Add test for bug #69522

diff --git a/ext/standard/pack.c b/ext/standard/pack.c
index c1c2c7a02c1de4d610f68ba23b680e7cf774bf35..20c7bf04628fdcb78f4772579e215bac4c8751af 100644 (file)
--- a/ext/standard/pack.c
+++ b/ext/standard/pack.c
@@ -642,6 +642,12 @@ PHP_FUNCTION(unpack)
                                break;
                }
 
+               if (size != 0 && size != -1 && size < 0) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Type %c: integer overflow", type);
+                       zval_dtor(return_value);
+                       RETURN_FALSE;
+               }
+
                /* Do actual unpacking */
                for (i = 0; i != arg; i++ ) {
                        /* Space for name + number, safe as namelen is ensured <= 200 */

diff --git a/ext/standard/tests/strings/bug69522.phpt b/ext/standard/tests/strings/bug69522.phpt
new file mode 100644 (file)
index 0000000..fc86d40
--- /dev/null
+++ b/ext/standard/tests/strings/bug69522.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #69522 (heap buffer overflow in unpack())
+--FILE--
+<?php
+$a = pack("AAAAAAAAAAAA", 1,2,3,4,5,6,7,8,9,10,11,12);
+$b = unpack('h2147483648', $a);
+?>
+===DONE===
+--EXPECTF--
+Warning: unpack(): Type h: integer overflow in %s on line %d
+===DONE===