Invalid characters passed for attempted conversion, these have been ignored in _color_unpack()

The actual code used from the function is the following one.

  if (strlen($hex) == 4) {
    $hex = $hex[1] . $hex[1] . $hex[2] . $hex[2] . $hex[3] . $hex[3];
  }
  $c = hexdec($hex);

Unconditionally removing the leading # is not necessary as, at least in one case, it is already removed. I would rather change the code as follows.

   if (strlen($hex) == 4) {
     $hex = $hex[1] . $hex[1] . $hex[2] . $hex[2] . $hex[3] . $hex[3];
   }
   else { 
     $hex = ltrim($hex, '#');
   }

The Color module doesn't seem to validate the value used for $hex, which could also contain '99#ff'. In this case, filtering out any character that isn't acceptable as hexadecimal digit would be better.

function _color_unpack($hex, $normalize = FALSE) {
  $hex = preg_replace("/[^0-9a-fA-F]/", "", $hex);
  if (strlen($hex) == 4) {
    $hex = $hex[1] . $hex[1] . $hex[2] . $hex[2] . $hex[3] . $hex[3];
  }
  $c = hexdec($hex);
  for ($i = 16; $i >= 0; $i -= 8) {
    $out[] = ($c >> $i & 0xff) / ($normalize ? 255 : 1);
  }
  return $out;
}

If it's sure that $hex will always contain a string matching '/^#([a-f0-9]{3}){1,2}$/iD', then the function code should be the following one.

function _color_unpack($hex, $normalize = FALSE) {
  if (strlen($hex) == 4) {
    $hex = $hex[1] . $hex[1] . $hex[2] . $hex[2] . $hex[3] . $hex[3];
  }
  else {
    $hex = substr($hex, 1);
  }
  $c = hexdec($hex);
  for ($i = 16; $i >= 0; $i -= 8) {
    $out[] = ($c >> $i & 0xff) / ($normalize ? 255 : 1);
  }
  return $out;
}

This was addressed in D8 in #3086374: Make Drupal 8 & 9 compatible with PHP 7.4

As far as I can see there's no discussion of this code specifically in the issue, but between #29 and #30 the fix went from:

   if (strlen($hex) == 4) {
     $hex = $hex[1] . $hex[1] . $hex[2] . $hex[2] . $hex[3] . $hex[3];
   }
+  else {
+    $hex = str_replace('#', '', $hex);
+  }

...to:

-  if (strlen($hex) == 4) {
-    $hex = $hex[1] . $hex[1] . $hex[2] . $hex[2] . $hex[3] . $hex[3];
+  $hex = substr($hex, 1);
+  if (strlen($hex) == 3) {
+    $hex = $hex[0] . $hex[0] . $hex[1] . $hex[1] . $hex[2] . $hex[2];

Leaving us with the code in D8 now:

function _color_unpack($hex, $normalize = FALSE) {                                 
  $hex = substr($hex, 1);                                                          
  if (strlen($hex) == 3) {                                                         
    $hex = $hex[0] . $hex[0] . $hex[1] . $hex[1] . $hex[2] . $hex[2];              
  }                                                                                
  $c = hexdec($hex); 

I don't find this code the most intuitive to read, but it makes sense given what @Taran2L mentioned in #6:

Color module does input validation allowing either #XXX or #YYYYYY only

We should be consistent with D8 wherever possible, so let's backport the same change.

As noted in other issues, I'm not sure this method is perfect, but if we compare the exceptions from the no-op patch in #3081386-49: [META] Fully support PHP 7.4 in Drupal 7 with those from the PHP 7.4 test for #8:

$ curl -s https://www.drupal.org/pift-ci-job/1601005 | grep -o 'exception: .* Line [0-9]* of .*:' | perl -pe 's#<.*?>##g' | sort | uniq -c | sort -rn | diff - <(curl -s https://www.drupal.org/pift-ci-job/1602413 | grep -o 'exception: .* Line [0-9]* of .*:' | perl -pe 's#<.*?>##g' | sort | uniq -c | sort -rn)
1c1
<  189257 exception: [Notice] Line 6656 of includes/common.inc:
---
>  189299 exception: [Notice] Line 6656 of includes/common.inc:
3d2
<    1132 exception: [Deprecated function] Line 740 of modules/color/color.module:

...that seems to confirm that the patch fixes the issue on line 740 of color.module:

https://git.drupalcode.org/project/drupal/-/blob/7.x/modules/color/color...

I'm not certain why the number of exceptions from element_children() also goes up, but we're addressing that in #3084935: element_children() and DrupalRequestSanitizer::stripDangerousValues() should not use integer keys as array and that Notice should go away once that issue's done.

As the change here is exactly the same as the one committed to D8, I'm confident enough to mark this RTBC and ready for final review.

Ready to be merged - let's get this in. Thanks all!

Another one done; thanks everyone!