Fix pack() function reading string beyond the end

diff --git a/ext/standard/pack.c b/ext/standard/pack.c
index 8e3a32d1154028db1adfa7d5c81a6c2ba8f8c63f..7afe52a6af6244ec5a953baa9917cc40567a2e40 100644 (file)
--- a/ext/standard/pack.c
+++ b/ext/standard/pack.c
@@ -302,6 +302,10 @@ PHP_FUNCTION(pack)
                                convert_to_string_ex(val);
                                v = (*val)->value.str.val;
                                outputpos--;
+                               if(arg > (*val)->value.str.len) {
+                                       php_error(E_WARNING,"pack type %c: not enough characters in string",code);
+                                       arg = (*val)->value.str.len;
+                               }
 
                                while (arg-- > 0) {
                                        char n = *(v++);