head	1.1;
access;
symbols
	pkgsrc-2026Q3:1.1.0.2;
locks; strict;
comment	@ * @;


1.1
date	2026.10.27.15.30.49;	author taca;	state Exp;
branches
	1.1.2.1;
next	;
commitid	KjO33YVcJEfD481H;

1.1.2.1
date	2026.10.27.15.30.49;	author maya;	state dead;
branches;
next	1.1.2.2;
commitid	p9DWww5rhvcuiL2H;

1.1.2.2
date	2026.11.09.08.24.26;	author maya;	state Exp;
branches;
next	;
commitid	p9DWww5rhvcuiL2H;


desc
@@


1.1
log
@lang/php56: fix CVE-2026-109618 and CVE-2026-109619

Apply patch for CVE-2026-109618 and CVE-2026-109619.
Thanks to sborrill@@ providing patch information.

Bump PKGREVISION.
@
text
@$NetBSD$

https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch

--- ext/standard/var_unserializer.c.orig	2019-01-09 10:25:59.000000000 +0000
+++ ext/standard/var_unserializer.c
@@@@ -1,4 +1,5 @@@@
-/* Generated by re2c 0.15.3 */
+/* Generated by re2c 1.1.1 */
+#line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
@@@@ -279,6 +280,7 @@@@ static char *unserialize_str(const unsig
 #define YYMARKER marker
 
 
+#line 288 "ext/standard/var_unserializer.re"
 
 
 
@@@@ -366,6 +368,16 @@@@ static inline int process_nested_data(UN
 			return 0;
 		}
 
+		/* The members that incomplete_classes_only mode writes itself cannot be
+		 * told apart from that bookkeeping: reject them */
+		if (objprops && UNEXPECTED(BG(incomplete_classes_only)) && Z_TYPE_P(key) == IS_STRING
+				&& ((Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER, sizeof(MAGIC_MEMBER) - 1))
+					|| (Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER_SERIALIZED) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED) - 1)))) {
+			var_push_dtor_no_addref(var_hash, &key);
+			var_push_dtor_no_addref(var_hash, &data);
+			return 0;
+		}
+
 		if (!objprops) {
 			switch (Z_TYPE_P(key)) {
 			case IS_LONG:
@@@@ -412,7 +424,7 @@@@ static inline int finish_nested_data(UNS
 	return 1;
 }
 
-static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
+static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce, int keep_payload)
 {
 	long datalen;
 
@@@@ -425,7 +437,16 @@@@ static inline int object_custom(UNSERIAL
 		return 0;
 	}
 
-	if (ce->unserialize == NULL) {
+	if (keep_payload) {
+		/* The class was not resolved (see BG(incomplete_classes_only)): keep
+		 * the payload verbatim, so that the object serializes back unchanged */
+		zval *payload;
+
+		object_init_ex(*rval, ce);
+		MAKE_STD_ZVAL(payload);
+		ZVAL_STRINGL(payload, (char *) *p, datalen, 1);
+		zend_hash_update(Z_OBJPROP_PP(rval), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED), &payload, sizeof(payload), NULL);
+	} else if (ce->unserialize == NULL) {
 		zend_error(E_WARNING, "Class %s has no unserializer", ce->name);
 		object_init_ex(*rval, ce);
 	} else if (ce->unserialize(rval, ce, (const unsigned char*)*p, datalen, (zend_unserialize_data *)var_hash TSRMLS_CC) != SUCCESS) {
@@@@ -526,6 +547,7 @@@@ PHPAPI int php_var_unserialize(UNSERIALI
 
 
 
+#line 551 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@@@ -566,524 +588,407 @@@@ PHPAPI int php_var_unserialize(UNSERIALI
 	yych = *YYCURSOR;
 	switch (yych) {
 	case 'C':
-	case 'O':	goto yy13;
+	case 'O':	goto yy4;
 	case 'N':	goto yy5;
-	case 'R':	goto yy2;
-	case 'S':	goto yy10;
-	case 'a':	goto yy11;
-	case 'b':	goto yy6;
-	case 'd':	goto yy8;
-	case 'i':	goto yy7;
+	case 'R':	goto yy6;
+	case 'S':	goto yy7;
+	case 'a':	goto yy8;
+	case 'b':	goto yy9;
+	case 'd':	goto yy10;
+	case 'i':	goto yy11;
 	case 'o':	goto yy12;
-	case 'r':	goto yy4;
-	case 's':	goto yy9;
-	case '}':	goto yy14;
-	default:	goto yy16;
+	case 'r':	goto yy13;
+	case 's':	goto yy14;
+	case '}':	goto yy15;
+	default:	goto yy2;
 	}
 yy2:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy95;
+	++YYCURSOR;
 yy3:
+#line 935 "ext/standard/var_unserializer.re"
 	{ return 0; }
+#line 611 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy89;
+	if (yych == ':') goto yy17;
 	goto yy3;
 yy5:
 	yych = *++YYCURSOR;
-	if (yych == ';') goto yy87;
+	if (yych == ';') goto yy19;
 	goto yy3;
 yy6:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy83;
+	if (yych == ':') goto yy21;
 	goto yy3;
 yy7:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy77;
+	if (yych == ':') goto yy22;
 	goto yy3;
 yy8:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy53;
+	if (yych == ':') goto yy23;
 	goto yy3;
 yy9:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy46;
+	if (yych == ':') goto yy24;
 	goto yy3;
 yy10:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy39;
+	if (yych == ':') goto yy25;
 	goto yy3;
 yy11:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy32;
+	if (yych == ':') goto yy26;
 	goto yy3;
 yy12:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy25;
+	if (yych == ':') goto yy27;
 	goto yy3;
 yy13:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy17;
+	if (yych == ':') goto yy28;
 	goto yy3;
 yy14:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy29;
+	goto yy3;
+yy15:
 	++YYCURSOR;
+#line 929 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-yy16:
-	yych = *++YYCURSOR;
-	goto yy3;
+#line 664 "ext/standard/var_unserializer.c"
 yy17:
 	yych = *++YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy20;
+		goto yy31;
 	}
-	if (yych == '+') goto yy19;
+	if (yych == '+') goto yy30;
 yy18:
 	YYCURSOR = YYMARKER;
 	goto yy3;
 yy19:
+	++YYCURSOR;
+#line 599 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	INIT_PZVAL(*rval);
+	ZVAL_NULL(*rval);
+	return 1;
+}
+#line 683 "ext/standard/var_unserializer.c"
+yy21:
 	yych = *++YYCURSOR;
-	if (yybm[0+yych] & 128) {
-		goto yy20;
+	if (yych <= ',') {
+		if (yych == '+') goto yy33;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy33;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy34;
+		goto yy18;
 	}
+yy22:
+	yych = *++YYCURSOR;
+	if (yych == '+') goto yy36;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy37;
 	goto yy18;
-yy20:
-	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
-	yych = *YYCURSOR;
-	if (yybm[0+yych] & 128) {
-		goto yy20;
-	}
+yy23:
+	yych = *++YYCURSOR;
+	if (yych == '+') goto yy39;
 	if (yych <= '/') goto yy18;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy40;
+	goto yy18;
+yy24:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
-	++YYCURSOR;
-	{
-	size_t len, len2, len3, maxlen;
-	long elements;
-	char *class_name;
-	zend_class_entry *ce;
-	zend_class_entry **pce;
-	int incomplete_class = 0;
-
-	int custom_object = 0;
-
-	zval *user_func;
-	zval *retval_ptr;
-	zval **args[1];
-	zval *arg_func_name;
-
-    if (!var_hash) return 0;
-	if (*start == 'C') {
-		custom_object = 1;
-	}
-
-	INIT_PZVAL(*rval);
-	len2 = len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len || len == 0) {
-		*p = start + 2;
-		return 0;
-	}
-
-	class_name = (char*)YYCURSOR;
-
-	YYCURSOR += len;
-
-	if (*(YYCURSOR) != '"') {
-		*p = YYCURSOR;
-		return 0;
-	}
-	if (*(YYCURSOR+1) != ':') {
-		*p = YYCURSOR+1;
-		return 0;
-	}
-
-	len3 = strspn(class_name, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\");
-	if (len3 != len)
-	{
-		*p = YYCURSOR + len3 - len;
-		return 0;
-	}
-
-	class_name = estrndup(class_name, len);
-
-	do {
-		/* Try to find class directly */
-		BG(serialize_lock)++;
-		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
-			BG(serialize_lock)--;
-			if (EG(exception)) {
-				efree(class_name);
-				return 0;
-			}
-			ce = *pce;
-			break;
-		}
-		BG(serialize_lock)--;
-
-		if (EG(exception)) {
-			efree(class_name);
-			return 0;
-		}
-
-		/* Check for unserialize callback */
-		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
-			break;
-		}
-
-		/* Call unserialize callback */
-		MAKE_STD_ZVAL(user_func);
-		ZVAL_STRING(user_func, PG(unserialize_callback_func), 1);
-		args[0] = &arg_func_name;
-		MAKE_STD_ZVAL(arg_func_name);
-		ZVAL_STRING(arg_func_name, class_name, 1);
-		BG(serialize_lock)++;
-		if (call_user_function_ex(CG(function_table), NULL, user_func, &retval_ptr, 1, args, 0, NULL TSRMLS_CC) != SUCCESS) {
-			BG(serialize_lock)--;
-			if (EG(exception)) {
-				efree(class_name);
-				zval_ptr_dtor(&user_func);
-				zval_ptr_dtor(&arg_func_name);
-				return 0;
-			}
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "defined (%s) but not found", user_func->value.str.val);
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
-			zval_ptr_dtor(&user_func);
-			zval_ptr_dtor(&arg_func_name);
-			break;
-		}
-		BG(serialize_lock)--;
-		if (retval_ptr) {
-			zval_ptr_dtor(&retval_ptr);
-		}
-		if (EG(exception)) {
-			efree(class_name);
-			zval_ptr_dtor(&user_func);
-			zval_ptr_dtor(&arg_func_name);
-			return 0;
-		}
-
-		/* The callback function may have defined the class */
-		BG(serialize_lock)++;
-		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
-			ce = *pce;
+	if (yych <= '/') goto yy18;
+	if (yych <= '1') goto yy42;
+	goto yy18;
+yy25:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych <= ',') {
+			if (yych == '+') goto yy43;
+			goto yy18;
 		} else {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val);
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
+			if (yych <= '-') goto yy44;
+			if (yych <= '.') goto yy45;
+			goto yy18;
 		}
-		BG(serialize_lock)--;
-
-		zval_ptr_dtor(&user_func);
-		zval_ptr_dtor(&arg_func_name);
-		break;
-	} while (1);
-
-	*p = YYCURSOR;
-
-	if (custom_object) {
-		int ret;
-
-		ret = object_custom(UNSERIALIZE_PASSTHRU, ce);
-
-		if (ret && incomplete_class) {
-			php_store_class_name(*rval, class_name, len2);
+	} else {
+		if (yych <= 'I') {
+			if (yych <= '9') goto yy46;
+			if (yych <= 'H') goto yy18;
+			goto yy48;
+		} else {
+			if (yych == 'N') goto yy49;
+			goto yy18;
 		}
-		efree(class_name);
-		return ret;
 	}
-
-	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
-
-	if (elements < 0) {
-	   efree(class_name);
-	   return 0;
+yy26:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy50;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy50;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy51;
+		goto yy18;
 	}
-
-	if (incomplete_class) {
-		php_store_class_name(*rval, class_name, len2);
+yy27:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy53;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy53;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy54;
+		goto yy18;
 	}
-	efree(class_name);
-
-	return object_common2(UNSERIALIZE_PASSTHRU, elements);
-}
-yy25:
+yy28:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
-		if (yych != '+') goto yy18;
+		if (yych == '+') goto yy56;
+		goto yy18;
 	} else {
-		if (yych <= '-') goto yy26;
+		if (yych <= '-') goto yy56;
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy27;
+		if (yych <= '9') goto yy57;
 		goto yy18;
 	}
-yy26:
+yy29:
 	yych = *++YYCURSOR;
+	if (yych == '+') goto yy59;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy27:
+	if (yych <= '9') goto yy60;
+	goto yy18;
+yy30:
+	yych = *++YYCURSOR;
+	if (yybm[0+yych] & 128) {
+		goto yy31;
+	}
+	goto yy18;
+yy31:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
+	if (yybm[0+yych] & 128) {
+		goto yy31;
+	}
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy27;
-	if (yych >= ';') goto yy18;
+	if (yych <= ':') goto yy62;
+	goto yy18;
+yy33:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy34:
 	++YYCURSOR;
-	{
-	long elements;
-    if (!var_hash) return 0;
-
-	INIT_PZVAL(*rval);
-
-	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
-	if (elements < 0) {
-		return 0;
-	}
-	return object_common2(UNSERIALIZE_PASSTHRU, elements);
-}
-yy32:
-	yych = *++YYCURSOR;
-	if (yych == '+') goto yy33;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy34;
+	if (yych == ';') goto yy63;
 	goto yy18;
-yy33:
+yy36:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy34:
+yy37:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy34;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy37;
+	if (yych <= ':') goto yy65;
+	goto yy18;
+yy39:
 	yych = *++YYCURSOR;
-	if (yych != '{') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy40:
 	++YYCURSOR;
-	{
-	long elements = parse_iv(start + 2);
-	/* use iv() not uiv() in order to check data range */
-	*p = YYCURSOR;
-    if (!var_hash) return 0;
-
-	if (elements < 0) {
-		return 0;
+	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy40;
+	if (yych <= ':') goto yy66;
+	goto yy18;
+yy42:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy67;
+	goto yy18;
+yy43:
+	yych = *++YYCURSOR;
+	if (yych == '.') goto yy45;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy46;
+	goto yy18;
+yy44:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych != '.') goto yy18;
+	} else {
+		if (yych <= '9') goto yy46;
+		if (yych == 'I') goto yy48;
+		goto yy18;
 	}
-
-	INIT_PZVAL(*rval);
-
-	array_init_size(*rval, elements);
-
-	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_PP(rval), elements, 0)) {
-		return 0;
+yy45:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy69;
+	goto yy18;
+yy46:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
+	yych = *YYCURSOR;
+	if (yych <= ':') {
+		if (yych <= '.') {
+			if (yych <= '-') goto yy18;
+			goto yy69;
+		} else {
+			if (yych <= '/') goto yy18;
+			if (yych <= '9') goto yy46;
+			goto yy18;
+		}
+	} else {
+		if (yych <= 'E') {
+			if (yych <= ';') goto yy71;
+			if (yych <= 'D') goto yy18;
+			goto yy73;
+		} else {
+			if (yych == 'e') goto yy73;
+			goto yy18;
+		}
 	}
-
-	return finish_nested_data(UNSERIALIZE_PASSTHRU);
-}
-yy39:
+yy48:
+	yych = *++YYCURSOR;
+	if (yych == 'N') goto yy74;
+	goto yy18;
+yy49:
+	yych = *++YYCURSOR;
+	if (yych == 'A') goto yy75;
+	goto yy18;
+yy50:
 	yych = *++YYCURSOR;
-	if (yych == '+') goto yy40;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy41;
+	if (yych >= ':') goto yy18;
+yy51:
+	++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy51;
+	if (yych == ';') goto yy76;
 	goto yy18;
-yy40:
+yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy41:
+yy54:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy41;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy54;
+	if (yych <= ':') goto yy78;
+	goto yy18;
+yy56:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy57:
 	++YYCURSOR;
-	{
-	size_t len, maxlen;
-	char *str;
-
-	len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len) {
-		*p = start + 2;
-		return 0;
-	}
-
-	if ((str = unserialize_str(&YYCURSOR, &len, maxlen)) == NULL) {
-		return 0;
-	}
-
-	if (*(YYCURSOR) != '"') {
-		efree(str);
-		*p = YYCURSOR;
-		return 0;
-	}
-
-	if (*(YYCURSOR + 1) != ';') {
-		efree(str);
-		*p = YYCURSOR + 1;
-		return 0;
-	}
-
-	YYCURSOR += 2;
-	*p = YYCURSOR;
-
-	INIT_PZVAL(*rval);
-	ZVAL_STRINGL(*rval, str, len, 0);
-	return 1;
-}
-yy46:
-	yych = *++YYCURSOR;
-	if (yych == '+') goto yy47;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy48;
+	if (yych <= '9') goto yy57;
+	if (yych == ';') goto yy79;
 	goto yy18;
-yy47:
+yy59:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy48:
+yy60:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy48;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy60;
+	if (yych <= ':') goto yy81;
+	goto yy18;
+yy62:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych == '"') goto yy82;
+	goto yy18;
+yy63:
 	++YYCURSOR;
+#line 555 "ext/standard/var_unserializer.re"
 	{
-	size_t len, maxlen;
-	char *str;
-
-	len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len) {
-		*p = start + 2;
-		return 0;
-	}
-
-	str = (char*)YYCURSOR;
+	long id;
 
-	YYCURSOR += len;
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
 
-	if (*(YYCURSOR) != '"') {
-		*p = YYCURSOR;
+	id = parse_iv(start + 2) - 1;
+	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
 		return 0;
 	}
 
-	if (*(YYCURSOR + 1) != ';') {
-		*p = YYCURSOR + 1;
-		return 0;
+	if (*rval != NULL) {
+		var_push_dtor_no_addref(var_hash, rval);
 	}
+	*rval = *rval_ref;
+	Z_ADDREF_PP(rval);
+	Z_SET_ISREF_PP(rval);
 
-	YYCURSOR += 2;
-	*p = YYCURSOR;
-
-	INIT_PZVAL(*rval);
-	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-yy53:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych <= ',') {
-			if (yych == '+') goto yy57;
-			goto yy18;
-		} else {
-			if (yych <= '-') goto yy55;
-			if (yych <= '.') goto yy60;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'I') {
-			if (yych <= '9') goto yy58;
-			if (yych <= 'H') goto yy18;
-			goto yy56;
-		} else {
-			if (yych != 'N') goto yy18;
-		}
-	}
+#line 954 "ext/standard/var_unserializer.c"
+yy65:
 	yych = *++YYCURSOR;
-	if (yych == 'A') goto yy76;
+	if (yych == '"') goto yy84;
 	goto yy18;
-yy55:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych == '.') goto yy60;
-		goto yy18;
-	} else {
-		if (yych <= '9') goto yy58;
-		if (yych != 'I') goto yy18;
-	}
-yy56:
+yy66:
 	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy72;
+	if (yych == '{') goto yy86;
 	goto yy18;
-yy57:
-	yych = *++YYCURSOR;
-	if (yych == '.') goto yy60;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy58:
+yy67:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
-	yych = *YYCURSOR;
-	if (yych <= ':') {
-		if (yych <= '.') {
-			if (yych <= '-') goto yy18;
-			goto yy70;
-		} else {
-			if (yych <= '/') goto yy18;
-			if (yych <= '9') goto yy58;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'E') {
-			if (yych <= ';') goto yy63;
-			if (yych <= 'D') goto yy18;
-			goto yy65;
-		} else {
-			if (yych == 'e') goto yy65;
-			goto yy18;
-		}
-	}
-yy60:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy61:
+#line 606 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	INIT_PZVAL(*rval);
+	ZVAL_BOOL(*rval, parse_iv(start + 2));
+	return 1;
+}
+#line 972 "ext/standard/var_unserializer.c"
+yy69:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
 	yych = *YYCURSOR;
 	if (yych <= ';') {
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy61;
+		if (yych <= '9') goto yy69;
 		if (yych <= ':') goto yy18;
 	} else {
 		if (yych <= 'E') {
 			if (yych <= 'D') goto yy18;
-			goto yy65;
+			goto yy73;
 		} else {
-			if (yych == 'e') goto yy65;
+			if (yych == 'e') goto yy73;
 			goto yy18;
 		}
 	}
-yy63:
+yy71:
 	++YYCURSOR;
+#line 655 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@@@ -1093,238 +998,416 @@@@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-yy65:
+#line 1002 "ext/standard/var_unserializer.c"
+yy73:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
-		if (yych != '+') goto yy18;
+		if (yych == '+') goto yy88;
+		goto yy18;
 	} else {
-		if (yych <= '-') goto yy66;
+		if (yych <= '-') goto yy88;
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy67;
+		if (yych <= '9') goto yy89;
 		goto yy18;
 	}
-yy66:
+yy74:
 	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych == '+') goto yy69;
-		goto yy18;
-	} else {
-		if (yych <= '-') goto yy69;
-		if (yych <= '/') goto yy18;
-		if (yych >= ':') goto yy18;
-	}
-yy67:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy67;
-	if (yych == ';') goto yy63;
+	if (yych == 'F') goto yy91;
 	goto yy18;
-yy69:
+yy75:
 	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy67;
+	if (yych == 'N') goto yy91;
 	goto yy18;
-yy70:
+yy76:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
-	yych = *YYCURSOR;
-	if (yych <= ';') {
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy70;
-		if (yych <= ':') goto yy18;
-		goto yy63;
-	} else {
-		if (yych <= 'E') {
-			if (yych <= 'D') goto yy18;
-			goto yy65;
+#line 613 "ext/standard/var_unserializer.re"
+	{
+#if SIZEOF_LONG == 4
+	int digits = YYCURSOR - start - 3;
+
+	if (start[2] == '-' || start[2] == '+') {
+		digits--;
+	}
+
+	/* Use double for large long values that were serialized on a 64-bit system */
+	if (digits >= MAX_LENGTH_OF_LONG - 1) {
+		if (digits == MAX_LENGTH_OF_LONG - 1) {
+			int cmp = strncmp(YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
+
+			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
+				goto use_double;
+			}
 		} else {
-			if (yych == 'e') goto yy65;
-			goto yy18;
+			goto use_double;
 		}
 	}
-yy72:
-	yych = *++YYCURSOR;
-	if (yych != 'F') goto yy18;
-yy73:
-	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-	{
+#endif
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
-
-	if (!strncmp(start + 2, "NAN", 3)) {
-		ZVAL_DOUBLE(*rval, php_get_nan());
-	} else if (!strncmp(start + 2, "INF", 3)) {
-		ZVAL_DOUBLE(*rval, php_get_inf());
-	} else if (!strncmp(start + 2, "-INF", 4)) {
-		ZVAL_DOUBLE(*rval, -php_get_inf());
-	}
-
+	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-yy76:
-	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy73;
-	goto yy18;
-yy77:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy78;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy79;
-		goto yy18;
-	}
+#line 1051 "ext/standard/var_unserializer.c"
 yy78:
 	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
+	if (yych == '"') goto yy92;
+	goto yy18;
 yy79:
 	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy79;
-	if (yych != ';') goto yy18;
+#line 576 "ext/standard/var_unserializer.re"
+	{
+	long id;
+
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
+
+	id = parse_iv(start + 2) - 1;
+	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
+		return 0;
+	}
+
+	if (*rval == *rval_ref) return 0;
+
+	if (*rval != NULL) {
+		var_push_dtor_no_addref(var_hash, rval);
+	}
+	*rval = *rval_ref;
+	Z_ADDREF_PP(rval);
+	Z_UNSET_ISREF_PP(rval);
+
+	return 1;
+}
+#line 1081 "ext/standard/var_unserializer.c"
+yy81:
+	yych = *++YYCURSOR;
+	if (yych == '"') goto yy94;
+	goto yy18;
+yy82:
 	++YYCURSOR;
+#line 767 "ext/standard/var_unserializer.re"
 	{
-#if SIZEOF_LONG == 4
-	int digits = YYCURSOR - start - 3;
+	size_t len, len2, len3, maxlen;
+	long elements;
+	char *class_name;
+	zend_class_entry *ce;
+	zend_class_entry **pce;
+	int incomplete_class = 0;
 
-	if (start[2] == '-' || start[2] == '+') {
-		digits--;
+	int custom_object = 0;
+
+	zval *user_func;
+	zval *retval_ptr;
+	zval **args[1];
+	zval *arg_func_name;
+
+    if (!var_hash) return 0;
+	if (*start == 'C') {
+		custom_object = 1;
 	}
 
-	/* Use double for large long values that were serialized on a 64-bit system */
-	if (digits >= MAX_LENGTH_OF_LONG - 1) {
-		if (digits == MAX_LENGTH_OF_LONG - 1) {
-			int cmp = strncmp(YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
+	INIT_PZVAL(*rval);
+	len2 = len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len || len == 0) {
+		*p = start + 2;
+		return 0;
+	}
 
-			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
-				goto use_double;
+	class_name = (char*)YYCURSOR;
+
+	YYCURSOR += len;
+
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
+		return 0;
+	}
+	if (*(YYCURSOR+1) != ':') {
+		*p = YYCURSOR+1;
+		return 0;
+	}
+
+	len3 = strspn(class_name, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\");
+	if (len3 != len)
+	{
+		*p = YYCURSOR + len3 - len;
+		return 0;
+	}
+
+	class_name = estrndup(class_name, len);
+
+	do {
+		if (BG(incomplete_classes_only)) {
+			/* Do not look the class up at all, so that no code (autoloader,
+			 * unserialize_callback_func, __wakeup(), unserialize()) can run */
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			break;
+		}
+
+		/* Try to find class directly */
+		BG(serialize_lock)++;
+		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
+			BG(serialize_lock)--;
+			if (EG(exception)) {
+				efree(class_name);
+				return 0;
 			}
+			ce = *pce;
+			break;
+		}
+		BG(serialize_lock)--;
+
+		if (EG(exception)) {
+			efree(class_name);
+			return 0;
+		}
+
+		/* Check for unserialize callback */
+		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			break;
+		}
+
+		/* Call unserialize callback */
+		MAKE_STD_ZVAL(user_func);
+		ZVAL_STRING(user_func, PG(unserialize_callback_func), 1);
+		args[0] = &arg_func_name;
+		MAKE_STD_ZVAL(arg_func_name);
+		ZVAL_STRING(arg_func_name, class_name, 1);
+		BG(serialize_lock)++;
+		if (call_user_function_ex(CG(function_table), NULL, user_func, &retval_ptr, 1, args, 0, NULL TSRMLS_CC) != SUCCESS) {
+			BG(serialize_lock)--;
+			if (EG(exception)) {
+				efree(class_name);
+				zval_ptr_dtor(&user_func);
+				zval_ptr_dtor(&arg_func_name);
+				return 0;
+			}
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "defined (%s) but not found", user_func->value.str.val);
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			zval_ptr_dtor(&user_func);
+			zval_ptr_dtor(&arg_func_name);
+			break;
+		}
+		BG(serialize_lock)--;
+		if (retval_ptr) {
+			zval_ptr_dtor(&retval_ptr);
+		}
+		if (EG(exception)) {
+			efree(class_name);
+			zval_ptr_dtor(&user_func);
+			zval_ptr_dtor(&arg_func_name);
+			return 0;
+		}
+
+		/* The callback function may have defined the class */
+		BG(serialize_lock)++;
+		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
+			ce = *pce;
 		} else {
-			goto use_double;
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val);
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
 		}
-	}
-#endif
+		BG(serialize_lock)--;
+
+		zval_ptr_dtor(&user_func);
+		zval_ptr_dtor(&arg_func_name);
+		break;
+	} while (1);
+
 	*p = YYCURSOR;
-	INIT_PZVAL(*rval);
-	ZVAL_LONG(*rval, parse_iv(start + 2));
-	return 1;
+
+	if (custom_object) {
+		int ret;
+
+		ret = object_custom(UNSERIALIZE_PASSTHRU, ce, incomplete_class && BG(incomplete_classes_only));
+
+		if (ret && incomplete_class) {
+			php_store_class_name(*rval, class_name, len2);
+		}
+		efree(class_name);
+		return ret;
+	}
+
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
+
+	if (elements < 0) {
+	   efree(class_name);
+	   return 0;
+	}
+
+	if (incomplete_class) {
+		php_store_class_name(*rval, class_name, len2);
+	}
+	efree(class_name);
+
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-yy83:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= '2') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
+#line 1250 "ext/standard/var_unserializer.c"
+yy84:
 	++YYCURSOR;
+#line 698 "ext/standard/var_unserializer.re"
 	{
+	size_t len, maxlen;
+	char *str;
+
+	len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len) {
+		*p = start + 2;
+		return 0;
+	}
+
+	if ((str = unserialize_str(&YYCURSOR, &len, maxlen)) == NULL) {
+		return 0;
+	}
+
+	if (*(YYCURSOR) != '"') {
+		efree(str);
+		*p = YYCURSOR;
+		return 0;
+	}
+
+	if (*(YYCURSOR + 1) != ';') {
+		efree(str);
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
+	YYCURSOR += 2;
 	*p = YYCURSOR;
+
 	INIT_PZVAL(*rval);
-	ZVAL_BOOL(*rval, parse_iv(start + 2));
+	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-yy87:
+#line 1288 "ext/standard/var_unserializer.c"
+yy86:
 	++YYCURSOR;
+#line 733 "ext/standard/var_unserializer.re"
 	{
+	long elements = parse_iv(start + 2);
+	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
+    if (!var_hash) return 0;
+
+	if (elements < 0) {
+		return 0;
+	}
+
 	INIT_PZVAL(*rval);
-	ZVAL_NULL(*rval);
-	return 1;
+
+	array_init_size(*rval, elements);
+
+	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_PP(rval), elements, 0)) {
+		return 0;
+	}
+
+	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-yy89:
+#line 1312 "ext/standard/var_unserializer.c"
+yy88:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
-		if (yych != '+') goto yy18;
+		if (yych == '+') goto yy96;
+		goto yy18;
 	} else {
-		if (yych <= '-') goto yy90;
+		if (yych <= '-') goto yy96;
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy91;
-		goto yy18;
+		if (yych >= ':') goto yy18;
 	}
-yy90:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy91:
+yy89:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy91;
-	if (yych != ';') goto yy18;
+	if (yych <= '9') goto yy89;
+	if (yych == ';') goto yy71;
+	goto yy18;
+yy91:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy97;
+	goto yy18;
+yy92:
 	++YYCURSOR;
+#line 754 "ext/standard/var_unserializer.re"
 	{
-	long id;
+	long elements;
+    if (!var_hash) return 0;
 
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
+	INIT_PZVAL(*rval);
 
-	id = parse_iv(start + 2) - 1;
-	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
+	if (elements < 0) {
 		return 0;
 	}
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
+}
+#line 1350 "ext/standard/var_unserializer.c"
+yy94:
+	++YYCURSOR;
+#line 665 "ext/standard/var_unserializer.re"
+	{
+	size_t len, maxlen;
+	char *str;
 
-	if (*rval == *rval_ref) return 0;
+	len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len) {
+		*p = start + 2;
+		return 0;
+	}
 
-	if (*rval != NULL) {
-		var_push_dtor_no_addref(var_hash, rval);
+	str = (char*)YYCURSOR;
+
+	YYCURSOR += len;
+
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
+		return 0;
 	}
-	*rval = *rval_ref;
-	Z_ADDREF_PP(rval);
-	Z_UNSET_ISREF_PP(rval);
 
+	if (*(YYCURSOR + 1) != ';') {
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
+	YYCURSOR += 2;
+	*p = YYCURSOR;
+
+	INIT_PZVAL(*rval);
+	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-yy95:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy96;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy97;
-		goto yy18;
-	}
+#line 1386 "ext/standard/var_unserializer.c"
 yy96:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
+	if (yych <= '9') goto yy89;
+	goto yy18;
 yy97:
 	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy97;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
+#line 640 "ext/standard/var_unserializer.re"
 	{
-	long id;
-
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
-
-	id = parse_iv(start + 2) - 1;
-	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
-		return 0;
-	}
+	*p = YYCURSOR;
+	INIT_PZVAL(*rval);
 
-	if (*rval != NULL) {
-		var_push_dtor_no_addref(var_hash, rval);
+	if (!strncmp(start + 2, "NAN", 3)) {
+		ZVAL_DOUBLE(*rval, php_get_nan());
+	} else if (!strncmp(start + 2, "INF", 3)) {
+		ZVAL_DOUBLE(*rval, php_get_inf());
+	} else if (!strncmp(start + 2, "-INF", 4)) {
+		ZVAL_DOUBLE(*rval, -php_get_inf());
 	}
-	*rval = *rval_ref;
-	Z_ADDREF_PP(rval);
-	Z_SET_ISREF_PP(rval);
 
 	return 1;
 }
+#line 1409 "ext/standard/var_unserializer.c"
 }
+#line 937 "ext/standard/var_unserializer.re"
 
 
 	return 0;
@


1.1.2.1
log
@file patch-ext_standard_var__unserializer.c was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:26 +0000
@
text
@d1 1429
@


1.1.2.2
log
@Pullup ticket #7341 - requested by taca
lang/php56: Security fix

Revisions pulled up:
- lang/php56/Makefile                                           1.50
- lang/php56/distinfo                                           1.68-1.69
- lang/php56/patches/patch-Zend_zend.c                          1.1
- lang/php56/patches/patch-Zend_zend__alloc.c                   1.1
- lang/php56/patches/patch-Zend_zend__alloc.h                   1.1
- lang/php56/patches/patch-Zend_zend__execute__API.c            1.1
- lang/php56/patches/patch-Zend_zend__globals.h                 1.1
- lang/php56/patches/patch-Zend_zend__llist.c                   1.1
- lang/php56/patches/patch-Zend_zend__multiply.h                1.2
- lang/php56/patches/patch-Zend_zend__vm__execute.h             1.1
- lang/php56/patches/patch-Zend_zend__vm__execute.skl           1.1
- lang/php56/patches/patch-ext_session_session.c                1.1
- lang/php56/patches/patch-ext_standard_basic__functions.c      1.3
- lang/php56/patches/patch-ext_standard_basic__functions.h      1.1
- lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1
- lang/php56/patches/patch-ext_standard_var.c                   1.1
- lang/php56/patches/patch-ext_standard_var__unserializer.c     1.1
- lang/php56/patches/patch-ext_standard_var__unserializer.re    1.1
- lang/php56/patches/patch-main_SAPI.c                          1.1
- lang/php56/patches/patch-main_main.c                          1.1
- lang/php56/patches/patch-main_php__variables.c                1.1
- lang/php56/patches/patch-main_rfc1867.c                       1.1
- lang/php56/patches/patch-sapi_embed_php__embed.c              1.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Oct 27 15:30:49 UTC 2026

   Modified Files:
   	pkgsrc/lang/php56: Makefile distinfo
   	pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h
   Added Files:
   	pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c
   	    patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c
   	    patch-Zend_zend__globals.h patch-Zend_zend__llist.c
   	    patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl
   	    patch-ext_session_session.c patch-ext_standard_basic__functions.h
   	    patch-ext_standard_php__incomplete__class.h
   	    patch-ext_standard_var.c patch-ext_standard_var__unserializer.c
   	    patch-ext_standard_var__unserializer.re patch-main_SAPI.c
   	    patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c

   Log Message:
   lang/php56: fix CVE-2026-109618 and CVE-2026-109619

   Apply patch for CVE-2026-109618 and CVE-2026-109619.
   Thanks to sborrill@@ providing patch information.

   Bump PKGREVISION.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Oct 28 14:40:58 UTC 2026

   Modified Files:
   	pkgsrc/lang/php56: distinfo
   	pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c
   Added Files:
   	pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c

   Log Message:
   lang/php56: build fix

   Add missing parts from previous patches.
@
text
@a0 1429
$NetBSD: patch-ext_standard_var__unserializer.c,v 1.1 2026/10/27 15:30:49 taca Exp $

https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch

--- ext/standard/var_unserializer.c.orig	2019-01-09 10:25:59.000000000 +0000
+++ ext/standard/var_unserializer.c
@@@@ -1,4 +1,5 @@@@
-/* Generated by re2c 0.15.3 */
+/* Generated by re2c 1.1.1 */
+#line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
@@@@ -279,6 +280,7 @@@@ static char *unserialize_str(const unsig
 #define YYMARKER marker
 
 
+#line 288 "ext/standard/var_unserializer.re"
 
 
 
@@@@ -366,6 +368,16 @@@@ static inline int process_nested_data(UN
 			return 0;
 		}
 
+		/* The members that incomplete_classes_only mode writes itself cannot be
+		 * told apart from that bookkeeping: reject them */
+		if (objprops && UNEXPECTED(BG(incomplete_classes_only)) && Z_TYPE_P(key) == IS_STRING
+				&& ((Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER, sizeof(MAGIC_MEMBER) - 1))
+					|| (Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER_SERIALIZED) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED) - 1)))) {
+			var_push_dtor_no_addref(var_hash, &key);
+			var_push_dtor_no_addref(var_hash, &data);
+			return 0;
+		}
+
 		if (!objprops) {
 			switch (Z_TYPE_P(key)) {
 			case IS_LONG:
@@@@ -412,7 +424,7 @@@@ static inline int finish_nested_data(UNS
 	return 1;
 }
 
-static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
+static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce, int keep_payload)
 {
 	long datalen;
 
@@@@ -425,7 +437,16 @@@@ static inline int object_custom(UNSERIAL
 		return 0;
 	}
 
-	if (ce->unserialize == NULL) {
+	if (keep_payload) {
+		/* The class was not resolved (see BG(incomplete_classes_only)): keep
+		 * the payload verbatim, so that the object serializes back unchanged */
+		zval *payload;
+
+		object_init_ex(*rval, ce);
+		MAKE_STD_ZVAL(payload);
+		ZVAL_STRINGL(payload, (char *) *p, datalen, 1);
+		zend_hash_update(Z_OBJPROP_PP(rval), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED), &payload, sizeof(payload), NULL);
+	} else if (ce->unserialize == NULL) {
 		zend_error(E_WARNING, "Class %s has no unserializer", ce->name);
 		object_init_ex(*rval, ce);
 	} else if (ce->unserialize(rval, ce, (const unsigned char*)*p, datalen, (zend_unserialize_data *)var_hash TSRMLS_CC) != SUCCESS) {
@@@@ -526,6 +547,7 @@@@ PHPAPI int php_var_unserialize(UNSERIALI
 
 
 
+#line 551 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@@@ -566,524 +588,407 @@@@ PHPAPI int php_var_unserialize(UNSERIALI
 	yych = *YYCURSOR;
 	switch (yych) {
 	case 'C':
-	case 'O':	goto yy13;
+	case 'O':	goto yy4;
 	case 'N':	goto yy5;
-	case 'R':	goto yy2;
-	case 'S':	goto yy10;
-	case 'a':	goto yy11;
-	case 'b':	goto yy6;
-	case 'd':	goto yy8;
-	case 'i':	goto yy7;
+	case 'R':	goto yy6;
+	case 'S':	goto yy7;
+	case 'a':	goto yy8;
+	case 'b':	goto yy9;
+	case 'd':	goto yy10;
+	case 'i':	goto yy11;
 	case 'o':	goto yy12;
-	case 'r':	goto yy4;
-	case 's':	goto yy9;
-	case '}':	goto yy14;
-	default:	goto yy16;
+	case 'r':	goto yy13;
+	case 's':	goto yy14;
+	case '}':	goto yy15;
+	default:	goto yy2;
 	}
 yy2:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy95;
+	++YYCURSOR;
 yy3:
+#line 935 "ext/standard/var_unserializer.re"
 	{ return 0; }
+#line 611 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy89;
+	if (yych == ':') goto yy17;
 	goto yy3;
 yy5:
 	yych = *++YYCURSOR;
-	if (yych == ';') goto yy87;
+	if (yych == ';') goto yy19;
 	goto yy3;
 yy6:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy83;
+	if (yych == ':') goto yy21;
 	goto yy3;
 yy7:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy77;
+	if (yych == ':') goto yy22;
 	goto yy3;
 yy8:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy53;
+	if (yych == ':') goto yy23;
 	goto yy3;
 yy9:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy46;
+	if (yych == ':') goto yy24;
 	goto yy3;
 yy10:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy39;
+	if (yych == ':') goto yy25;
 	goto yy3;
 yy11:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy32;
+	if (yych == ':') goto yy26;
 	goto yy3;
 yy12:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy25;
+	if (yych == ':') goto yy27;
 	goto yy3;
 yy13:
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy17;
+	if (yych == ':') goto yy28;
 	goto yy3;
 yy14:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy29;
+	goto yy3;
+yy15:
 	++YYCURSOR;
+#line 929 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-yy16:
-	yych = *++YYCURSOR;
-	goto yy3;
+#line 664 "ext/standard/var_unserializer.c"
 yy17:
 	yych = *++YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy20;
+		goto yy31;
 	}
-	if (yych == '+') goto yy19;
+	if (yych == '+') goto yy30;
 yy18:
 	YYCURSOR = YYMARKER;
 	goto yy3;
 yy19:
+	++YYCURSOR;
+#line 599 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	INIT_PZVAL(*rval);
+	ZVAL_NULL(*rval);
+	return 1;
+}
+#line 683 "ext/standard/var_unserializer.c"
+yy21:
 	yych = *++YYCURSOR;
-	if (yybm[0+yych] & 128) {
-		goto yy20;
+	if (yych <= ',') {
+		if (yych == '+') goto yy33;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy33;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy34;
+		goto yy18;
 	}
+yy22:
+	yych = *++YYCURSOR;
+	if (yych == '+') goto yy36;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy37;
 	goto yy18;
-yy20:
-	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
-	yych = *YYCURSOR;
-	if (yybm[0+yych] & 128) {
-		goto yy20;
-	}
+yy23:
+	yych = *++YYCURSOR;
+	if (yych == '+') goto yy39;
 	if (yych <= '/') goto yy18;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy40;
+	goto yy18;
+yy24:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
-	++YYCURSOR;
-	{
-	size_t len, len2, len3, maxlen;
-	long elements;
-	char *class_name;
-	zend_class_entry *ce;
-	zend_class_entry **pce;
-	int incomplete_class = 0;
-
-	int custom_object = 0;
-
-	zval *user_func;
-	zval *retval_ptr;
-	zval **args[1];
-	zval *arg_func_name;
-
-    if (!var_hash) return 0;
-	if (*start == 'C') {
-		custom_object = 1;
-	}
-
-	INIT_PZVAL(*rval);
-	len2 = len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len || len == 0) {
-		*p = start + 2;
-		return 0;
-	}
-
-	class_name = (char*)YYCURSOR;
-
-	YYCURSOR += len;
-
-	if (*(YYCURSOR) != '"') {
-		*p = YYCURSOR;
-		return 0;
-	}
-	if (*(YYCURSOR+1) != ':') {
-		*p = YYCURSOR+1;
-		return 0;
-	}
-
-	len3 = strspn(class_name, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\");
-	if (len3 != len)
-	{
-		*p = YYCURSOR + len3 - len;
-		return 0;
-	}
-
-	class_name = estrndup(class_name, len);
-
-	do {
-		/* Try to find class directly */
-		BG(serialize_lock)++;
-		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
-			BG(serialize_lock)--;
-			if (EG(exception)) {
-				efree(class_name);
-				return 0;
-			}
-			ce = *pce;
-			break;
-		}
-		BG(serialize_lock)--;
-
-		if (EG(exception)) {
-			efree(class_name);
-			return 0;
-		}
-
-		/* Check for unserialize callback */
-		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
-			break;
-		}
-
-		/* Call unserialize callback */
-		MAKE_STD_ZVAL(user_func);
-		ZVAL_STRING(user_func, PG(unserialize_callback_func), 1);
-		args[0] = &arg_func_name;
-		MAKE_STD_ZVAL(arg_func_name);
-		ZVAL_STRING(arg_func_name, class_name, 1);
-		BG(serialize_lock)++;
-		if (call_user_function_ex(CG(function_table), NULL, user_func, &retval_ptr, 1, args, 0, NULL TSRMLS_CC) != SUCCESS) {
-			BG(serialize_lock)--;
-			if (EG(exception)) {
-				efree(class_name);
-				zval_ptr_dtor(&user_func);
-				zval_ptr_dtor(&arg_func_name);
-				return 0;
-			}
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "defined (%s) but not found", user_func->value.str.val);
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
-			zval_ptr_dtor(&user_func);
-			zval_ptr_dtor(&arg_func_name);
-			break;
-		}
-		BG(serialize_lock)--;
-		if (retval_ptr) {
-			zval_ptr_dtor(&retval_ptr);
-		}
-		if (EG(exception)) {
-			efree(class_name);
-			zval_ptr_dtor(&user_func);
-			zval_ptr_dtor(&arg_func_name);
-			return 0;
-		}
-
-		/* The callback function may have defined the class */
-		BG(serialize_lock)++;
-		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
-			ce = *pce;
+	if (yych <= '/') goto yy18;
+	if (yych <= '1') goto yy42;
+	goto yy18;
+yy25:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych <= ',') {
+			if (yych == '+') goto yy43;
+			goto yy18;
 		} else {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val);
-			incomplete_class = 1;
-			ce = PHP_IC_ENTRY;
+			if (yych <= '-') goto yy44;
+			if (yych <= '.') goto yy45;
+			goto yy18;
 		}
-		BG(serialize_lock)--;
-
-		zval_ptr_dtor(&user_func);
-		zval_ptr_dtor(&arg_func_name);
-		break;
-	} while (1);
-
-	*p = YYCURSOR;
-
-	if (custom_object) {
-		int ret;
-
-		ret = object_custom(UNSERIALIZE_PASSTHRU, ce);
-
-		if (ret && incomplete_class) {
-			php_store_class_name(*rval, class_name, len2);
+	} else {
+		if (yych <= 'I') {
+			if (yych <= '9') goto yy46;
+			if (yych <= 'H') goto yy18;
+			goto yy48;
+		} else {
+			if (yych == 'N') goto yy49;
+			goto yy18;
 		}
-		efree(class_name);
-		return ret;
 	}
-
-	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
-
-	if (elements < 0) {
-	   efree(class_name);
-	   return 0;
+yy26:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy50;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy50;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy51;
+		goto yy18;
 	}
-
-	if (incomplete_class) {
-		php_store_class_name(*rval, class_name, len2);
+yy27:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy53;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy53;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy54;
+		goto yy18;
 	}
-	efree(class_name);
-
-	return object_common2(UNSERIALIZE_PASSTHRU, elements);
-}
-yy25:
+yy28:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
-		if (yych != '+') goto yy18;
+		if (yych == '+') goto yy56;
+		goto yy18;
 	} else {
-		if (yych <= '-') goto yy26;
+		if (yych <= '-') goto yy56;
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy27;
+		if (yych <= '9') goto yy57;
 		goto yy18;
 	}
-yy26:
+yy29:
 	yych = *++YYCURSOR;
+	if (yych == '+') goto yy59;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy27:
+	if (yych <= '9') goto yy60;
+	goto yy18;
+yy30:
+	yych = *++YYCURSOR;
+	if (yybm[0+yych] & 128) {
+		goto yy31;
+	}
+	goto yy18;
+yy31:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
+	if (yybm[0+yych] & 128) {
+		goto yy31;
+	}
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy27;
-	if (yych >= ';') goto yy18;
+	if (yych <= ':') goto yy62;
+	goto yy18;
+yy33:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy34:
 	++YYCURSOR;
-	{
-	long elements;
-    if (!var_hash) return 0;
-
-	INIT_PZVAL(*rval);
-
-	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
-	if (elements < 0) {
-		return 0;
-	}
-	return object_common2(UNSERIALIZE_PASSTHRU, elements);
-}
-yy32:
-	yych = *++YYCURSOR;
-	if (yych == '+') goto yy33;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy34;
+	if (yych == ';') goto yy63;
 	goto yy18;
-yy33:
+yy36:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy34:
+yy37:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy34;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy37;
+	if (yych <= ':') goto yy65;
+	goto yy18;
+yy39:
 	yych = *++YYCURSOR;
-	if (yych != '{') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy40:
 	++YYCURSOR;
-	{
-	long elements = parse_iv(start + 2);
-	/* use iv() not uiv() in order to check data range */
-	*p = YYCURSOR;
-    if (!var_hash) return 0;
-
-	if (elements < 0) {
-		return 0;
+	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy40;
+	if (yych <= ':') goto yy66;
+	goto yy18;
+yy42:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy67;
+	goto yy18;
+yy43:
+	yych = *++YYCURSOR;
+	if (yych == '.') goto yy45;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy46;
+	goto yy18;
+yy44:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych != '.') goto yy18;
+	} else {
+		if (yych <= '9') goto yy46;
+		if (yych == 'I') goto yy48;
+		goto yy18;
 	}
-
-	INIT_PZVAL(*rval);
-
-	array_init_size(*rval, elements);
-
-	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_PP(rval), elements, 0)) {
-		return 0;
+yy45:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy69;
+	goto yy18;
+yy46:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
+	yych = *YYCURSOR;
+	if (yych <= ':') {
+		if (yych <= '.') {
+			if (yych <= '-') goto yy18;
+			goto yy69;
+		} else {
+			if (yych <= '/') goto yy18;
+			if (yych <= '9') goto yy46;
+			goto yy18;
+		}
+	} else {
+		if (yych <= 'E') {
+			if (yych <= ';') goto yy71;
+			if (yych <= 'D') goto yy18;
+			goto yy73;
+		} else {
+			if (yych == 'e') goto yy73;
+			goto yy18;
+		}
 	}
-
-	return finish_nested_data(UNSERIALIZE_PASSTHRU);
-}
-yy39:
+yy48:
+	yych = *++YYCURSOR;
+	if (yych == 'N') goto yy74;
+	goto yy18;
+yy49:
+	yych = *++YYCURSOR;
+	if (yych == 'A') goto yy75;
+	goto yy18;
+yy50:
 	yych = *++YYCURSOR;
-	if (yych == '+') goto yy40;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy41;
+	if (yych >= ':') goto yy18;
+yy51:
+	++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy51;
+	if (yych == ';') goto yy76;
 	goto yy18;
-yy40:
+yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy41:
+yy54:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy41;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy54;
+	if (yych <= ':') goto yy78;
+	goto yy18;
+yy56:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy57:
 	++YYCURSOR;
-	{
-	size_t len, maxlen;
-	char *str;
-
-	len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len) {
-		*p = start + 2;
-		return 0;
-	}
-
-	if ((str = unserialize_str(&YYCURSOR, &len, maxlen)) == NULL) {
-		return 0;
-	}
-
-	if (*(YYCURSOR) != '"') {
-		efree(str);
-		*p = YYCURSOR;
-		return 0;
-	}
-
-	if (*(YYCURSOR + 1) != ';') {
-		efree(str);
-		*p = YYCURSOR + 1;
-		return 0;
-	}
-
-	YYCURSOR += 2;
-	*p = YYCURSOR;
-
-	INIT_PZVAL(*rval);
-	ZVAL_STRINGL(*rval, str, len, 0);
-	return 1;
-}
-yy46:
-	yych = *++YYCURSOR;
-	if (yych == '+') goto yy47;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy48;
+	if (yych <= '9') goto yy57;
+	if (yych == ';') goto yy79;
 	goto yy18;
-yy47:
+yy59:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= ':') goto yy18;
-yy48:
+yy60:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy48;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy60;
+	if (yych <= ':') goto yy81;
+	goto yy18;
+yy62:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych == '"') goto yy82;
+	goto yy18;
+yy63:
 	++YYCURSOR;
+#line 555 "ext/standard/var_unserializer.re"
 	{
-	size_t len, maxlen;
-	char *str;
-
-	len = parse_uiv(start + 2);
-	maxlen = max - YYCURSOR;
-	if (maxlen < len) {
-		*p = start + 2;
-		return 0;
-	}
-
-	str = (char*)YYCURSOR;
+	long id;
 
-	YYCURSOR += len;
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
 
-	if (*(YYCURSOR) != '"') {
-		*p = YYCURSOR;
+	id = parse_iv(start + 2) - 1;
+	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
 		return 0;
 	}
 
-	if (*(YYCURSOR + 1) != ';') {
-		*p = YYCURSOR + 1;
-		return 0;
+	if (*rval != NULL) {
+		var_push_dtor_no_addref(var_hash, rval);
 	}
+	*rval = *rval_ref;
+	Z_ADDREF_PP(rval);
+	Z_SET_ISREF_PP(rval);
 
-	YYCURSOR += 2;
-	*p = YYCURSOR;
-
-	INIT_PZVAL(*rval);
-	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-yy53:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych <= ',') {
-			if (yych == '+') goto yy57;
-			goto yy18;
-		} else {
-			if (yych <= '-') goto yy55;
-			if (yych <= '.') goto yy60;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'I') {
-			if (yych <= '9') goto yy58;
-			if (yych <= 'H') goto yy18;
-			goto yy56;
-		} else {
-			if (yych != 'N') goto yy18;
-		}
-	}
+#line 954 "ext/standard/var_unserializer.c"
+yy65:
 	yych = *++YYCURSOR;
-	if (yych == 'A') goto yy76;
+	if (yych == '"') goto yy84;
 	goto yy18;
-yy55:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych == '.') goto yy60;
-		goto yy18;
-	} else {
-		if (yych <= '9') goto yy58;
-		if (yych != 'I') goto yy18;
-	}
-yy56:
+yy66:
 	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy72;
+	if (yych == '{') goto yy86;
 	goto yy18;
-yy57:
-	yych = *++YYCURSOR;
-	if (yych == '.') goto yy60;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy58:
+yy67:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
-	yych = *YYCURSOR;
-	if (yych <= ':') {
-		if (yych <= '.') {
-			if (yych <= '-') goto yy18;
-			goto yy70;
-		} else {
-			if (yych <= '/') goto yy18;
-			if (yych <= '9') goto yy58;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'E') {
-			if (yych <= ';') goto yy63;
-			if (yych <= 'D') goto yy18;
-			goto yy65;
-		} else {
-			if (yych == 'e') goto yy65;
-			goto yy18;
-		}
-	}
-yy60:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy61:
+#line 606 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	INIT_PZVAL(*rval);
+	ZVAL_BOOL(*rval, parse_iv(start + 2));
+	return 1;
+}
+#line 972 "ext/standard/var_unserializer.c"
+yy69:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
 	yych = *YYCURSOR;
 	if (yych <= ';') {
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy61;
+		if (yych <= '9') goto yy69;
 		if (yych <= ':') goto yy18;
 	} else {
 		if (yych <= 'E') {
 			if (yych <= 'D') goto yy18;
-			goto yy65;
+			goto yy73;
 		} else {
-			if (yych == 'e') goto yy65;
+			if (yych == 'e') goto yy73;
 			goto yy18;
 		}
 	}
-yy63:
+yy71:
 	++YYCURSOR;
+#line 655 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@@@ -1093,238 +998,416 @@@@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-yy65:
+#line 1002 "ext/standard/var_unserializer.c"
+yy73:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
-		if (yych != '+') goto yy18;
+		if (yych == '+') goto yy88;
+		goto yy18;
 	} else {
-		if (yych <= '-') goto yy66;
+		if (yych <= '-') goto yy88;
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy67;
+		if (yych <= '9') goto yy89;
 		goto yy18;
 	}
-yy66:
+yy74:
 	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych == '+') goto yy69;
-		goto yy18;
-	} else {
-		if (yych <= '-') goto yy69;
-		if (yych <= '/') goto yy18;
-		if (yych >= ':') goto yy18;
-	}
-yy67:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy67;
-	if (yych == ';') goto yy63;
+	if (yych == 'F') goto yy91;
 	goto yy18;
-yy69:
+yy75:
 	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy67;
+	if (yych == 'N') goto yy91;
 	goto yy18;
-yy70:
+yy76:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
-	yych = *YYCURSOR;
-	if (yych <= ';') {
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy70;
-		if (yych <= ':') goto yy18;
-		goto yy63;
-	} else {
-		if (yych <= 'E') {
-			if (yych <= 'D') goto yy18;
-			goto yy65;
+#line 613 "ext/standard/var_unserializer.re"
+	{
+#if SIZEOF_LONG == 4
+	int digits = YYCURSOR - start - 3;
+
+	if (start[2] == '-' || start[2] == '+') {
+		digits--;
+	}
+
+	/* Use double for large long values that were serialized on a 64-bit system */
+	if (digits >= MAX_LENGTH_OF_LONG - 1) {
+		if (digits == MAX_LENGTH_OF_LONG - 1) {
+			int cmp = strncmp(YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
+
+			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
+				goto use_double;
+			}
 		} else {
-			if (yych == 'e') goto yy65;
-			goto yy18;
+			goto use_double;
 		}
 	}
-yy72:
-	yych = *++YYCURSOR;
-	if (yych != 'F') goto yy18;
-yy73:
-	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-	{
+#endif
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
-
-	if (!strncmp(start + 2, "NAN", 3)) {
-		ZVAL_DOUBLE(*rval, php_get_nan());
-	} else if (!strncmp(start + 2, "INF", 3)) {
-		ZVAL_DOUBLE(*rval, php_get_inf());
-	} else if (!strncmp(start + 2, "-INF", 4)) {
-		ZVAL_DOUBLE(*rval, -php_get_inf());
-	}
-
+	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-yy76:
-	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy73;
-	goto yy18;
-yy77:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy78;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy79;
-		goto yy18;
-	}
+#line 1051 "ext/standard/var_unserializer.c"
 yy78:
 	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
+	if (yych == '"') goto yy92;
+	goto yy18;
 yy79:
 	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy79;
-	if (yych != ';') goto yy18;
+#line 576 "ext/standard/var_unserializer.re"
+	{
+	long id;
+
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
+
+	id = parse_iv(start + 2) - 1;
+	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
+		return 0;
+	}
+
+	if (*rval == *rval_ref) return 0;
+
+	if (*rval != NULL) {
+		var_push_dtor_no_addref(var_hash, rval);
+	}
+	*rval = *rval_ref;
+	Z_ADDREF_PP(rval);
+	Z_UNSET_ISREF_PP(rval);
+
+	return 1;
+}
+#line 1081 "ext/standard/var_unserializer.c"
+yy81:
+	yych = *++YYCURSOR;
+	if (yych == '"') goto yy94;
+	goto yy18;
+yy82:
 	++YYCURSOR;
+#line 767 "ext/standard/var_unserializer.re"
 	{
-#if SIZEOF_LONG == 4
-	int digits = YYCURSOR - start - 3;
+	size_t len, len2, len3, maxlen;
+	long elements;
+	char *class_name;
+	zend_class_entry *ce;
+	zend_class_entry **pce;
+	int incomplete_class = 0;
 
-	if (start[2] == '-' || start[2] == '+') {
-		digits--;
+	int custom_object = 0;
+
+	zval *user_func;
+	zval *retval_ptr;
+	zval **args[1];
+	zval *arg_func_name;
+
+    if (!var_hash) return 0;
+	if (*start == 'C') {
+		custom_object = 1;
 	}
 
-	/* Use double for large long values that were serialized on a 64-bit system */
-	if (digits >= MAX_LENGTH_OF_LONG - 1) {
-		if (digits == MAX_LENGTH_OF_LONG - 1) {
-			int cmp = strncmp(YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
+	INIT_PZVAL(*rval);
+	len2 = len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len || len == 0) {
+		*p = start + 2;
+		return 0;
+	}
 
-			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
-				goto use_double;
+	class_name = (char*)YYCURSOR;
+
+	YYCURSOR += len;
+
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
+		return 0;
+	}
+	if (*(YYCURSOR+1) != ':') {
+		*p = YYCURSOR+1;
+		return 0;
+	}
+
+	len3 = strspn(class_name, "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\");
+	if (len3 != len)
+	{
+		*p = YYCURSOR + len3 - len;
+		return 0;
+	}
+
+	class_name = estrndup(class_name, len);
+
+	do {
+		if (BG(incomplete_classes_only)) {
+			/* Do not look the class up at all, so that no code (autoloader,
+			 * unserialize_callback_func, __wakeup(), unserialize()) can run */
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			break;
+		}
+
+		/* Try to find class directly */
+		BG(serialize_lock)++;
+		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
+			BG(serialize_lock)--;
+			if (EG(exception)) {
+				efree(class_name);
+				return 0;
 			}
+			ce = *pce;
+			break;
+		}
+		BG(serialize_lock)--;
+
+		if (EG(exception)) {
+			efree(class_name);
+			return 0;
+		}
+
+		/* Check for unserialize callback */
+		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			break;
+		}
+
+		/* Call unserialize callback */
+		MAKE_STD_ZVAL(user_func);
+		ZVAL_STRING(user_func, PG(unserialize_callback_func), 1);
+		args[0] = &arg_func_name;
+		MAKE_STD_ZVAL(arg_func_name);
+		ZVAL_STRING(arg_func_name, class_name, 1);
+		BG(serialize_lock)++;
+		if (call_user_function_ex(CG(function_table), NULL, user_func, &retval_ptr, 1, args, 0, NULL TSRMLS_CC) != SUCCESS) {
+			BG(serialize_lock)--;
+			if (EG(exception)) {
+				efree(class_name);
+				zval_ptr_dtor(&user_func);
+				zval_ptr_dtor(&arg_func_name);
+				return 0;
+			}
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "defined (%s) but not found", user_func->value.str.val);
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
+			zval_ptr_dtor(&user_func);
+			zval_ptr_dtor(&arg_func_name);
+			break;
+		}
+		BG(serialize_lock)--;
+		if (retval_ptr) {
+			zval_ptr_dtor(&retval_ptr);
+		}
+		if (EG(exception)) {
+			efree(class_name);
+			zval_ptr_dtor(&user_func);
+			zval_ptr_dtor(&arg_func_name);
+			return 0;
+		}
+
+		/* The callback function may have defined the class */
+		BG(serialize_lock)++;
+		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
+			ce = *pce;
 		} else {
-			goto use_double;
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Function %s() hasn't defined the class it was called for", user_func->value.str.val);
+			incomplete_class = 1;
+			ce = PHP_IC_ENTRY;
 		}
-	}
-#endif
+		BG(serialize_lock)--;
+
+		zval_ptr_dtor(&user_func);
+		zval_ptr_dtor(&arg_func_name);
+		break;
+	} while (1);
+
 	*p = YYCURSOR;
-	INIT_PZVAL(*rval);
-	ZVAL_LONG(*rval, parse_iv(start + 2));
-	return 1;
+
+	if (custom_object) {
+		int ret;
+
+		ret = object_custom(UNSERIALIZE_PASSTHRU, ce, incomplete_class && BG(incomplete_classes_only));
+
+		if (ret && incomplete_class) {
+			php_store_class_name(*rval, class_name, len2);
+		}
+		efree(class_name);
+		return ret;
+	}
+
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
+
+	if (elements < 0) {
+	   efree(class_name);
+	   return 0;
+	}
+
+	if (incomplete_class) {
+		php_store_class_name(*rval, class_name, len2);
+	}
+	efree(class_name);
+
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-yy83:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= '2') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
+#line 1250 "ext/standard/var_unserializer.c"
+yy84:
 	++YYCURSOR;
+#line 698 "ext/standard/var_unserializer.re"
 	{
+	size_t len, maxlen;
+	char *str;
+
+	len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len) {
+		*p = start + 2;
+		return 0;
+	}
+
+	if ((str = unserialize_str(&YYCURSOR, &len, maxlen)) == NULL) {
+		return 0;
+	}
+
+	if (*(YYCURSOR) != '"') {
+		efree(str);
+		*p = YYCURSOR;
+		return 0;
+	}
+
+	if (*(YYCURSOR + 1) != ';') {
+		efree(str);
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
+	YYCURSOR += 2;
 	*p = YYCURSOR;
+
 	INIT_PZVAL(*rval);
-	ZVAL_BOOL(*rval, parse_iv(start + 2));
+	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-yy87:
+#line 1288 "ext/standard/var_unserializer.c"
+yy86:
 	++YYCURSOR;
+#line 733 "ext/standard/var_unserializer.re"
 	{
+	long elements = parse_iv(start + 2);
+	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
+    if (!var_hash) return 0;
+
+	if (elements < 0) {
+		return 0;
+	}
+
 	INIT_PZVAL(*rval);
-	ZVAL_NULL(*rval);
-	return 1;
+
+	array_init_size(*rval, elements);
+
+	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_PP(rval), elements, 0)) {
+		return 0;
+	}
+
+	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-yy89:
+#line 1312 "ext/standard/var_unserializer.c"
+yy88:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
-		if (yych != '+') goto yy18;
+		if (yych == '+') goto yy96;
+		goto yy18;
 	} else {
-		if (yych <= '-') goto yy90;
+		if (yych <= '-') goto yy96;
 		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy91;
-		goto yy18;
+		if (yych >= ':') goto yy18;
 	}
-yy90:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy91:
+yy89:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy91;
-	if (yych != ';') goto yy18;
+	if (yych <= '9') goto yy89;
+	if (yych == ';') goto yy71;
+	goto yy18;
+yy91:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy97;
+	goto yy18;
+yy92:
 	++YYCURSOR;
+#line 754 "ext/standard/var_unserializer.re"
 	{
-	long id;
+	long elements;
+    if (!var_hash) return 0;
 
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
+	INIT_PZVAL(*rval);
 
-	id = parse_iv(start + 2) - 1;
-	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
+	if (elements < 0) {
 		return 0;
 	}
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
+}
+#line 1350 "ext/standard/var_unserializer.c"
+yy94:
+	++YYCURSOR;
+#line 665 "ext/standard/var_unserializer.re"
+	{
+	size_t len, maxlen;
+	char *str;
 
-	if (*rval == *rval_ref) return 0;
+	len = parse_uiv(start + 2);
+	maxlen = max - YYCURSOR;
+	if (maxlen < len) {
+		*p = start + 2;
+		return 0;
+	}
 
-	if (*rval != NULL) {
-		var_push_dtor_no_addref(var_hash, rval);
+	str = (char*)YYCURSOR;
+
+	YYCURSOR += len;
+
+	if (*(YYCURSOR) != '"') {
+		*p = YYCURSOR;
+		return 0;
 	}
-	*rval = *rval_ref;
-	Z_ADDREF_PP(rval);
-	Z_UNSET_ISREF_PP(rval);
 
+	if (*(YYCURSOR + 1) != ';') {
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
+	YYCURSOR += 2;
+	*p = YYCURSOR;
+
+	INIT_PZVAL(*rval);
+	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-yy95:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy96;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy97;
-		goto yy18;
-	}
+#line 1386 "ext/standard/var_unserializer.c"
 yy96:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
+	if (yych <= '9') goto yy89;
+	goto yy18;
 yy97:
 	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy97;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
+#line 640 "ext/standard/var_unserializer.re"
 	{
-	long id;
-
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
-
-	id = parse_iv(start + 2) - 1;
-	if (id == -1 || var_access(var_hash, id, &rval_ref) != SUCCESS) {
-		return 0;
-	}
+	*p = YYCURSOR;
+	INIT_PZVAL(*rval);
 
-	if (*rval != NULL) {
-		var_push_dtor_no_addref(var_hash, rval);
+	if (!strncmp(start + 2, "NAN", 3)) {
+		ZVAL_DOUBLE(*rval, php_get_nan());
+	} else if (!strncmp(start + 2, "INF", 3)) {
+		ZVAL_DOUBLE(*rval, php_get_inf());
+	} else if (!strncmp(start + 2, "-INF", 4)) {
+		ZVAL_DOUBLE(*rval, -php_get_inf());
 	}
-	*rval = *rval_ref;
-	Z_ADDREF_PP(rval);
-	Z_SET_ISREF_PP(rval);
 
 	return 1;
 }
+#line 1409 "ext/standard/var_unserializer.c"
 }
+#line 937 "ext/standard/var_unserializer.re"
 
 
 	return 0;
@