Merge branch 'php7' of github.com:msgpack/msgpack-php into php7

Author: laruence

msgpack.c

@@ -168,11 +168,14 @@ PS_SERIALIZER_DECODE_FUNC(msgpack) /* {{{ */ {
 	mp.user.var_hash = &var_hash;
 
 	ret = template_execute(&mp, val, vallen, &off);
+	if (Z_TYPE_P(mp.user.retval) == IS_REFERENCE) {
+		ZVAL_DEREF(mp.user.retval);
+	}
 
 	if (ret == MSGPACK_UNPACK_EXTRA_BYTES || ret == MSGPACK_UNPACK_SUCCESS) {
 		msgpack_unserialize_var_destroy(&var_hash, 0);
 
-		ZEND_HASH_FOREACH_STR_KEY_VAL(HASH_OF(&tmp), key_str, value) {
+		ZEND_HASH_FOREACH_STR_KEY_VAL(HASH_OF(mp.user.retval), key_str, value) {
 			if (key_str) {
 				php_set_session_var(key_str, value, NULL);
 				php_add_session_var(key_str);

msgpack_unpack.c

@@ -178,9 +178,11 @@ static zend_class_entry* msgpack_unserialize_class(zval **container, zend_string
     zend_class_entry *ce;
     int func_call_status;
     zend_bool incomplete_class = 0;
-    zval user_func, retval, args[1], *container_val;
+    zval user_func, retval, args[1], *container_val, container_tmp, *val;
+    zend_string *str_key;
 
     container_val = Z_ISREF_P(*container) ? Z_REFVAL_P(*container) : *container;
+    ZVAL_UNDEF(&container_tmp);
 
     do {
         /* Try to find class directly */
@@ -229,7 +231,22 @@ static zend_class_entry* msgpack_unserialize_class(zval **container, zend_string
     }
 
     if (init_class || incomplete_class) {
+        if (Z_TYPE_P(container_val) == IS_ARRAY) {
+            ZVAL_COPY_VALUE(&container_tmp, container_val);
+        }
         object_init_ex(container_val, ce);
+
+        if (Z_TYPE(container_tmp) != IS_UNDEF) {
+            ZEND_HASH_FOREACH_STR_KEY_VAL(HASH_OF(&container_tmp), str_key, val) {
+                const char *class_name, *prop_name;
+                size_t prop_len;
+
+                zend_unmangle_property_name_ex(str_key, &class_name, &prop_name, &prop_len);
+                zend_update_property(Z_OBJCE_P(container_val), container_val, prop_name, prop_len, val);
+            } ZEND_HASH_FOREACH_END();
+            zval_dtor(&container_tmp);
+        }
+
     }
 
     /* store incomplete class name */

tests/139.phpt

@@ -0,0 +1,132 @@
+--TEST--
+Null byte key position while unpacking objects
+--SKIPIF--
+<?php
+if (version_compare(PHP_VERSION, '5.2.0') < 0) {
+    echo "skip tests in PHP 5.2 or newer";
+}
+--FILE--
+<?php
+if(!extension_loaded('msgpack'))
+{
+    dl('msgpack.' . PHP_SHLIB_SUFFIX);
+}
+
+function test($type, $array)
+{
+    $stdClass = hex2bin('c0a8737464436c617373'); // "\0" => 'stdClass'
+    $placeholder = hex2bin('a178a178'); // 'x' => 'x'
+
+    $serialized = msgpack_pack($array);
+    $serialized = str_replace($placeholder, $stdClass, $serialized);
+    $unserialized = msgpack_unpack($serialized);
+
+    var_dump($unserialized);
+    unset($array['x']);
+
+    echo $unserialized == (object) $array ? 'OK' : 'ERROR', PHP_EOL;
+}
+
+$array = array('x' => 'x', 'foo' => 1);
+test('single property, key at the beginning', $array);
+
+$array = array('foo' => 1, 'x' => 'x');
+test('single property, key at the end', $array);
+
+$array = array('x' => 'x', 'foo' => 1, 'bar' => 2);
+test('multiple properties, key at the beginning', $array);
+
+$array = array('foo' => 1, 'x' => 'x', 'bar' => 2);
+test('multiple properties, key in the middle', $array);
+
+$array = array('foo' => 1, 'bar' => 2, 'x' => 'x');
+test('multiple properties, key at the end', $array);
+
+$array = array('null' => null, 'x' => 'x');
+test('null, key at the end', $array);
+
+$array = array('int' => 1, 'x' => 'x');
+test('int, key at the end', $array);
+
+$array = array('float' => 4.2, 'x' => 'x');
+test('float, key at the end', $array);
+
+$array = array('string' => 'str', 'x' => 'x');
+test('string, key at the end', $array);
+
+$array = array('array' => array(42), 'x' => 'x');
+test('array, key at the end', $array);
+
+class Foo { public $a = null; }
+$obj = new Foo();
+$array = array('object' => $obj, 'x' => 'x');
+test('object, key at the end', $array);
+
+--EXPECTF--
+object(stdClass)#%d (1) {
+  ["foo"]=>
+  int(1)
+}
+OK
+object(stdClass)#%d (1) {
+  ["foo"]=>
+  int(1)
+}
+OK
+object(stdClass)#%d (2) {
+  ["foo"]=>
+  int(1)
+  ["bar"]=>
+  int(2)
+}
+OK
+object(stdClass)#%d (2) {
+  ["foo"]=>
+  int(1)
+  ["bar"]=>
+  int(2)
+}
+OK
+object(stdClass)#%d (2) {
+  ["foo"]=>
+  int(1)
+  ["bar"]=>
+  int(2)
+}
+OK
+object(stdClass)#%d (1) {
+  ["null"]=>
+  NULL
+}
+OK
+object(stdClass)#%d (1) {
+  ["int"]=>
+  int(1)
+}
+OK
+object(stdClass)#%d (1) {
+  ["float"]=>
+  float(4.2)
+}
+OK
+object(stdClass)#%d (1) {
+  ["string"]=>
+  string(3) "str"
+}
+OK
+object(stdClass)#%d (1) {
+  ["array"]=>
+  array(1) {
+    [0]=>
+    int(42)
+  }
+}
+OK
+object(stdClass)#%d (1) {
+  ["object"]=>
+  object(Foo)#%d (1) {
+    ["a"]=>
+    NULL
+  }
+}
+OK