Fix GH-18976: pack with h or H format string overflow.

adding with its own remainder, INT_MAX overflows here (negative values are
discarded).

Author: devnexen

ext/standard/pack.c

@@ -388,7 +388,7 @@ PHP_FUNCTION(pack)
 		switch ((int) code) {
 			case 'h':
 			case 'H':
-				INC_OUTPUTPOS((arg + (arg % 2)) / 2,1)	/* 4 bit per arg */
+				INC_OUTPUTPOS((arg / 2) + (arg % 2),1)	/* 4 bit per arg */
 				break;
 
 			case 'a':

ext/standard/tests/strings/gh18976.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-18976 (pack overflow wit h/H format)
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+pack('h2147483647', 1);
+pack('H2147483647', 1);
+?>
+--EXPECTF--
+
+Warning: pack(): Type h: not enough characters in string in %s on line %d
+
+Warning: pack(): Type H: not enough characters in string in %s on line %d