Skip to content

Commit ea0937b

Browse files
committed
Merge branch 'PHP-8.3'
2 parents 4ffc971 + b975b6c commit ea0937b

File tree

2 files changed

+32
-0
lines changed

2 files changed

+32
-0
lines changed

ext/standard/pack.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -977,6 +977,13 @@ PHP_FUNCTION(unpack)
977977
zend_string *buf;
978978
zend_long ipos, opos;
979979

980+
981+
if (size > INT_MAX / 2) {
982+
zend_string_release(real_name);
983+
zend_argument_value_error(1, "repeater must be less than or equal to %d", INT_MAX / 2);
984+
RETURN_THROWS();
985+
}
986+
980987
/* If size was given take minimum of len and size */
981988
if (size >= 0 && len > (size * 2)) {
982989
len = size * 2;
Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--TEST--
2+
GH-15613 overflow on hex strings repeater value
3+
--SKIPIF--
4+
<?php
5+
if (PHP_INT_SIZE != 8) die("skip this test is for 64 bit platform only");
6+
?>
7+
--INI--
8+
memory_limit=-1
9+
--FILE--
10+
<?php
11+
try {
12+
unpack('h2147483647', str_repeat('X', 2**31 + 10));
13+
} catch (\ValueError $e) {
14+
echo $e->getMessage() . PHP_EOL;
15+
}
16+
17+
try {
18+
unpack('H2147483647', str_repeat('X', 2**31 + 10));
19+
} catch (\ValueError $e) {
20+
echo $e->getMessage();
21+
}
22+
?>
23+
--EXPECTF--
24+
unpack(): Argument #1 ($format) repeater must be less than or equal to %d
25+
unpack(): Argument #1 ($format) repeater must be less than or equal to %d

0 commit comments

Comments
 (0)