diff options
| author | Xinchen Hui <laruence@gmail.com> | 2017-08-15 12:34:13 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2017-08-15 12:34:13 +0800 |
| commit | d8c80af71e9b43e9adec9e3f57f2732a0ac95d71 (patch) | |
| tree | 29002a3e15a283b3eaa2a65a164e51a6b95e3fa8 | |
| parent | 2def85688db36b5e7a0b48cd2cdb9266b7a2f2b5 (diff) | |
| download | php-git-d8c80af71e9b43e9adec9e3f57f2732a0ac95d71.tar.gz | |
Fixed bug #75075 (unpack with X* causes infinity loop)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/standard/pack.c | 4 | ||||
| -rw-r--r-- | ext/standard/tests/strings/bug75075.phpt | 10 |
3 files changed, 15 insertions, 0 deletions
@@ -53,6 +53,7 @@ PHP NEWS . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien) - Standard: + . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence) . Fixed bug #74103 (heap-use-after-free when unserializing invalid array size). (Nikita) . Fixed bug #75054 (A Denial of Service Vulnerability was found when diff --git a/ext/standard/pack.c b/ext/standard/pack.c index d15154df31..f6748d42a2 100644 --- a/ext/standard/pack.c +++ b/ext/standard/pack.c @@ -782,6 +782,10 @@ PHP_FUNCTION(unpack) /* Never use any input */ case 'X': size = -1; + if (arg < 0) { + php_error_docref(NULL, E_WARNING, "Type %c: '*' ignored", type); + arg = 1; + } break; case '@': diff --git a/ext/standard/tests/strings/bug75075.phpt b/ext/standard/tests/strings/bug75075.phpt new file mode 100644 index 0000000000..232de50622 --- /dev/null +++ b/ext/standard/tests/strings/bug75075.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #75075 (unpack with X* causes infinity loop) +--FILE-- +<?php +var_dump(unpack("X*", "")); +?> +--EXPECTF-- +Warning: unpack(): Type X: '*' ignored in %sbug75075.php on line %d +array(0) { +} |