[pull] master from laruence:master - #16

yaf_dispatcher_instance() dereferenced YAF_G(app) unconditionally, so
calling Yaf_Dispatcher::getInstance() before any Yaf_Application was
created crashed with SIGSEGV.  Guard on Z_TYPE(YAF_G(app)) and throw a
startup error (same convention as the "Only one application" error)
instead.

A zero limit underflows the dispatch-loop counter (--nesting from 0)
and spins forever; storing 0 in the loader flags slot leaves the same
trap armed. Fall back to YAF_DEFAULT_FORWARD_LIMIT instead so the
counter is always positive.

ZEND_HASH_FOREACH_STR_KEY_VAL yields a NULL key for integer-indexed
entries; snprintf then dereferenced it while composing the "yaf.*"
ini name. Skip numeric keys since no ini entry can be named after
them anyway.

When forward() is called in a controller's init(), the dispatcher used
to tail-recurse into itself for every hop, bypassing the forward_limit
counter and blowing the stack with an uncaught fatal error on a
forwarding loop. Return to the dispatch loop instead, where each hop is
counted and capped like any other forward.

yaf_route_instance() fell through to "return 1" when the configured
type matched none of the built-in routes, handing the caller a zval
that was never written (stack garbage). The default-route path then
OBJ_RELEASE'd that garbage on failure. Return 0 for unknown types, and
initialize the caller's zval to UNDEF so the failure path is safe.

The supervar is looked up in \$_GET, which may hold an array (e.g.
?r[a]=b). Reading Z_STRVAL/Z_STRLEN of a non-string zval crashed the
router; require IS_STRING and fail the route otherwise.

A cached pointer into $_SESSION dangles once userland unsets the
variable or the session is destroyed, while holding a reference
silently detaches the session object from the live array and breaks
copy-on-write. Instead resolve the array straight from the symbol
table on every access and fail gracefully when it is gone.

yaf_loader_load_mvc() handed the bare class-name length down, but
yaf_loader_import() uses the length to seed the zend_string it
registers in EG(included_files), truncating the key. Recompute the
final path length and assert the caller always passes the full length.