Description:
------------
ArrayIterator should not be changed while being sorted.
There is a check missing in unserialize method in spl_array.c .



Test script:
---------------
<?php
$it = new ArrayIterator(array_fill(0,10,'X'), 1 );

function badsort($a, $b) {
        $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
        return TRUE;
}

$it->uksort('badsort');

Expected result:
----------------
Warning: Modification of ArrayObject during sorting is prohibited in spl_array.php on line 5

Actual result:
--------------
$ USE_ZEND_ALLOC=0 valgrind /opt/php/5.5.14/bin/php spl_array.php
==23209== Memcheck, a memory error detector
==23209== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==23209== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==23209== Command: /opt/php/5.5.14/bin/php spl_array.php
==23209==
==23209== Invalid read of size 4
==23209==    at 0x8374BAD: php_array_user_key_compare (array.c:736)
==23209==    by 0x849C8BC: zend_qsort_r (zend_qsort.c:84)
==23209==    by 0x849C9BE: zend_qsort (zend_qsort.c:123)
==23209==    by 0x8496368: zend_hash_sort (zend_hash.c:1463)
==23209==    by 0x837906B: zif_uksort (array.c:796)
==23209==    by 0x8479E7C: zend_call_function (zend_execute_API.c:955)
==23209==    by 0x6506747: ???
==23209==  Address 0x716c05c is 4 bytes inside a block of size 36 free'd
==23209==    at 0x402750C: free (vg_replace_malloc.c:427)
==23209==    by 0x8494B1A: zend_hash_destroy (zend_hash.c:565)
==23209==    by 0x84866E0: _zval_dtor_func (zend_variables.c:45)
==23209==    by 0x8477F47: _zval_ptr_dtor (zend_variables.h:35)
==23209==    by 0x8357D33: zim_spl_Array_unserialize (spl_array.c:1781)
==23209==    by 0x852E1B1: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550)
==23209==    by 0x84F0935: execute_ex (zend_vm_execute.h:363)
==23209==    by 0x8479F14: zend_call_function (zend_execute_API.c:937)
==23209==    by 0x8374C11: php_array_user_key_compare (array.c:757)
==23209==    by 0x849C8BC: zend_qsort_r (zend_qsort.c:84)
==23209==    by 0x849C9BE: zend_qsort (zend_qsort.c:123)
==23209==    by 0x8496368: zend_hash_sort (zend_hash.c:1463)