iliaa Thu Nov 18 17:14:42 2004 EDT Modified files: (Branch: PHP_4_3) /php-src NEWS /php-src/ext/standard var_unserializer.c var_unserializer.re Log: Fixed bug #30826 (Certain reference relations cannot be unserialized properly).
http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1247.2.754&r2=1.1247.2.755&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1247.2.754 php-src/NEWS:1.1247.2.755 --- php-src/NEWS:1.1247.2.754 Wed Nov 17 12:13:41 2004 +++ php-src/NEWS Thu Nov 18 17:14:40 2004 @@ -6,6 +6,8 @@ - Fixed a bug in addslashes() handling of the '\0' character. (Ilia) - Backported Marcus' foreach() speedup patch from PHP 5.x. (Derick) - Fixed potential problems with unserializing invalid serialize data. (Marcus) +- Fixed bug #30826 (Certain reference relations cannot be unserialized + properly). (Ilia) - Fixed bug #30750 (Meaningful error message when upload directory is not accessible). (Ilia) - Fixed bug #30739 (imagefill does not set back alphablending mode) (Pierre) http://cvs.php.net/diff.php/php-src/ext/standard/var_unserializer.c?r1=1.18.4.10&r2=1.18.4.11&ty=u Index: php-src/ext/standard/var_unserializer.c diff -u php-src/ext/standard/var_unserializer.c:1.18.4.10 php-src/ext/standard/var_unserializer.c:1.18.4.11 --- php-src/ext/standard/var_unserializer.c:1.18.4.10 Mon Nov 15 08:40:31 2004 +++ php-src/ext/standard/var_unserializer.c Thu Nov 18 17:14:42 2004 @@ -1,5 +1,5 @@ -/* Generated by re2c 0.5 on Thu Nov 4 01:10:35 2004 */ -#line 1 "/dat/dev/php/php-4.3dev/ext/standard/var_unserializer.re" +/* Generated by re2c 0.5 on Thu Nov 18 17:11:01 2004 */ +#line 1 "/home/rei/php4/ext/standard/var_unserializer.re" /* +----------------------------------------------------------------------+ | PHP Version 4 | @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: var_unserializer.c,v 1.18.4.10 2004/11/15 13:40:31 derick Exp $ */ +/* $Id: var_unserializer.c,v 1.18.4.11 2004/11/18 22:14:42 iliaa Exp $ */ #include "php.h" #include "ext/standard/php_var.h" @@ -341,40 +341,40 @@ if(yych <= 'd'){ if(yych <= 'R'){ if(yych <= 'N'){ - if(yych <= 'M') goto yy15; - goto yy5; + if(yych <= 'M') goto yy16; + goto yy6; } else { - if(yych <= 'O') goto yy12; - if(yych <= 'Q') goto yy15; + if(yych <= 'O') goto yy13; + if(yych <= 'Q') goto yy16; goto yy3; } } else { if(yych <= 'a'){ - if(yych <= '`') goto yy15; - goto yy10; + if(yych <= '`') goto yy16; + goto yy11; } else { - if(yych <= 'b') goto yy6; - if(yych <= 'c') goto yy15; - goto yy8; + if(yych <= 'b') goto yy7; + if(yych <= 'c') goto yy16; + goto yy9; } } } else { - if(yych <= 'r'){ + if(yych <= 'q'){ if(yych <= 'i'){ - if(yych <= 'h') goto yy15; - goto yy7; + if(yych <= 'h') goto yy16; + goto yy8; } else { - if(yych == 'o') goto yy11; - goto yy15; + if(yych == 'o') goto yy12; + goto yy16; } } else { if(yych <= '|'){ - if(yych <= 's') goto yy9; - goto yy15; + if(yych <= 'r') goto yy5; + if(yych <= 's') goto yy10; + goto yy16; } else { - if(yych <= '}') goto yy13; - if(yych <= '\277') goto yy15; - goto yy2; + if(yych <= '}') goto yy14; + if(yych <= '\277') goto yy16; } } } @@ -384,74 +384,71 @@ } yy3: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy80; - goto yy4; + if(yych == ':') goto yy87; yy4: -#line 511 +#line 532 { return 0; } -yy5: yych = *++YYCURSOR; - if(yych == ';') goto yy78; - goto yy4; -yy6: yyaccept = 0; +yy5: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy74; + if(yych == ':') goto yy81; + goto yy4; +yy6: yych = *++YYCURSOR; + if(yych == ';') goto yy79; goto yy4; yy7: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy68; + if(yych == ':') goto yy75; goto yy4; yy8: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy44; + if(yych == ':') goto yy69; goto yy4; yy9: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy37; + if(yych == ':') goto yy45; goto yy4; yy10: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy30; + if(yych == ':') goto yy38; goto yy4; yy11: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy23; + if(yych == ':') goto yy31; goto yy4; yy12: yyaccept = 0; yych = *(YYMARKER = ++YYCURSOR); - if(yych == ':') goto yy16; + if(yych == ':') goto yy24; goto yy4; -yy13: yych = *++YYCURSOR; - goto yy14; -yy14: -#line 505 +yy13: yyaccept = 0; + yych = *(YYMARKER = ++YYCURSOR); + if(yych == ':') goto yy17; + goto yy4; +yy14: yych = *++YYCURSOR; +yy15: +#line 526 { /* this is the case where we have less data than planned */ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } -yy15: yych = *++YYCURSOR; - goto yy4; yy16: yych = *++YYCURSOR; - if(yybm[0+yych] & 128) goto yy18; - if(yych != '+') goto yy2; - goto yy17; + goto yy4; yy17: yych = *++YYCURSOR; - if(yybm[0+yych] & 128) goto yy18; + if(yybm[0+yych] & 128) goto yy19; + if(yych != '+') goto yy2; +yy18: yych = *++YYCURSOR; + if(yybm[0+yych] & 128) goto yy19; goto yy2; -yy18: ++YYCURSOR; +yy19: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy19; -yy19: if(yybm[0+yych] & 128) goto yy18; +yy20: if(yybm[0+yych] & 128) goto yy19; if(yych != ':') goto yy2; - goto yy20; -yy20: yych = *++YYCURSOR; - if(yych != '"') goto yy2; - goto yy21; yy21: yych = *++YYCURSOR; - goto yy22; -yy22: -#line 424 + if(yych != '"') goto yy2; +yy22: yych = *++YYCURSOR; +yy23: +#line 445 { size_t len, len2, maxlen; int elements; @@ -532,35 +529,29 @@ return object_common2(UNSERIALIZE_PASSTHRU, elements); } -yy23: yych = *++YYCURSOR; +yy24: yych = *++YYCURSOR; if(yych <= ','){ if(yych != '+') goto yy2; - goto yy24; } else { - if(yych <= '-') goto yy24; + if(yych <= '-') goto yy25; if(yych <= '/') goto yy2; - if(yych <= '9') goto yy25; + if(yych <= '9') goto yy26; goto yy2; } -yy24: yych = *++YYCURSOR; +yy25: yych = *++YYCURSOR; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy25; -yy25: ++YYCURSOR; +yy26: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy26; -yy26: if(yych <= '/') goto yy2; - if(yych <= '9') goto yy25; +yy27: if(yych <= '/') goto yy2; + if(yych <= '9') goto yy26; if(yych >= ';') goto yy2; - goto yy27; -yy27: yych = *++YYCURSOR; - if(yych != '"') goto yy2; - goto yy28; yy28: yych = *++YYCURSOR; - goto yy29; -yy29: -#line 416 + if(yych != '"') goto yy2; +yy29: yych = *++YYCURSOR; +yy30: +#line 437 { INIT_PZVAL(*rval); @@ -568,30 +559,25 @@ return object_common2(UNSERIALIZE_PASSTHRU, object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); } -yy30: yych = *++YYCURSOR; - if(yych == '+') goto yy31; +yy31: yych = *++YYCURSOR; + if(yych == '+') goto yy32; if(yych <= '/') goto yy2; - if(yych <= '9') goto yy32; + if(yych <= '9') goto yy33; goto yy2; -yy31: yych = *++YYCURSOR; +yy32: yych = *++YYCURSOR; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy32; -yy32: ++YYCURSOR; +yy33: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy33; -yy33: if(yych <= '/') goto yy2; - if(yych <= '9') goto yy32; +yy34: if(yych <= '/') goto yy2; + if(yych <= '9') goto yy33; if(yych >= ';') goto yy2; - goto yy34; -yy34: yych = *++YYCURSOR; - if(yych != '{') goto yy2; - goto yy35; yy35: yych = *++YYCURSOR; - goto yy36; -yy36: -#line 398 + if(yych != '{') goto yy2; +yy36: yych = *++YYCURSOR; +yy37: +#line 419 { int elements = parse_iv(start + 2); @@ -609,30 +595,25 @@ return finish_nested_data(UNSERIALIZE_PASSTHRU); } -yy37: yych = *++YYCURSOR; - if(yych == '+') goto yy38; +yy38: yych = *++YYCURSOR; + if(yych == '+') goto yy39; if(yych <= '/') goto yy2; - if(yych <= '9') goto yy39; + if(yych <= '9') goto yy40; goto yy2; -yy38: yych = *++YYCURSOR; +yy39: yych = *++YYCURSOR; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy39; -yy39: ++YYCURSOR; +yy40: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy40; -yy40: if(yych <= '/') goto yy2; - if(yych <= '9') goto yy39; +yy41: if(yych <= '/') goto yy2; + if(yych <= '9') goto yy40; if(yych >= ';') goto yy2; - goto yy41; -yy41: yych = *++YYCURSOR; - if(yych != '"') goto yy2; - goto yy42; yy42: yych = *++YYCURSOR; - goto yy43; -yy43: -#line 370 + if(yych != '"') goto yy2; +yy43: yych = *++YYCURSOR; +yy44: +#line 391 { size_t len, maxlen; char *str; @@ -660,161 +641,146 @@ ZVAL_STRINGL(*rval, str, len, 1); return 1; } -yy44: yych = *++YYCURSOR; +yy45: yych = *++YYCURSOR; if(yych <= '/'){ if(yych <= ','){ - if(yych == '+') goto yy48; + if(yych == '+') goto yy49; goto yy2; } else { - if(yych <= '-') goto yy46; - if(yych <= '.') goto yy51; + if(yych <= '-') goto yy47; + if(yych <= '.') goto yy52; goto yy2; } } else { if(yych <= 'I'){ - if(yych <= '9') goto yy49; + if(yych <= '9') goto yy50; if(yych <= 'H') goto yy2; - goto yy47; + goto yy48; } else { if(yych != 'N') goto yy2; - goto yy45; } } -yy45: yych = *++YYCURSOR; - if(yych == 'A') goto yy67; - goto yy2; yy46: yych = *++YYCURSOR; + if(yych == 'A') goto yy68; + goto yy2; +yy47: yych = *++YYCURSOR; if(yych <= '/'){ - if(yych == '.') goto yy51; + if(yych == '.') goto yy52; goto yy2; } else { - if(yych <= '9') goto yy49; + if(yych <= '9') goto yy50; if(yych != 'I') goto yy2; - goto yy47; } -yy47: yych = *++YYCURSOR; - if(yych == 'N') goto yy63; - goto yy2; yy48: yych = *++YYCURSOR; - if(yych == '.') goto yy51; + if(yych == 'N') goto yy64; + goto yy2; +yy49: yych = *++YYCURSOR; + if(yych == '.') goto yy52; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy49; -yy49: ++YYCURSOR; +yy50: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy50; -yy50: if(yych <= ':'){ +yy51: if(yych <= ':'){ if(yych <= '.'){ if(yych <= '-') goto yy2; - goto yy61; + goto yy62; } else { if(yych <= '/') goto yy2; - if(yych <= '9') goto yy49; + if(yych <= '9') goto yy50; goto yy2; } } else { if(yych <= 'E'){ - if(yych <= ';') goto yy54; + if(yych <= ';') goto yy55; if(yych <= 'D') goto yy2; - goto yy56; + goto yy57; } else { - if(yych == 'e') goto yy56; + if(yych == 'e') goto yy57; goto yy2; } } -yy51: yych = *++YYCURSOR; +yy52: yych = *++YYCURSOR; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy52; -yy52: ++YYCURSOR; +yy53: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy53; -yy53: if(yych <= ';'){ +yy54: if(yych <= ';'){ if(yych <= '/') goto yy2; - if(yych <= '9') goto yy52; + if(yych <= '9') goto yy53; if(yych <= ':') goto yy2; - goto yy54; } else { if(yych <= 'E'){ if(yych <= 'D') goto yy2; - goto yy56; + goto yy57; } else { - if(yych == 'e') goto yy56; + if(yych == 'e') goto yy57; goto yy2; } } -yy54: yych = *++YYCURSOR; - goto yy55; -yy55: -#line 363 +yy55: yych = *++YYCURSOR; +yy56: +#line 384 { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_DOUBLE(*rval, atof(start + 2)); return 1; } -yy56: yych = *++YYCURSOR; +yy57: yych = *++YYCURSOR; if(yych <= ','){ if(yych != '+') goto yy2; - goto yy57; } else { - if(yych <= '-') goto yy57; + if(yych <= '-') goto yy58; if(yych <= '/') goto yy2; - if(yych <= '9') goto yy58; + if(yych <= '9') goto yy59; goto yy2; } -yy57: yych = *++YYCURSOR; +yy58: yych = *++YYCURSOR; if(yych <= ','){ - if(yych == '+') goto yy60; + if(yych == '+') goto yy61; goto yy2; } else { - if(yych <= '-') goto yy60; + if(yych <= '-') goto yy61; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy58; } -yy58: ++YYCURSOR; +yy59: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy59; -yy59: if(yych <= '/') goto yy2; - if(yych <= '9') goto yy58; - if(yych == ';') goto yy54; +yy60: if(yych <= '/') goto yy2; + if(yych <= '9') goto yy59; + if(yych == ';') goto yy55; goto yy2; -yy60: yych = *++YYCURSOR; +yy61: yych = *++YYCURSOR; if(yych <= '/') goto yy2; - if(yych <= '9') goto yy58; + if(yych <= '9') goto yy59; goto yy2; -yy61: ++YYCURSOR; +yy62: ++YYCURSOR; if((YYLIMIT - YYCURSOR) < 4) YYFILL(4); yych = *YYCURSOR; - goto yy62; -yy62: if(yych <= ';'){ +yy63: if(yych <= ';'){ if(yych <= '/') goto yy2; - if(yych <= '9') goto yy61; + if(yych <= '9') goto yy62; if(yych <= ':') goto yy2; - goto yy54; + goto yy55; } else { if(yych <= 'E'){ if(yych <= 'D') goto yy2; - goto yy56; + goto yy57; } else { - if(yych == 'e') goto yy56; + if(yych == 'e') goto yy57; goto yy2; } } -yy63: yych = *++YYCURSOR; - if(yych != 'F') goto yy2; - goto yy64; yy64: yych = *++YYCURSOR; - if(yych != ';') goto yy2; - goto yy65; + if(yych != 'F') goto yy2; yy65: yych = *++YYCURSOR; - goto yy66; -yy66: -#line 346 + if(yych != ';') goto yy2; +yy66: yych = *++YYCURSOR; +yy67: +#line 367 { *p = YYCURSOR; INIT_PZVAL(*rval); @@ -831,93 +797,120 @@ #endif return 1; } -yy67: yych = *++YYCURSOR; - if(yych == 'N') goto yy64; - goto yy2; yy68: yych = *++YYCURSOR; + if(yych == 'N') goto yy65; + goto yy2; +yy69: yych = *++YYCURSOR; if(yych <= ','){ if(yych != '+') goto yy2; - goto yy69; } else { - if(yych <= '-') goto yy69; + if(yych <= '-') goto yy70; if(yych <= '/') goto yy2; - if(yych <= '9') goto yy70; + if(yych <= '9') goto yy71; goto yy2; } -yy69: yych = *++YYCURSOR; +yy70: yych = *++YYCURSOR; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy70; -yy70: ++YYCURSOR; +yy71: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy71; -yy71: if(yych <= '/') goto yy2; - if(yych <= '9') goto yy70; +yy72: if(yych <= '/') goto yy2; + if(yych <= '9') goto yy71; if(yych != ';') goto yy2; - goto yy72; -yy72: yych = *++YYCURSOR; - goto yy73; -yy73: -#line 339 +yy73: yych = *++YYCURSOR; +yy74: +#line 360 { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_LONG(*rval, parse_iv(start + 2)); return 1; } -yy74: yych = *++YYCURSOR; +yy75: yych = *++YYCURSOR; if(yych <= '/') goto yy2; if(yych >= '2') goto yy2; - goto yy75; -yy75: yych = *++YYCURSOR; - if(yych != ';') goto yy2; - goto yy76; yy76: yych = *++YYCURSOR; - goto yy77; -yy77: -#line 332 + if(yych != ';') goto yy2; +yy77: yych = *++YYCURSOR; +yy78: +#line 353 { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_BOOL(*rval, parse_iv(start + 2)); return 1; } -yy78: yych = *++YYCURSOR; - goto yy79; -yy79: -#line 325 +yy79: yych = *++YYCURSOR; +yy80: +#line 346 { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_NULL(*rval); return 1; } -yy80: yych = *++YYCURSOR; +yy81: yych = *++YYCURSOR; if(yych <= ','){ if(yych != '+') goto yy2; - goto yy81; } else { - if(yych <= '-') goto yy81; + if(yych <= '-') goto yy82; if(yych <= '/') goto yy2; - if(yych <= '9') goto yy82; + if(yych <= '9') goto yy83; goto yy2; } -yy81: yych = *++YYCURSOR; +yy82: yych = *++YYCURSOR; + if(yych <= '/') goto yy2; + if(yych >= ':') goto yy2; +yy83: ++YYCURSOR; + if(YYLIMIT == YYCURSOR) YYFILL(1); + yych = *YYCURSOR; +yy84: if(yych <= '/') goto yy2; + if(yych <= '9') goto yy83; + if(yych != ';') goto yy2; +yy85: yych = *++YYCURSOR; +yy86: +#line 325 + { + int id; + + *p = YYCURSOR; + if (!var_hash) return 0; + + id = parse_iv(start + 2) - 1; + if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) { + return 0; + } + + if (*rval != NULL) { + zval_ptr_dtor(rval); + } + *rval = *rval_ref; + (*rval)->refcount++; + (*rval)->is_ref = 1; + + return 1; +} +yy87: yych = *++YYCURSOR; + if(yych <= ','){ + if(yych != '+') goto yy2; + } else { + if(yych <= '-') goto yy88; + if(yych <= '/') goto yy2; + if(yych <= '9') goto yy89; + goto yy2; + } +yy88: yych = *++YYCURSOR; if(yych <= '/') goto yy2; if(yych >= ':') goto yy2; - goto yy82; -yy82: ++YYCURSOR; +yy89: ++YYCURSOR; if(YYLIMIT == YYCURSOR) YYFILL(1); yych = *YYCURSOR; - goto yy83; -yy83: if(yych <= '/') goto yy2; - if(yych <= '9') goto yy82; +yy90: if(yych <= '/') goto yy2; + if(yych <= '9') goto yy89; if(yych != ';') goto yy2; - goto yy84; -yy84: yych = *++YYCURSOR; - goto yy85; -yy85: +yy91: yych = *++YYCURSOR; +yy92: #line 304 { int id; @@ -940,7 +933,7 @@ return 1; } } -#line 513 +#line 534 return 0; http://cvs.php.net/diff.php/php-src/ext/standard/var_unserializer.re?r1=1.11.4.4&r2=1.11.4.5&ty=u Index: php-src/ext/standard/var_unserializer.re diff -u php-src/ext/standard/var_unserializer.re:1.11.4.4 php-src/ext/standard/var_unserializer.re:1.11.4.5 --- php-src/ext/standard/var_unserializer.re:1.11.4.4 Fri Sep 24 17:56:59 2004 +++ php-src/ext/standard/var_unserializer.re Thu Nov 18 17:14:42 2004 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: var_unserializer.re,v 1.11.4.4 2004/09/24 21:56:59 helly Exp $ */ +/* $Id: var_unserializer.re,v 1.11.4.5 2004/11/18 22:14:42 iliaa Exp $ */ #include "php.h" #include "ext/standard/php_var.h" @@ -322,6 +322,27 @@ return 1; } +"r:" iv ";" { + int id; + + *p = YYCURSOR; + if (!var_hash) return 0; + + id = parse_iv(start + 2) - 1; + if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) { + return 0; + } + + if (*rval != NULL) { + zval_ptr_dtor(rval); + } + *rval = *rval_ref; + (*rval)->refcount++; + (*rval)->is_ref = 1; + + return 1; +} + "N;" { *p = YYCURSOR; INIT_PZVAL(*rval);
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php