 
-	YYCURSOR += len + 2;
+	YYCURSOR += 2;
 	*p = YYCURSOR;
 
 	INIT_PZVAL(*rval);
-	ZVAL_STRINGL(*rval, str, len, 0);
+	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-yy44:	yych = *++YYCURSOR;
+yy45:	yych = *++YYCURSOR;
 	if(yych <= '/'){
 		if(yych <= ','){
-			if(yych == '+')	goto yy48;
+			if(yych == '+')	goto yy49;
 			goto yy2;
 		} else {
-			if(yych <= '-')	goto yy46;
-			if(yych <= '.')	goto yy51;
+			if(yych <= '-')	goto yy47;
+			if(yych <= '.')	goto yy52;
 			goto yy2;
 		}
 	} else {
 		if(yych <= 'I'){
-			if(yych <= '9')	goto yy49;
+			if(yych <= '9')	goto yy50;
 			if(yych <= 'H')	goto yy2;
-			goto yy47;
+			goto yy48;
 		} else {
 			if(yych != 'N')	goto yy2;
-			goto yy45;
 		}
 	}
-yy45:	yych = *++YYCURSOR;
-	if(yych == 'A')	goto yy67;
-	goto yy2;
 yy46:	yych = *++YYCURSOR;
+	if(yych == 'A')	goto yy68;
+	goto yy2;
+yy47:	yych = *++YYCURSOR;
 	if(yych <= '/'){
-		if(yych == '.')	goto yy51;
+		if(yych == '.')	goto yy52;
 		goto yy2;
 	} else {
-		if(yych <= '9')	goto yy49;
+		if(yych <= '9')	goto yy50;
 		if(yych != 'I')	goto yy2;
-		goto yy47;
 	}
-yy47:	yych = *++YYCURSOR;
-	if(yych == 'N')	goto yy63;
-	goto yy2;
 yy48:	yych = *++YYCURSOR;
-	if(yych == '.')	goto yy51;
+	if(yych == 'N')	goto yy64;
+	goto yy2;
+yy49:	yych = *++YYCURSOR;
+	if(yych == '.')	goto yy52;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-	goto yy49;
-yy49:	++YYCURSOR;
+yy50:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy50;
-yy50:	if(yych <= ':'){
+yy51:	if(yych <= ':'){
 		if(yych <= '.'){
 			if(yych <= '-')	goto yy2;
-			goto yy61;
+			goto yy62;
 		} else {
 			if(yych <= '/')	goto yy2;
-			if(yych <= '9')	goto yy49;
+			if(yych <= '9')	goto yy50;
 			goto yy2;
 		}
 	} else {
 		if(yych <= 'E'){
-			if(yych <= ';')	goto yy54;
+			if(yych <= ';')	goto yy55;
 			if(yych <= 'D')	goto yy2;
-			goto yy56;
+			goto yy57;
 		} else {
-			if(yych == 'e')	goto yy56;
+			if(yych == 'e')	goto yy57;
 			goto yy2;
 		}
 	}
-yy51:	yych = *++YYCURSOR;
+yy52:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-	goto yy52;
-yy52:	++YYCURSOR;
+yy53:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy53;
-yy53:	if(yych <= ';'){
+yy54:	if(yych <= ';'){
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy52;
+		if(yych <= '9')	goto yy53;
 		if(yych <= ':')	goto yy2;
-		goto yy54;
 	} else {
 		if(yych <= 'E'){
 			if(yych <= 'D')	goto yy2;
-			goto yy56;
+			goto yy57;
 		} else {
-			if(yych == 'e')	goto yy56;
+			if(yych == 'e')	goto yy57;
 			goto yy2;
 		}
 	}
-yy54:	yych = *++YYCURSOR;
-	goto yy55;
-yy55:
-{
+yy55:	yych = *++YYCURSOR;
+yy56:
+#line 384
+	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_DOUBLE(*rval, atof(start + 2));
 	return 1;
 }
-yy56:	yych = *++YYCURSOR;
+yy57:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
-		goto yy57;
 	} else {
-		if(yych <= '-')	goto yy57;
+		if(yych <= '-')	goto yy58;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy58;
+		if(yych <= '9')	goto yy59;
 		goto yy2;
 	}
-yy57:	yych = *++YYCURSOR;
+yy58:	yych = *++YYCURSOR;
 	if(yych <= ','){
-		if(yych == '+')	goto yy60;
+		if(yych == '+')	goto yy61;
 		goto yy2;
 	} else {
-		if(yych <= '-')	goto yy60;
+		if(yych <= '-')	goto yy61;
 		if(yych <= '/')	goto yy2;
 		if(yych >= ':')	goto yy2;
-		goto yy58;
 	}
-yy58:	++YYCURSOR;
+yy59:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy59;
-yy59:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy58;
-	if(yych == ';')	goto yy54;
+yy60:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy59;
+	if(yych == ';')	goto yy55;
 	goto yy2;
-yy60:	yych = *++YYCURSOR;
+yy61:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy58;
+	if(yych <= '9')	goto yy59;
 	goto yy2;
-yy61:	++YYCURSOR;
+yy62:	++YYCURSOR;
 	if((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
 	yych = *YYCURSOR;
-	goto yy62;
-yy62:	if(yych <= ';'){
+yy63:	if(yych <= ';'){
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy61;
+		if(yych <= '9')	goto yy62;
 		if(yych <= ':')	goto yy2;
-		goto yy54;
+		goto yy55;
 	} else {
 		if(yych <= 'E'){
 			if(yych <= 'D')	goto yy2;
-			goto yy56;
+			goto yy57;
 		} else {
-			if(yych == 'e')	goto yy56;
+			if(yych == 'e')	goto yy57;
 			goto yy2;
 		}
 	}
-yy63:	yych = *++YYCURSOR;
-	if(yych != 'F')	goto yy2;
-	goto yy64;
 yy64:	yych = *++YYCURSOR;
-	if(yych != ';')	goto yy2;
-	goto yy65;
+	if(yych != 'F')	goto yy2;
 yy65:	yych = *++YYCURSOR;
-	goto yy66;
-yy66:
-{
+	if(yych != ';')	goto yy2;
+yy66:	yych = *++YYCURSOR;
+yy67:
+#line 367
+	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
-#if defined(HAVE_ATOF_ACCEPTS_NAN) && defined(HAVE_ATOF_ACCEPTS_INF)
+#if 1
 	ZVAL_DOUBLE(*rval, atof(start + 2));
 #else
 	if (!strncmp(start + 2, "NAN", 3)) {
@@ -742,106 +803,124 @@
 #endif
 	return 1;
 }
-yy67:	yych = *++YYCURSOR;
-	if(yych == 'N')	goto yy64;
-	goto yy2;
 yy68:	yych = *++YYCURSOR;
+	if(yych == 'N')	goto yy65;
+	goto yy2;
+yy69:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
-		goto yy69;
 	} else {
-		if(yych <= '-')	goto yy69;
+		if(yych <= '-')	goto yy70;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy70;
+		if(yych <= '9')	goto yy71;
 		goto yy2;
 	}
-yy69:	yych = *++YYCURSOR;
+yy70:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-	goto yy70;
-yy70:	++YYCURSOR;
+yy71:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy71;
-yy71:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy70;
+yy72:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy71;
 	if(yych != ';')	goto yy2;
-	goto yy72;
-yy72:	yych = *++YYCURSOR;
-	goto yy73;
-yy73:
-{
+yy73:	yych = *++YYCURSOR;
+yy74:
+#line 360
+	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-yy74:	yych = *++YYCURSOR;
-	if(yych <= ','){
-		if(yych != '+')	goto yy2;
-		goto yy75;
-	} else {
-		if(yych <= '-')	goto yy75;
-		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy76;
-		goto yy2;
-	}
 yy75:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
-	if(yych >= ':')	goto yy2;
-	goto yy76;
-yy76:	++YYCURSOR;
-	if(YYLIMIT == YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	goto yy77;
-yy77:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy76;
+	if(yych >= '2')	goto yy2;
+yy76:	yych = *++YYCURSOR;
 	if(yych != ';')	goto yy2;
-	goto yy78;
-yy78:	yych = *++YYCURSOR;
-	goto yy79;
-yy79:
-{
+yy77:	yych = *++YYCURSOR;
+yy78:
+#line 353
+	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-yy80:	yych = *++YYCURSOR;
-	goto yy81;
-yy81:
-{
+yy79:	yych = *++YYCURSOR;
+yy80:
+#line 346
+	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
+yy81:	yych = *++YYCURSOR;
+	if(yych <= ','){
+		if(yych != '+')	goto yy2;
+	} else {
+		if(yych <= '-')	goto yy82;
+		if(yych <= '/')	goto yy2;
+		if(yych <= '9')	goto yy83;
+		goto yy2;
+	}
 yy82:	yych = *++YYCURSOR;
+	if(yych <= '/')	goto yy2;
+	if(yych >= ':')	goto yy2;
+yy83:	++YYCURSOR;
+	if(YYLIMIT == YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+yy84:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy83;
+	if(yych != ';')	goto yy2;
+yy85:	yych = *++YYCURSOR;
+yy86:
+#line 325
+	{
+	int id;
+
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
+
+	id = parse_iv(start + 2) - 1;
+	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
+		return 0;
+	}
+
+	if (*rval == *rval_ref) return 0;
+
+	if (*rval != NULL) {
+	zval_ptr_dtor(rval);
+	}
+	*rval = *rval_ref;
+	(*rval)->refcount++;
+	(*rval)->is_ref = 1;
+	
+	return 1;
+}
+yy87:	yych = *++YYCURSOR;
 	if(yych <= ','){
 		if(yych != '+')	goto yy2;
-		goto yy83;
 	} else {
-		if(yych <= '-')	goto yy83;
+		if(yych <= '-')	goto yy88;
 		if(yych <= '/')	goto yy2;
-		if(yych <= '9')	goto yy84;
+		if(yych <= '9')	goto yy89;
 		goto yy2;
 	}
-yy83:	yych = *++YYCURSOR;
+yy88:	yych = *++YYCURSOR;
 	if(yych <= '/')	goto yy2;
 	if(yych >= ':')	goto yy2;
-	goto yy84;
-yy84:	++YYCURSOR;
+yy89:	++YYCURSOR;
 	if(YYLIMIT == YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-	goto yy85;
-yy85:	if(yych <= '/')	goto yy2;
-	if(yych <= '9')	goto yy84;
+yy90:	if(yych <= '/')	goto yy2;
+	if(yych <= '9')	goto yy89;
 	if(yych != ';')	goto yy2;
-	goto yy86;
-yy86:	yych = *++YYCURSOR;
-	goto yy87;
-yy87:
-{
+yy91:	yych = *++YYCURSOR;
+yy92:
+#line 304
+	{
 	int id;
 
  	*p = YYCURSOR;
@@ -852,7 +931,9 @@
 		return 0;
 	}
 
+	if (*rval != NULL) {
 	zval_ptr_dtor(rval);
+	}
 	*rval = *rval_ref;
 	(*rval)->refcount++;
 	(*rval)->is_ref = 1;
@@ -860,6 +941,7 @@
 	return 1;
 }
 }
+#line 534
 
 
 	return 0;
--- php-4.3.9/ext/standard/php_var.h.can1019
+++ php-4.3.9/ext/standard/php_var.h
@@ -46,7 +46,7 @@
 typedef struct php_unserialize_data php_unserialize_data_t;
 
 PHPAPI void php_var_serialize(smart_str *buf, zval **struc, php_serialize_data_t *var_hash TSRMLS_DC);
-PHPAPI int php_var_unserialize(zval **rval, const char **p, const char *max, php_unserialize_data_t *var_hash TSRMLS_DC);
+PHPAPI int php_var_unserialize(zval **rval, const unsigned char **p, const unsigned char *max, php_unserialize_data_t *var_hash TSRMLS_DC);
 
 #define PHP_VAR_SERIALIZE_INIT(var_hash) \
    zend_hash_init(&(var_hash), 10, NULL, NULL, 0)