Fixed bug #75075 (unpack with X* causes infinity loop)

diff --git a/NEWS b/NEWS
index 0723d9923179cba7cc7665618ba6abac2775dfd3..d901e3db9c269b571723782c7d15998dc1b8c411 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -53,6 +53,7 @@ PHP                                                                        NEWS
   . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
 
 - Standard:
+  . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence)
   . Fixed bug #74103 (heap-use-after-free when unserializing invalid array
     size). (Nikita)
   . Fixed bug #75054 (A Denial of Service Vulnerability was found when

diff --git a/ext/standard/pack.c b/ext/standard/pack.c
index d15154df31deeaa6d1efc490e9ca593ea8817803..f6748d42a279898f00c3ffe628cebd51af0b0901 100644 (file)
--- a/ext/standard/pack.c
+++ b/ext/standard/pack.c
@@ -782,6 +782,10 @@ PHP_FUNCTION(unpack)
                        /* Never use any input */
                        case 'X':
                                size = -1;
+                               if (arg < 0) {
+                                       php_error_docref(NULL, E_WARNING, "Type %c: '*' ignored", type);
+                                       arg = 1;
+                               }
                                break;
 
                        case '@':

diff --git a/ext/standard/tests/strings/bug75075.phpt b/ext/standard/tests/strings/bug75075.phpt
new file mode 100644 (file)
index 0000000..232de50
--- /dev/null
+++ b/ext/standard/tests/strings/bug75075.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #75075 (unpack with X* causes infinity loop)
+--FILE--
+<?php
+var_dump(unpack("X*", ""));
+?>
+--EXPECTF--
+Warning: unpack(): Type X: '*' ignored in %sbug75075.php on line %d
+array(0) {
+}