com php-src: Fixed bug #75075 (unpack with X* causes infinity loop): NEWS ext/standard/pack.c ext/standard/tests/strings/bug75075.phpt

Commit: d8c80af71e9b43e9adec9e3f57f2732a0ac95d71 Author: Xinchen Hui <laruence@gmail.com> Tue, 15 Aug 2017 12:34:13 +0800 Parents: 2def85688db36b5e7a0b48cd2cdb9266b7a2f2b5 Branches: PHP-7.0 PHP-7.1 PHP-7.2 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d8c80af71e9b43e9adec9e3f57f2732a0ac95d71 Log: Fixed bug #75075 (unpack with X* causes infinity loop) Bugs: https://bugs.php.net/75075 Changed paths: M NEWS M ext/standard/pack.c A ext/standard/tests/strings/bug75075.phpt Diff: diff --git a/NEWS b/NEWS index 0723d99..d901e3d 100644 --- a/NEWS +++ b/NEWS @@ -53,6 +53,7 @@ PHP NEWS . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien) - Standard: + . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence) . Fixed bug #74103 (heap-use-after-free when unserializing invalid array size). (Nikita) . Fixed bug #75054 (A Denial of Service Vulnerability was found when diff --git a/ext/standard/pack.c b/ext/standard/pack.c index d15154d..f6748d4 100644 --- a/ext/standard/pack.c +++ b/ext/standard/pack.c @@ -782,6 +782,10 @@ PHP_FUNCTION(unpack) /* Never use any input */ case 'X': size = -1; + if (arg < 0) { + php_error_docref(NULL, E_WARNING, "Type %c: '*' ignored", type); + arg = 1; + } break; case '@': diff --git a/ext/standard/tests/strings/bug75075.phpt b/ext/standard/tests/strings/bug75075.phpt new file mode 100644 index 0000000..232de50 --- /dev/null +++ b/ext/standard/tests/strings/bug75075.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #75075 (unpack with X* causes infinity loop) +--FILE-- +<?php +var_dump(unpack("X*", "")); +?> +--EXPECTF-- +Warning: unpack(): Type X: '*' ignored in %sbug75075.php on line %d +array(0) { +}