Fix #75673: SplStack::unserialize() behavior

Even though `SplStack::unserialize()` is not supposed to be called on
an already constructed instance, it is probably better if the method
clears the stack before actually unserializing.

Author: cmb69

NEWS

@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.17
 
+- Spl:
+  . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb)
+
 19 Mar 2020, PHP 7.3.16
 
 - Core:

ext/spl/spl_dllist.c

@@ -1185,6 +1185,12 @@ SPL_METHOD(SplDoublyLinkedList, unserialize)
 		return;
 	}
 
+	while (intern->llist->count > 0) {
+		zval tmp;
+		spl_ptr_llist_pop(intern->llist, &tmp);
+		zval_ptr_dtor(&tmp);
+	}
+
 	s = p = (const unsigned char*)buf;
 	PHP_VAR_UNSERIALIZE_INIT(var_hash);
 

ext/spl/tests/bug75673.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #75673 (SplStack::unserialize() behavior)
+--FILE--
+<?php
+$stack = new SplStack();
+$stack->push("one");
+$stack->push("two");
+
+$serialized = $stack->serialize();
+var_dump($stack->count());
+$stack->unserialize($serialized);
+var_dump($stack->count());
+$stack->unserialize($serialized);
+var_dump($stack->count());
+?>
+--EXPECT--
+int(2)
+int(2)
+int(2)