archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.2'

Browse source 
* PHP-8.2:
  Fix undefined behaviour in unpack()
This commit is contained in:
Niels Dossche 2023-03-28 22:48:21 +02:00
commit f8ecb80e84
2 changed files with 20 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
ext/standard/pack.c
View file

@ -750,7 +750,16 @@ PHP_FUNCTION(unpack)
c = *format;
if (c >= '0' && c <= '9') {
repetitions = atoi(format);
errno = 0;
long tmp = strtol(format, NULL, 10);
/* There is not strtoi. We have to check the range ourselves.
* With 32-bit long the INT_{MIN,MAX} are useless because long == int, but with 64-bit they do limit us to 32-bit. */
if (errno || tmp < INT_MIN || tmp > INT_MAX) {
php_error_docref(NULL, E_WARNING, "Type %c: integer overflow", type);
zend_array_destroy(Z_ARR_P(return_value));
RETURN_FALSE;
}
repetitions = tmp;
while (formatlen > 0 && *format >= '0' && *format <= '9') {
format++;
@ -800,7 +809,7 @@ PHP_FUNCTION(unpack)
case 'h':
case 'H':
size = (repetitions > 0) ? (repetitions + (repetitions % 2)) / 2 : repetitions;
size = (repetitions > 0) ? ((unsigned int) repetitions + 1) / 2 : repetitions;
repetitions = 1;
break;
@ -865,12 +874,6 @@ PHP_FUNCTION(unpack)
RETURN_THROWS();
}
if (size != 0 && size != -1 && size < 0) {
php_error_docref(NULL, E_WARNING, "Type %c: integer overflow", type);
zend_array_destroy(Z_ARR_P(return_value));
RETURN_FALSE;
}
/* Do actual unpacking */
for (i = 0; i != repetitions; i++ ) {

9
ext/standard/tests/strings/gh10940.phpt Normal file
View file

@ -0,0 +1,9 @@
--TEST--
Test unpacking at the 32-bit integer limit
--FILE--
<?php
$a = pack("AAAAAAAAAAAA", 1,2,3,4,5,6,7,8,9,10,11,12);
unpack('h2147483647', $a);
?>
--EXPECTF--
Warning: unpack(): Type h: not enough input values, need 1073741824 values but only 12 were provided in %s on line %d