diff --git a/NEWS b/NEWS
index b1068f1feb4..c783c3c7501 100644
--- a/NEWS
+++ b/NEWS
@@ -59,6 +59,12 @@ PHP                                                                        NEWS
     (Andrew Nester)
   . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
 
+- Standard:
+  . Fixed bug #74103 (heap-use-after-free when unserializing invalid array
+    size). (Nikita)
+  . Fixed bug #75054 (A Denial of Service Vulnerability was found when
+    performing deserialization). (Nikita)
+
 - XMLRPC:
   . Fixed bug #74975 (Incorrect xmlrpc serialization for classes with declared
     properties). (blar)
diff --git a/ext/standard/tests/serialize/bug74103.phpt b/ext/standard/tests/serialize/bug74103.phpt
new file mode 100644
index 00000000000..3d474b31b1c
--- /dev/null
+++ b/ext/standard/tests/serialize/bug74103.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #74103: heap-use-after-free when unserializing invalid array size
+--FILE--
+<?php
+var_dump(unserialize('a:7:{i:0;i:04;s:1:"a";i:2;i:00009617006;i:4;s:1:"a";i:4;s:1:"a";R:5;s:1:"7";R:3;s:1:"a";R:5;;s:18;}}'));
+?>
+--EXPECTF--
+Notice: unserialize(): Error at offset 68 of 100 bytes in %s on line %d
+bool(false)
diff --git a/ext/standard/tests/serialize/bug75054.phpt b/ext/standard/tests/serialize/bug75054.phpt
new file mode 100644
index 00000000000..51f5692f445
--- /dev/null
+++ b/ext/standard/tests/serialize/bug75054.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #75054: A Denial of Service Vulnerability was found when performing deserialization
+--FILE--
+<?php
+$poc = 'a:9:{i:0;s:4:"0000";i:0;s:4:"0000";i:0;R:2;s:4:"5003";R:2;s:4:"0000";R:2;s:4:"0000";R:2;s:4:"';
+$poc .= "\x06";
+$poc .= '000";R:2;s:4:"0000";d:0;s:4:"0000";a:9:{s:4:"0000";';
+var_dump(unserialize($poc));
+?>
+--EXPECTF--
+Notice: unserialize(): Error at offset 43 of 145 bytes in %s on line %d
+bool(false)
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 2f5559c5191..acbc711118e 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.15.3 */
+/* Generated by re2c 0.16 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
@@ -450,16 +450,7 @@ string_key:
 			return 0;
 		}
 
-		if (UNEXPECTED(Z_ISUNDEF_P(data))) {
-			if (Z_TYPE(key) == IS_LONG) {
-				zend_hash_index_del(ht, Z_LVAL(key));
-			} else {
-				zend_hash_del_ind(ht, Z_STR(key));
-			}
-		} else {
-			var_push_dtor(var_hash, data);
-		}
-
+		var_push_dtor(var_hash, data);
 		zval_dtor(&key);
 
 		if (elements && *(*p-1) != ';' && *(*p-1) != '}') {
@@ -620,7 +611,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 	start = cursor;
 
 
-#line 624 "ext/standard/var_unserializer.c"
+#line 615 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -661,107 +652,504 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 	yych = *YYCURSOR;
 	switch (yych) {
 	case 'C':
-	case 'O':	goto yy13;
+	case 'O':	goto yy4;
 	case 'N':	goto yy5;
-	case 'R':	goto yy2;
-	case 'S':	goto yy10;
-	case 'a':	goto yy11;
-	case 'b':	goto yy6;
-	case 'd':	goto yy8;
-	case 'i':	goto yy7;
+	case 'R':	goto yy6;
+	case 'S':	goto yy7;
+	case 'a':	goto yy8;
+	case 'b':	goto yy9;
+	case 'd':	goto yy10;
+	case 'i':	goto yy11;
 	case 'o':	goto yy12;
-	case 'r':	goto yy4;
-	case 's':	goto yy9;
-	case '}':	goto yy14;
-	default:	goto yy16;
+	case 'r':	goto yy13;
+	case 's':	goto yy14;
+	case '}':	goto yy15;
+	default:	goto yy2;
 	}
 yy2:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy95;
+	++YYCURSOR;
 yy3:
-#line 1001 "ext/standard/var_unserializer.re"
+#line 990 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 685 "ext/standard/var_unserializer.c"
+#line 675 "ext/standard/var_unserializer.c"
 yy4:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy89;
-	goto yy3;
-yy5:
-	yych = *++YYCURSOR;
-	if (yych == ';') goto yy87;
-	goto yy3;
-yy6:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy83;
-	goto yy3;
-yy7:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy77;
-	goto yy3;
-yy8:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy53;
-	goto yy3;
-yy9:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy46;
-	goto yy3;
-yy10:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy39;
-	goto yy3;
-yy11:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy32;
-	goto yy3;
-yy12:
-	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych == ':') goto yy25;
-	goto yy3;
-yy13:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy17;
 	goto yy3;
+yy5:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy19;
+	goto yy3;
+yy6:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy21;
+	goto yy3;
+yy7:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy22;
+	goto yy3;
+yy8:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy23;
+	goto yy3;
+yy9:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy24;
+	goto yy3;
+yy10:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy25;
+	goto yy3;
+yy11:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy26;
+	goto yy3;
+yy12:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy27;
+	goto yy3;
+yy13:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy28;
+	goto yy3;
 yy14:
+	yych = *(YYMARKER = ++YYCURSOR);
+	if (yych == ':') goto yy29;
+	goto yy3;
+yy15:
 	++YYCURSOR;
-#line 995 "ext/standard/var_unserializer.re"
+#line 984 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 734 "ext/standard/var_unserializer.c"
-yy16:
-	yych = *++YYCURSOR;
-	goto yy3;
+#line 728 "ext/standard/var_unserializer.c"
 yy17:
 	yych = *++YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy20;
+		goto yy31;
 	}
-	if (yych == '+') goto yy19;
+	if (yych == '+') goto yy30;
 yy18:
 	YYCURSOR = YYMARKER;
 	goto yy3;
 yy19:
+	++YYCURSOR;
+#line 668 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	ZVAL_NULL(rval);
+	return 1;
+}
+#line 746 "ext/standard/var_unserializer.c"
+yy21:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy33;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy33;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy34;
+		goto yy18;
+	}
+yy22:
+	yych = *++YYCURSOR;
+	if (yych == '+') goto yy36;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy37;
+	goto yy18;
+yy23:
+	yych = *++YYCURSOR;
+	if (yych == '+') goto yy39;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy40;
+	goto yy18;
+yy24:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '1') goto yy42;
+	goto yy18;
+yy25:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych <= ',') {
+			if (yych == '+') goto yy43;
+			goto yy18;
+		} else {
+			if (yych <= '-') goto yy44;
+			if (yych <= '.') goto yy45;
+			goto yy18;
+		}
+	} else {
+		if (yych <= 'I') {
+			if (yych <= '9') goto yy46;
+			if (yych <= 'H') goto yy18;
+			goto yy48;
+		} else {
+			if (yych == 'N') goto yy49;
+			goto yy18;
+		}
+	}
+yy26:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy50;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy50;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy51;
+		goto yy18;
+	}
+yy27:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy53;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy53;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy54;
+		goto yy18;
+	}
+yy28:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy56;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy56;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy57;
+		goto yy18;
+	}
+yy29:
+	yych = *++YYCURSOR;
+	if (yych == '+') goto yy59;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy60;
+	goto yy18;
+yy30:
 	yych = *++YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy20;
+		goto yy31;
 	}
 	goto yy18;
-yy20:
+yy31:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
 	if (yybm[0+yych] & 128) {
-		goto yy20;
+		goto yy31;
 	}
 	if (yych <= '/') goto yy18;
-	if (yych >= ';') goto yy18;
+	if (yych <= ':') goto yy62;
+	goto yy18;
+yy33:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy34:
 	++YYCURSOR;
-#line 843 "ext/standard/var_unserializer.re"
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy34;
+	if (yych == ';') goto yy63;
+	goto yy18;
+yy36:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy37:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy37;
+	if (yych <= ':') goto yy65;
+	goto yy18;
+yy39:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy40:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy40;
+	if (yych <= ':') goto yy66;
+	goto yy18;
+yy42:
+	yych = *++YYCURSOR;
+	if (yych == ';') goto yy67;
+	goto yy18;
+yy43:
+	yych = *++YYCURSOR;
+	if (yych == '.') goto yy45;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy46;
+	goto yy18;
+yy44:
+	yych = *++YYCURSOR;
+	if (yych <= '/') {
+		if (yych != '.') goto yy18;
+	} else {
+		if (yych <= '9') goto yy46;
+		if (yych == 'I') goto yy48;
+		goto yy18;
+	}
+yy45:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy69;
+	goto yy18;
+yy46:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
+	yych = *YYCURSOR;
+	if (yych <= ':') {
+		if (yych <= '.') {
+			if (yych <= '-') goto yy18;
+			goto yy69;
+		} else {
+			if (yych <= '/') goto yy18;
+			if (yych <= '9') goto yy46;
+			goto yy18;
+		}
+	} else {
+		if (yych <= 'E') {
+			if (yych <= ';') goto yy71;
+			if (yych <= 'D') goto yy18;
+			goto yy73;
+		} else {
+			if (yych == 'e') goto yy73;
+			goto yy18;
+		}
+	}
+yy48:
+	yych = *++YYCURSOR;
+	if (yych == 'N') goto yy74;
+	goto yy18;
+yy49:
+	yych = *++YYCURSOR;
+	if (yych == 'A') goto yy75;
+	goto yy18;
+yy50:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy51:
+	++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy51;
+	if (yych == ';') goto yy76;
+	goto yy18;
+yy53:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy54:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy54;
+	if (yych <= ':') goto yy78;
+	goto yy18;
+yy56:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy57:
+	++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy57;
+	if (yych == ';') goto yy79;
+	goto yy18;
+yy59:
+	yych = *++YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych >= ':') goto yy18;
+yy60:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	yych = *YYCURSOR;
+	if (yych <= '/') goto yy18;
+	if (yych <= '9') goto yy60;
+	if (yych <= ':') goto yy81;
+	goto yy18;
+yy62:
+	yych = *++YYCURSOR;
+	if (yych == '"') goto yy82;
+	goto yy18;
+yy63:
+	++YYCURSOR;
+#line 619 "ext/standard/var_unserializer.re"
+	{
+	zend_long id;
+
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
+
+	id = parse_iv(start + 2) - 1;
+	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
+		return 0;
+	}
+
+	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
+		return 0;
+	}
+
+	if (Z_ISREF_P(rval_ref)) {
+		ZVAL_COPY(rval, rval_ref);
+	} else {
+		ZVAL_NEW_REF(rval_ref, rval_ref);
+		ZVAL_COPY(rval, rval_ref);
+	}
+
+	return 1;
+}
+#line 1021 "ext/standard/var_unserializer.c"
+yy65:
+	yych = *++YYCURSOR;
+	if (yych == '"') goto yy84;
+	goto yy18;
+yy66:
+	yych = *++YYCURSOR;
+	if (yych == '{') goto yy86;
+	goto yy18;
+yy67:
+	++YYCURSOR;
+#line 674 "ext/standard/var_unserializer.re"
+	{
+	*p = YYCURSOR;
+	ZVAL_BOOL(rval, parse_iv(start + 2));
+	return 1;
+}
+#line 1038 "ext/standard/var_unserializer.c"
+yy69:
+	++YYCURSOR;
+	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
+	yych = *YYCURSOR;
+	if (yych <= ';') {
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy69;
+		if (yych <= ':') goto yy18;
+	} else {
+		if (yych <= 'E') {
+			if (yych <= 'D') goto yy18;
+			goto yy73;
+		} else {
+			if (yych == 'e') goto yy73;
+			goto yy18;
+		}
+	}
+yy71:
+	++YYCURSOR;
+#line 722 "ext/standard/var_unserializer.re"
+	{
+#if SIZEOF_ZEND_LONG == 4
+use_double:
+#endif
+	*p = YYCURSOR;
+	ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
+	return 1;
+}
+#line 1067 "ext/standard/var_unserializer.c"
+yy73:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy88;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy88;
+		if (yych <= '/') goto yy18;
+		if (yych <= '9') goto yy89;
+		goto yy18;
+	}
+yy74:
+	yych = *++YYCURSOR;
+	if (yych == 'F') goto yy91;
+	goto yy18;
+yy75:
+	yych = *++YYCURSOR;
+	if (yych == 'N') goto yy91;
+	goto yy18;
+yy76:
+	++YYCURSOR;
+#line 680 "ext/standard/var_unserializer.re"
+	{
+#if SIZEOF_ZEND_LONG == 4
+	int digits = YYCURSOR - start - 3;
+
+	if (start[2] == '-' || start[2] == '+') {
+		digits--;
+	}
+
+	/* Use double for large zend_long values that were serialized on a 64-bit system */
+	if (digits >= MAX_LENGTH_OF_LONG - 1) {
+		if (digits == MAX_LENGTH_OF_LONG - 1) {
+			int cmp = strncmp((char*)YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
+
+			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
+				goto use_double;
+			}
+		} else {
+			goto use_double;
+		}
+	}
+#endif
+	*p = YYCURSOR;
+	ZVAL_LONG(rval, parse_iv(start + 2));
+	return 1;
+}
+#line 1115 "ext/standard/var_unserializer.c"
+yy78:
+	yych = *++YYCURSOR;
+	if (yych == '"') goto yy92;
+	goto yy18;
+yy79:
+	++YYCURSOR;
+#line 644 "ext/standard/var_unserializer.re"
+	{
+	zend_long id;
+
+ 	*p = YYCURSOR;
+	if (!var_hash) return 0;
+
+	id = parse_iv(start + 2) - 1;
+	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
+		return 0;
+	}
+
+	if (rval_ref == rval) {
+		return 0;
+	}
+
+	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
+		return 0;
+	}
+
+	ZVAL_COPY(rval, rval_ref);
+
+	return 1;
+}
+#line 1146 "ext/standard/var_unserializer.c"
+yy81:
+	yych = *++YYCURSOR;
+	if (yych == '"') goto yy94;
+	goto yy18;
+yy82:
+	++YYCURSOR;
+#line 832 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	zend_long elements;
@@ -913,109 +1301,10 @@ yy20:
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 917 "ext/standard/var_unserializer.c"
-yy25:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy26;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy27;
-		goto yy18;
-	}
-yy26:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy27:
+#line 1305 "ext/standard/var_unserializer.c"
+yy84:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy27;
-	if (yych >= ';') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
-	++YYCURSOR;
-#line 832 "ext/standard/var_unserializer.re"
-	{
-	zend_long elements;
-    if (!var_hash) return 0;
-
-	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
-	if (elements < 0 || elements >= HT_MAX_SIZE) {
-		return 0;
-	}
-	return object_common2(UNSERIALIZE_PASSTHRU, elements);
-}
-#line 953 "ext/standard/var_unserializer.c"
-yy32:
-	yych = *++YYCURSOR;
-	if (yych == '+') goto yy33;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy34;
-	goto yy18;
-yy33:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy34:
-	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy34;
-	if (yych >= ';') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != '{') goto yy18;
-	++YYCURSOR;
-#line 808 "ext/standard/var_unserializer.re"
-	{
-	zend_long elements = parse_iv(start + 2);
-	/* use iv() not uiv() in order to check data range */
-	*p = YYCURSOR;
-    if (!var_hash) return 0;
-
-	if (elements < 0 || elements >= HT_MAX_SIZE) {
-		return 0;
-	}
-
-	array_init_size(rval, elements);
-	if (elements) {
-		/* we can't convert from packed to hash during unserialization, because
-		   reference to some zvals might be keept in var_hash (to support references) */
-		zend_hash_real_init(Z_ARRVAL_P(rval), 0);
-	}
-
-	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) {
-		return 0;
-	}
-
-	return finish_nested_data(UNSERIALIZE_PASSTHRU);
-}
-#line 998 "ext/standard/var_unserializer.c"
-yy39:
-	yych = *++YYCURSOR;
-	if (yych == '+') goto yy40;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy41;
-	goto yy18;
-yy40:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy41:
-	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy41;
-	if (yych >= ';') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
-	++YYCURSOR;
-#line 774 "ext/standard/var_unserializer.re"
+#line 763 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	zend_string *str;
@@ -1049,28 +1338,73 @@ yy41:
 	ZVAL_STR(rval, str);
 	return 1;
 }
-#line 1053 "ext/standard/var_unserializer.c"
-yy46:
-	yych = *++YYCURSOR;
-	if (yych == '+') goto yy47;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy48;
-	goto yy18;
-yy47:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy48:
+#line 1342 "ext/standard/var_unserializer.c"
+yy86:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+#line 797 "ext/standard/var_unserializer.re"
+	{
+	zend_long elements = parse_iv(start + 2);
+	/* use iv() not uiv() in order to check data range */
+	*p = YYCURSOR;
+    if (!var_hash) return 0;
+
+	if (elements < 0 || elements >= HT_MAX_SIZE) {
+		return 0;
+	}
+
+	array_init_size(rval, elements);
+	if (elements) {
+		/* we can't convert from packed to hash during unserialization, because
+		   reference to some zvals might be keept in var_hash (to support references) */
+		zend_hash_real_init(Z_ARRVAL_P(rval), 0);
+	}
+
+	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) {
+		return 0;
+	}
+
+	return finish_nested_data(UNSERIALIZE_PASSTHRU);
+}
+#line 1369 "ext/standard/var_unserializer.c"
+yy88:
+	yych = *++YYCURSOR;
+	if (yych <= ',') {
+		if (yych == '+') goto yy96;
+		goto yy18;
+	} else {
+		if (yych <= '-') goto yy96;
+		if (yych <= '/') goto yy18;
+		if (yych >= ':') goto yy18;
+	}
+yy89:
+	++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy48;
-	if (yych >= ';') goto yy18;
+	if (yych <= '9') goto yy89;
+	if (yych == ';') goto yy71;
+	goto yy18;
+yy91:
 	yych = *++YYCURSOR;
-	if (yych != '"') goto yy18;
+	if (yych == ';') goto yy97;
+	goto yy18;
+yy92:
 	++YYCURSOR;
-#line 742 "ext/standard/var_unserializer.re"
+#line 821 "ext/standard/var_unserializer.re"
+	{
+	zend_long elements;
+    if (!var_hash) return 0;
+
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
+	if (elements < 0 || elements >= HT_MAX_SIZE) {
+		return 0;
+	}
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
+}
+#line 1405 "ext/standard/var_unserializer.c"
+yy94:
+	++YYCURSOR;
+#line 731 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -1102,163 +1436,15 @@ yy48:
 	ZVAL_STRINGL(rval, str, len);
 	return 1;
 }
-#line 1106 "ext/standard/var_unserializer.c"
-yy53:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych <= ',') {
-			if (yych == '+') goto yy57;
-			goto yy18;
-		} else {
-			if (yych <= '-') goto yy55;
-			if (yych <= '.') goto yy60;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'I') {
-			if (yych <= '9') goto yy58;
-			if (yych <= 'H') goto yy18;
-			goto yy56;
-		} else {
-			if (yych != 'N') goto yy18;
-		}
-	}
-	yych = *++YYCURSOR;
-	if (yych == 'A') goto yy76;
-	goto yy18;
-yy55:
-	yych = *++YYCURSOR;
-	if (yych <= '/') {
-		if (yych == '.') goto yy60;
-		goto yy18;
-	} else {
-		if (yych <= '9') goto yy58;
-		if (yych != 'I') goto yy18;
-	}
-yy56:
-	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy72;
-	goto yy18;
-yy57:
-	yych = *++YYCURSOR;
-	if (yych == '.') goto yy60;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy58:
-	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
-	yych = *YYCURSOR;
-	if (yych <= ':') {
-		if (yych <= '.') {
-			if (yych <= '-') goto yy18;
-			goto yy70;
-		} else {
-			if (yych <= '/') goto yy18;
-			if (yych <= '9') goto yy58;
-			goto yy18;
-		}
-	} else {
-		if (yych <= 'E') {
-			if (yych <= ';') goto yy63;
-			if (yych <= 'D') goto yy18;
-			goto yy65;
-		} else {
-			if (yych == 'e') goto yy65;
-			goto yy18;
-		}
-	}
-yy60:
+#line 1440 "ext/standard/var_unserializer.c"
+yy96:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy61:
-	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
-	yych = *YYCURSOR;
-	if (yych <= ';') {
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy61;
-		if (yych <= ':') goto yy18;
-	} else {
-		if (yych <= 'E') {
-			if (yych <= 'D') goto yy18;
-			goto yy65;
-		} else {
-			if (yych == 'e') goto yy65;
-			goto yy18;
-		}
-	}
-yy63:
-	++YYCURSOR;
-#line 733 "ext/standard/var_unserializer.re"
-	{
-#if SIZEOF_ZEND_LONG == 4
-use_double:
-#endif
-	*p = YYCURSOR;
-	ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
-	return 1;
-}
-#line 1203 "ext/standard/var_unserializer.c"
-yy65:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy66;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy67;
-		goto yy18;
-	}
-yy66:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych == '+') goto yy69;
-		goto yy18;
-	} else {
-		if (yych <= '-') goto yy69;
-		if (yych <= '/') goto yy18;
-		if (yych >= ':') goto yy18;
-	}
-yy67:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy67;
-	if (yych == ';') goto yy63;
+	if (yych <= '9') goto yy89;
 	goto yy18;
-yy69:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy67;
-	goto yy18;
-yy70:
+yy97:
 	++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
-	yych = *YYCURSOR;
-	if (yych <= ';') {
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy70;
-		if (yych <= ':') goto yy18;
-		goto yy63;
-	} else {
-		if (yych <= 'E') {
-			if (yych <= 'D') goto yy18;
-			goto yy65;
-		} else {
-			if (yych == 'e') goto yy65;
-			goto yy18;
-		}
-	}
-yy72:
-	yych = *++YYCURSOR;
-	if (yych != 'F') goto yy18;
-yy73:
-	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-#line 717 "ext/standard/var_unserializer.re"
+#line 706 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 
@@ -1274,182 +1460,9 @@ yy73:
 
 	return 1;
 }
-#line 1278 "ext/standard/var_unserializer.c"
-yy76:
-	yych = *++YYCURSOR;
-	if (yych == 'N') goto yy73;
-	goto yy18;
-yy77:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy78;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy79;
-		goto yy18;
-	}
-yy78:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy79:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy79;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-#line 691 "ext/standard/var_unserializer.re"
-	{
-#if SIZEOF_ZEND_LONG == 4
-	int digits = YYCURSOR - start - 3;
-
-	if (start[2] == '-' || start[2] == '+') {
-		digits--;
-	}
-
-	/* Use double for large zend_long values that were serialized on a 64-bit system */
-	if (digits >= MAX_LENGTH_OF_LONG - 1) {
-		if (digits == MAX_LENGTH_OF_LONG - 1) {
-			int cmp = strncmp((char*)YYCURSOR - MAX_LENGTH_OF_LONG, long_min_digits, MAX_LENGTH_OF_LONG - 1);
-
-			if (!(cmp < 0 || (cmp == 0 && start[2] == '-'))) {
-				goto use_double;
-			}
-		} else {
-			goto use_double;
-		}
-	}
-#endif
-	*p = YYCURSOR;
-	ZVAL_LONG(rval, parse_iv(start + 2));
-	return 1;
+#line 1464 "ext/standard/var_unserializer.c"
 }
-#line 1331 "ext/standard/var_unserializer.c"
-yy83:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= '2') goto yy18;
-	yych = *++YYCURSOR;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-#line 685 "ext/standard/var_unserializer.re"
-	{
-	*p = YYCURSOR;
-	ZVAL_BOOL(rval, parse_iv(start + 2));
-	return 1;
-}
-#line 1345 "ext/standard/var_unserializer.c"
-yy87:
-	++YYCURSOR;
-#line 679 "ext/standard/var_unserializer.re"
-	{
-	*p = YYCURSOR;
-	ZVAL_NULL(rval);
-	return 1;
-}
-#line 1354 "ext/standard/var_unserializer.c"
-yy89:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy90;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy91;
-		goto yy18;
-	}
-yy90:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy91:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy91;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-#line 654 "ext/standard/var_unserializer.re"
-	{
-	zend_long id;
-
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
-
-	id = parse_iv(start + 2) - 1;
-	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
-		return 0;
-	}
-
-	if (rval_ref == rval) {
-		return 0;
-	}
-
-	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
-		ZVAL_UNDEF(rval);
-		return 1;
-	}
-
-	ZVAL_COPY(rval, rval_ref);
-
-	return 1;
-}
-#line 1402 "ext/standard/var_unserializer.c"
-yy95:
-	yych = *++YYCURSOR;
-	if (yych <= ',') {
-		if (yych != '+') goto yy18;
-	} else {
-		if (yych <= '-') goto yy96;
-		if (yych <= '/') goto yy18;
-		if (yych <= '9') goto yy97;
-		goto yy18;
-	}
-yy96:
-	yych = *++YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych >= ':') goto yy18;
-yy97:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	if (yych <= '/') goto yy18;
-	if (yych <= '9') goto yy97;
-	if (yych != ';') goto yy18;
-	++YYCURSOR;
-#line 628 "ext/standard/var_unserializer.re"
-	{
-	zend_long id;
-
- 	*p = YYCURSOR;
-	if (!var_hash) return 0;
-
-	id = parse_iv(start + 2) - 1;
-	if (id == -1 || (rval_ref = var_access(var_hash, id)) == NULL) {
-		return 0;
-	}
-
-	zval_ptr_dtor(rval);
-	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
-		ZVAL_UNDEF(rval);
-		return 1;
-	}
-	if (Z_ISREF_P(rval_ref)) {
-		ZVAL_COPY(rval, rval_ref);
-	} else {
-		ZVAL_NEW_REF(rval_ref, rval_ref);
-		ZVAL_COPY(rval, rval_ref);
-	}
-
-	return 1;
-}
-#line 1451 "ext/standard/var_unserializer.c"
-}
-#line 1003 "ext/standard/var_unserializer.re"
+#line 992 "ext/standard/var_unserializer.re"
 
 
 	return 0;
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index dd9fe4915b6..d9069af660e 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -454,16 +454,7 @@ string_key:
 			return 0;
 		}
 
-		if (UNEXPECTED(Z_ISUNDEF_P(data))) {
-			if (Z_TYPE(key) == IS_LONG) {
-				zend_hash_index_del(ht, Z_LVAL(key));
-			} else {
-				zend_hash_del_ind(ht, Z_STR(key));
-			}
-		} else {
-			var_push_dtor(var_hash, data);
-		}
-
+		var_push_dtor(var_hash, data);
 		zval_dtor(&key);
 
 		if (elements && *(*p-1) != ';' && *(*p-1) != '}') {
@@ -636,11 +627,10 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 		return 0;
 	}
 
-	zval_ptr_dtor(rval);
 	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
-		ZVAL_UNDEF(rval);
-		return 1;
+		return 0;
 	}
+
 	if (Z_ISREF_P(rval_ref)) {
 		ZVAL_COPY(rval, rval_ref);
 	} else {
@@ -667,8 +657,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 	}
 
 	if (Z_ISUNDEF_P(rval_ref) || (Z_ISREF_P(rval_ref) && Z_ISUNDEF_P(Z_REFVAL_P(rval_ref)))) {
-		ZVAL_UNDEF(rval);
-		return 1;
+		return 0;
 	}
 
 	ZVAL_COPY(rval, rval_ref);