Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Fix #78833: Integer overflow in pack causes out-of-bound access

Author: cmb69

NEWS

@@ -27,6 +27,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #77638 (var_export'ing certain class instances segfaults). (cmb)
   . Fixed bug #78840 (imploding $GLOBALS crashes). (cmb)
+  . Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
+    (cmb)
 
 28 Nov 2019, PHP 7.4.0
 

ext/standard/pack.c

@@ -347,10 +347,13 @@ PHP_FUNCTION(pack)
 				if (arg < 0) {
 					arg = num_args - currentarg;
 				}
-
+				if (currentarg > INT_MAX - arg) {
+					goto too_few_args;
+				}
 				currentarg += arg;
 
 				if (currentarg > num_args) {
+too_few_args:
 					efree(formatcodes);
 					efree(formatargs);
 					php_error_docref(NULL, E_WARNING, "Type %c: too few arguments", code);

ext/standard/tests/strings/bug78833.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #78833 (Integer overflow in pack causes out-of-bound access)
+--FILE--
+<?php
+var_dump(pack("E2E2147483647H*", 0x0, 0x0, 0x0));
+?>
+--EXPECTF--
+Warning: pack(): Type E: too few arguments in %s on line %d
+bool(false)