Fixed bug #75075 (unpack with X* causes infinity loop)

Author: laruence

NEWS

@@ -53,6 +53,7 @@ PHP                                                                        NEWS
   . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
 
 - Standard:
+  . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence)
   . Fixed bug #74103 (heap-use-after-free when unserializing invalid array
     size). (Nikita)
   . Fixed bug #75054 (A Denial of Service Vulnerability was found when

ext/standard/pack.c

@@ -782,6 +782,10 @@ PHP_FUNCTION(unpack)
 			/* Never use any input */
 			case 'X':
 				size = -1;
+				if (arg < 0) {
+					php_error_docref(NULL, E_WARNING, "Type %c: '*' ignored", type);
+					arg = 1;
+				}
 				break;
 
 			case '@':

ext/standard/tests/strings/bug75075.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #75075 (unpack with X* causes infinity loop)
+--FILE--
+<?php
+var_dump(unpack("X*", ""));
+?>
+--EXPECTF--
+Warning: unpack(): Type X: '*' ignored in %sbug75075.php on line %d
+array(0) {
+}