cvs: php-src(PHP_4_4) / NEWS /ext/standard pack.c /ext/standard/tests/strings bug35817.phpt

iliaa Wed Dec 28 20:57:07 2005 EDT Added files: (Branch: PHP_4_4) /php-src/ext/standard/tests/strings bug35817.phpt Modified files: /php-src NEWS /php-src/ext/standard pack.c Log: MFH: Fixed bug #35817 (unpack() does not decode odd number of hexadecimal values) http://cvs.php.net/viewcvs.cgi/php-src/NEWS?r1=1.1247.2.920.2.103&r2=1.1247.2.920.2.104&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.1247.2.920.2.103 php-src/NEWS:1.1247.2.920.2.104 --- php-src/NEWS:1.1247.2.920.2.103 Mon Dec 26 14:48:57 2005 +++ php-src/NEWS Wed Dec 28 20:57:07 2005 @@ -3,6 +3,8 @@ ?? ??? 2005, Version 4.4.2 - Prevent header injection by limiting each header to a single line. (Ilia) - Fixed possible XSS inside error reporting functionality. (Ilia) +- Fixed bug #35817 (unpack() does not decode odd number of hexadecimal values). + (Ilia) - Fixed bug #35735 ($EGREP not defined in configure). (Jani) - Fixed bug #35655 (whitespace following end of heredoc is lost). (Ilia) - Fixed bug #35646 (%{mod_php_memory_usage}n is not reset after exit). http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/pack.c?r1=1.40.2.7.2.2&r2=1.40.2.7.2.3&diff_format=u Index: php-src/ext/standard/pack.c diff -u php-src/ext/standard/pack.c:1.40.2.7.2.2 php-src/ext/standard/pack.c:1.40.2.7.2.3 --- php-src/ext/standard/pack.c:1.40.2.7.2.2 Tue Jul 26 09:32:58 2005 +++ php-src/ext/standard/pack.c Wed Dec 28 20:57:07 2005 @@ -15,7 +15,7 @@ | Author: Chris Schneider <cschneid@relog.ch> | +----------------------------------------------------------------------+ */ -/* $Id: pack.c,v 1.40.2.7.2.2 2005/07/26 09:32:58 hyanantha Exp $ */ +/* $Id: pack.c,v 1.40.2.7.2.3 2005/12/28 20:57:07 iliaa Exp $ */ #include "php.h" @@ -246,7 +246,7 @@ switch ((int) code) { case 'h': case 'H': - INC_OUTPUTPOS((arg + 1) / 2,1) /* 4 bit per arg */ + INC_OUTPUTPOS((arg + (arg % 2)) / 2,1) /* 4 bit per arg */ break; case 'a': @@ -539,7 +539,7 @@ while (formatlen-- > 0) { char type = *(format++); char c; - int arg = 1; + int arg = 1, argb; char *name; int namelen; int size=0; @@ -564,6 +564,7 @@ /* Get of new value in array */ name = format; + argb = arg; while (formatlen > 0 && *format != '/') { formatlen--; @@ -593,7 +594,7 @@ case 'h': case 'H': - size = (arg > 0) ? arg / 2 : arg; + size = (arg > 0) ? (arg + (arg % 2)) / 2 : arg; arg = 1; break; @@ -692,6 +693,8 @@ len = size * 2; } + len -= argb % 2; + buf = emalloc(len + 1); for (ipos = opos = 0; opos < len; opos++) { http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/tests/strings/bug35817.phpt?view=markup&rev=1.1 Index: php-src/ext/standard/tests/strings/bug35817.phpt +++ php-src/ext/standard/tests/strings/bug35817.phpt