unserialize: Deprecate the 'S' tag

Support for this was added in 8f5310a for
forward-compatibility with PHP 6. There should not be any data that is
legitimately using this format and removing it simplifies the unserializer as a
security-sensitive piece of code.

Author: TimWolla

ext/standard/tests/serialize/unserialize_uppercase_s.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Test unserialize() with the 'S' format emits a deprecation.
+--FILE--
+<?php
+
+var_dump(unserialize('S:1:"e";'));
+var_dump(unserialize('S:1:"\65";'));
+
+?>
+--EXPECTF--
+Deprecated: unserialize(): Unserializing the 'S' format is deprecated in %s on line %d
+string(1) "e"
+
+Deprecated: unserialize(): Unserializing the 'S' format is deprecated in %s on line %d
+string(1) "e"

ext/standard/var_unserializer.re

@@ -1090,6 +1090,9 @@ use_double:
 	*p = YYCURSOR;
 
 	ZVAL_STR(rval, str);
+
+	php_error_docref(NULL, E_DEPRECATED, "Unserializing the 'S' format is deprecated");
+
 	return 1;
 }