FIx bug #70213

Fix bug #73825 - Heap out of bounds read on unserialize in finish_nested_data()

Fix bug #73052 - Memory Corruption in During Deserialized-object Destruction

Followup for bug #72785

Fix incorrect handling of nesting ... need to reset to the old
value afterwards.

Fix bug #72785 - allowed_classes only applies to outermost unserialize()

Bug #72663 - part 2

If a (nested) unserialize() call fails, we remove all the values
that were inserted into var_hash during that call. This prevents
their use in other unserializati

Bug #72663 - part 2

If a (nested) unserialize() call fails, we remove all the values
that were inserted into var_hash during that call. This prevents
their use in other unserializations in the same context.

show more ...

Bug #72663 - part 1

Don't call __destruct() on an unserialized object that has a
__wakeup() method if either
a) unserialization of its properties fails or
b) the __wakeup() call

Bug #72663 - part 1

Don't call __destruct() on an unserialized object that has a
__wakeup() method if either
a) unserialization of its properties fails or
b) the __wakeup() call fails (e.g. by throwing).

This basically treats __wakeup() as a form of constructor and
aligns us with the usual behavior that if the constructor call
fails the destructor should not be called.

The security aspect here is that people use __wakeup() to prevent
unserialization of objects with dangerous __destruct() methods,
but this is ineffective if __destruct() can still be called while
__wakeup() was skipped.

show more ...

Improve fix for #72663

Update comment

Fix bug #72663 - destroy broken object when unserializing

Hide (un)serialize data from ABI

The (UN)SERIALIZE_INIT/DESTROY macros now go through non-inlined
functions, so any changes to them will apply to extensions without
rebuilds.

Hide (un)serialize data from ABI

The (UN)SERIALIZE_INIT/DESTROY macros now go through non-inlined
functions, so any changes to them will apply to extensions without
rebuilds.

Additionally, the (un)serialize_data structures are now no longer
exported.

This means that we are allowed to change these structures in patch
releases without breaking the ABI.

show more ...

Added ZEND_ATTRIBUTE_FORMAT to some middind functions.
"%p" replaced by ZEND_LONG_FMT to avoid compilation warnings.
Fixed most incorrect use cases of format specifiers.

Use zend_string_safe_alloc

Improved fix for #71940

Fixed bug #71940 (Unserialize crushes on restore object reference)

Deduplicate NAN/INF portability, move to Zend

Fixed bug #71840 (Unserialize accepts wrongly data)

Eliminate usages of _PP macros

These are either in debug code (fix them), commented out (drop
them) or in dead compatibility macros (drop them).

One usage was in php_stream_get_

Eliminate usages of _PP macros

These are either in debug code (fix them), commented out (drop
them) or in dead compatibility macros (drop them).

One usage was in php_stream_get_from_zval(), which we have not used
since at least PHP 5.2 and, judging from the fact that nobody
complained about it causing compile errors in PHP 7, nobody else
uses it either, so drop it.

There are still remaining uses in mysqli embedded and odbc birdstep.
These probably need to be dropped outright.

show more ...

Fixed bug #71311: Use-after-free vulnerability in SPL(ArrayObject, unserialize)

Happy new year (Update copyright to 2016)

Also fixed 'r'

Indent (not sure why it was messed)

Fixed bug #70963 (Unserialize shows UNKNOW in result)

Thanks to ryat for reportinig

Cleanup: removed deprecated commented code

Don't allocate memory for empty HashTables.