[Security] Fix PHP #75075 unpack with X* causes infinite loop

fredemmott · fredemmott · commit e33bffbb7878 · 2017-12-18T10:13:38.000-08:00
diff --git a/hphp/runtime/base/zend-pack.cpp b/hphp/runtime/base/zend-pack.cpp
@@ -595,6 +595,10 @@ Variant ZendPack::unpack(const String& fmt, const String& data) {
       /* Never use any input */
     case 'X':
       size = -1;
+      if (arg < 0) {
+        throw_invalid_argument("Type %c: '*' ignored", type);
+        arg = 1;
+      }
       break;
 
     case '@':
diff --git a/hphp/test/zend/good/ext/standard/tests/bug75075.php b/hphp/test/zend/good/ext/standard/tests/bug75075.php
@@ -0,0 +1,3 @@
+<?php
+var_dump(unpack("X*", ""));
+?>
diff --git a/hphp/test/zend/good/ext/standard/tests/bug75075.php.expectf b/hphp/test/zend/good/ext/standard/tests/bug75075.php.expectf
@@ -0,0 +1,3 @@
+Warning: Invalid argument: Type X: '*' ignored in %sbug75075.php on line %d
+array(0) {
+}
