com php-src: Fixed bug #68225 unpack and X format code: ext/standard/pack.c ext/standard/tests/strings/unpack_bug68225.phpt

Commit: e7a6c15b93ab35bb148fa2ab31e905bb9a3afb51 Author: Anatol Belski <ab@php.net> Fri, 28 Nov 2014 10:17:22 +0100 Parents: dcfe58773eed1f0948108c67f94eec2d512a5abf Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=e7a6c15b93ab35bb148fa2ab31e905bb9a3afb51 Log: Fixed bug #68225 unpack and X format code This is done by reverting some parts to the state of pre 7, whereby that means all the size_t potential isn't exhausted. This might be a subject of the subsequent fix, the functionality can be ensured with the supplied test. Bugs: https://bugs.php.net/68225 Changed paths: M ext/standard/pack.c A ext/standard/tests/strings/unpack_bug68225.phpt Diff: diff --git a/ext/standard/pack.c b/ext/standard/pack.c index 4af72c3..85709bc 100644 --- a/ext/standard/pack.c +++ b/ext/standard/pack.c @@ -560,7 +560,7 @@ PHP_FUNCTION(unpack) { char *format, *input; zend_string *formatarg, *inputarg; - size_t formatlen, inputpos, inputlen; + zend_long formatlen, inputpos, inputlen; int i; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "SS", &formatarg, @@ -717,7 +717,7 @@ PHP_FUNCTION(unpack) inputpos = 0; } - if ((size >=0 && (inputpos + size) <= inputlen) || (size < 0 && -size <= (inputlen - inputpos))) { + if ((inputpos + size) <= inputlen) { switch ((int) type) { case 'a': { /* a will not strip any trailing whitespace or null padding */ diff --git a/ext/standard/tests/strings/unpack_bug68225.phpt b/ext/standard/tests/strings/unpack_bug68225.phpt new file mode 100644 index 0000000..7f8cdd4 --- /dev/null +++ b/ext/standard/tests/strings/unpack_bug68225.phpt @@ -0,0 +1,39 @@ +--TEST-- +Bug #68225 unpack and X format code +--FILE-- +<?php + +$data = pack('VV', 1, 2); + +$result = unpack('Va/X' ,$data); +var_dump($result); + +$result = unpack('Va/X4' ,$data); +var_dump($result); + +$result = unpack('V1a/X4/V1b/V1c/X4/V1d', $data); +var_dump($result); + +?> +===DONE=== +--EXPECTF-- +array(1) { + ["a"]=> + int(1) +} +array(1) { + ["a"]=> + int(1) +} +array(4) { + ["a"]=> + int(1) + ["b"]=> + int(1) + ["c"]=> + int(2) + ["d"]=> + int(2) +} +===DONE=== +