CVE-2016-5770: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2016-08-07T10:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/spl/spl_directory.c
Commit date: 2016-06-15 21:58:26 -0700
Commit message: Fix bug #72262 - do not overflow int

Diff: diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index e20a80ae77c..7718fe42d7f 100644
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -77,13 +77,13 @@ static void spl_filesystem_object_free_storage(void *object TSRMLS_DC) /* {{{ */
 	spl_filesystem_object *intern = (spl_filesystem_object*)object;
 
 	if (intern->oth_handler && intern->oth_handler->dtor) {
 		intern->oth_handler->dtor(intern TSRMLS_CC);
 	}
-	
+
 	zend_object_std_dtor(&intern->std TSRMLS_CC);
-	
+
 	if (intern->_path) {
 		efree(intern->_path);
 	}
 	if (intern->file_name) {
 		efree(intern->file_name);
@@ -96,11 +96,11 @@ static void spl_filesystem_object_free_storage(void *object TSRMLS_DC) /* {{{ */
 			php_stream_close(intern->u.dir.dirp);
 			intern->u.dir.dirp = NULL;
 		}
 		if (intern->u.dir.sub_path) {
 			efree(intern->u.dir.sub_path);
-		}		
+		}
 		break;
 	case SPL_FS_FILE:
 		if (intern->u.file.stream) {
 			if (intern->u.file.zcontext) {
 /*				zend_list_delref(Z_RESVAL_P(intern->zcontext));*/
@@ -132,17 +132,17 @@ static void spl_filesystem_object_free_storage(void *object TSRMLS_DC) /* {{{ */
 	}
 	efree(object);
 } /* }}} */
 
 /* {{{ spl_ce_dir_object_new */
-/* creates the object by 
-   - allocating memory 
+/* creates the object by
+   - allocating memory
    - initializing the object members
    - storing the object
    - setting it's handlers
 
-   called from 
+   called from
    - clone
    - new
  */
 static zend_object_value spl_filesystem_object_new_ex(zend_class_entry *class_type, spl_filesystem_object **obj TSRMLS_DC)
 {
@@ -311,11 +311,11 @@ static int spl_filesystem_file_open(spl_filesystem_object *intern, int use_inclu
 	intern->u.file.open_mode = estrndup(intern->u.file.open_mode, intern->u.file.open_mode_len);
 
 	/* avoid reference counting in debug mode, thus do it manually */
 	ZVAL_RESOURCE(&intern->u.file.zresource, php_stream_get_resource_id(intern->u.file.stream));
 	Z_SET_REFCOUNT(intern->u.file.zresource, 1);
-	
+
 	intern->u.file.delimiter = ',';
 	intern->u.file.enclosure = '"';
 	intern->u.file.escape = '\\';
 
 	zend_hash_find(&intern->std.ce->function_table, "getcurrentline", sizeof("getcurrentline"), (void **) &intern->u.file.func_getCurr);
@@ -323,11 +323,11 @@ static int spl_filesystem_file_open(spl_filesystem_object *intern, int use_inclu
 	return SUCCESS;
 } /* }}} */
 
 /* {{{ spl_filesystem_object_clone */
 /* Local zend_object_value creation (on stack)
-   Load the 'other' object 
+   Load the 'other' object
    Create a new empty object (See spl_filesystem_object_new_ex)
    Open the directory
    Clone other members (properties)
  */
 static zend_object_value spl_filesystem_object_clone(zval *zobject TSRMLS_DC)
@@ -368,11 +368,11 @@ static zend_object_value spl_filesystem_object_clone(zval *zobject TSRMLS_DC)
 		break;
 	case SPL_FS_FILE:
 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "An object of class %s cannot be cloned", old_object->ce->name);
 		break;
 	}
-	
+
 	intern->file_class = source->file_class;
 	intern->info_class = source->info_class;
 	intern->oth = source->oth;
 	intern->oth_handler = source->oth_handler;
 
@@ -387,11 +387,11 @@ static zend_object_value spl_filesystem_object_clone(zval *zobject TSRMLS_DC)
 /* }}} */
 
 void spl_filesystem_info_set_filename(spl_filesystem_object *intern, char *path, int len, int use_copy TSRMLS_DC) /* {{{ */
 {
 	char *p1, *p2;
-	
+
 	if (intern->file_name) {
 		efree(intern->file_name);
 	}
 
 	intern->file_name = use_copy ? estrndup(path, len) : path;
@@ -411,11 +411,11 @@ void spl_filesystem_info_set_filename(spl_filesystem_object *intern, char *path,
 	if (p1 || p2) {
 		intern->_path_len = (p1 > p2 ? p1 : p2) - intern->file_name;
 	} else {
 		intern->_path_len = 0;
 	}
-	
+
 	if (intern->_path) {
 		efree(intern->_path);
 	}
 	intern->_path = estrndup(path, intern->_path_len);
 } /* }}} */
@@ -457,11 +457,11 @@ static spl_filesystem_object * spl_filesystem_object_create_info(spl_filesystem_
 		zend_call_method_with_1_params(&return_value, ce, &ce->constructor, "__construct", NULL, arg1);
 		zval_ptr_dtor(&arg1);
 	} else {
 		spl_filesystem_info_set_filename(intern, file_path, file_path_len, use_copy TSRMLS_CC);
 	}
-	
+
 	zend_restore_error_handling(&error_handling TSRMLS_CC);
 	return intern;
 } /* }}} */
 
 static spl_filesystem_object * spl_filesystem_object_create_type(int ht, spl_filesystem_object *source, int type, zend_class_entry *ce, zval *return_value TSRMLS_DC) /* {{{ */
@@ -512,11 +512,11 @@ static spl_filesystem_object * spl_filesystem_object_create_type(int ht, spl_fil
 
 		zend_update_class_constants(ce TSRMLS_CC);
 
 		return_value->value.obj = spl_filesystem_object_new_ex(ce, &intern TSRMLS_CC);
 		Z_TYPE_P(return_value) = IS_OBJECT;
-	
+
 		spl_filesystem_object_get_file_name(source TSRMLS_CC);
 
 		if (ce->constructor->common.scope != spl_ce_SplFileObject) {
 			MAKE_STD_ZVAL(arg1);
 			MAKE_STD_ZVAL(arg2);
@@ -528,34 +528,34 @@ static spl_filesystem_object * spl_filesystem_object_create_type(int ht, spl_fil
 		} else {
 			intern->file_name = source->file_name;
 			intern->file_name_len = source->file_name_len;
 			intern->_path = spl_filesystem_object_get_path(source, &intern->_path_len TSRMLS_CC);
 			intern->_path = estrndup(intern->_path, intern->_path_len);
-		
+
 			intern->u.file.open_mode = "r";
 			intern->u.file.open_mode_len = 1;
-		
-			if (ht && zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sbr", 
-					&intern->u.file.open_mode, &intern->u.file.open_mode_len, 
+
+			if (ht && zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sbr",
+					&intern->u.file.open_mode, &intern->u.file.open_mode_len,
 					&use_include_path, &intern->u.file.zcontext) == FAILURE) {
 				zend_restore_error_handling(&error_handling TSRMLS_CC);
 				intern->u.file.open_mode = NULL;
 				intern->file_name = NULL;
 				zval_dtor(return_value);
 				Z_TYPE_P(return_value) = IS_NULL;
 				return NULL;
 			}
-		
+
 			if (spl_filesystem_file_open(intern, use_include_path, 0 TSRMLS_CC) == FAILURE) {
 				zend_restore_error_handling(&error_handling TSRMLS_CC);
 				zval_dtor(return_value);
 				Z_TYPE_P(return_value) = IS_NULL;
 				return NULL;
 			}
 		}
 		break;
-	case SPL_FS_DIR:	
+	case SPL_FS_DIR:
 		zend_restore_error_handling(&error_handling TSRMLS_CC);
 		zend_throw_exception_ex(spl_ce_RuntimeException, 0 TSRMLS_CC, "Operation not supported");
 		return NULL;
 	}
 	zend_restore_error_handling(&error_handling TSRMLS_CC);
@@ -615,11 +615,11 @@ static HashTable* spl_filesystem_object_get_debug_info(zval *obj, int *is_temp T
 	efree(pnstr);
 
 	if (intern->file_name) {
 		pnstr = spl_gen_private_prop_name(spl_ce_SplFileInfo, "fileName", sizeof("fileName")-1, &pnlen TSRMLS_CC);
 		spl_filesystem_object_get_path(intern, &path_len TSRMLS_CC);
-		
+
 		if (path_len && path_len < intern->file_name_len) {
 			add_assoc_stringl_ex(&zrv, pnstr, pnlen+1, intern->file_name + path_len + 1, intern->file_name_len - (path_len + 1), 1);
 		} else {
 			add_assoc_stringl_ex(&zrv, pnstr, pnlen+1, intern->file_name, intern->file_name_len, 1);
 		}
@@ -663,17 +663,17 @@ static HashTable* spl_filesystem_object_get_debug_info(zval *obj, int *is_temp T
 /* }}} */
 
 zend_function *spl_filesystem_object_get_method_check(zval **object_ptr, char *method, int method_len, const struct _zend_literal *key TSRMLS_DC) /* {{{ */
 {
 	spl_filesystem_object *fsobj = zend_object_store_get_object(*object_ptr TSRMLS_CC);
-	
+
 	if (fsobj->u.dir.entry.d_name[0] == '\0' && fsobj->orig_path == NULL) {
 		method = "_bad_state_ex";
 		method_len = sizeof("_bad_state_ex") - 1;
 		key = NULL;
 	}
-	
+
 	return zend_get_std_object_handlers()->get_method(object_ptr, method, method_len, key TSRMLS_CC);
 }
 /* }}} */
 
 #define DIT_CTOR_FLAGS  0x00000001
@@ -749,11 +749,11 @@ SPL_METHOD(DirectoryIterator, __construct)
 /* {{{ proto void DirectoryIterator::rewind()
    Rewind dir back to the start */
 SPL_METHOD(DirectoryIterator, rewind)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	intern->u.dir.index = 0;
@@ -767,11 +767,11 @@ SPL_METHOD(DirectoryIterator, rewind)
 /* {{{ proto string DirectoryIterator::key()
    Return current dir entry */
 SPL_METHOD(DirectoryIterator, key)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (intern->u.dir.dirp) {
@@ -797,11 +797,11 @@ SPL_METHOD(DirectoryIterator, current)
    Move to next entry */
 SPL_METHOD(DirectoryIterator, next)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	int skip_dots = SPL_HAS_FLAG(intern->flags, SPL_FILE_DIR_SKIPDOTS);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	intern->u.dir.index++;
@@ -857,11 +857,11 @@ SPL_METHOD(DirectoryIterator, seek)
 /* {{{ proto string DirectoryIterator::valid()
    Check whether dir contains more entries */
 SPL_METHOD(DirectoryIterator, valid)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	RETURN_BOOL(intern->u.dir.entry.d_name[0] != '\0');
@@ -873,11 +873,11 @@ SPL_METHOD(DirectoryIterator, valid)
 SPL_METHOD(SplFileInfo, getPath)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char *path;
 	int path_len;
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
   	path = spl_filesystem_object_get_path(intern, &path_len TSRMLS_CC);
@@ -889,17 +889,17 @@ SPL_METHOD(SplFileInfo, getPath)
    Return filename only */
 SPL_METHOD(SplFileInfo, getFilename)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	int path_len;
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	spl_filesystem_object_get_path(intern, &path_len TSRMLS_CC);
-	
+
 	if (path_len && path_len < intern->file_name_len) {
 		RETURN_STRINGL(intern->file_name + path_len + 1, intern->file_name_len - (path_len + 1), 1);
 	} else {
 		RETURN_STRINGL(intern->file_name, intern->file_name_len, 1);
 	}
@@ -909,11 +909,11 @@ SPL_METHOD(SplFileInfo, getFilename)
 /* {{{ proto string DirectoryIterator::getFilename()
    Return filename of current dir entry */
 SPL_METHOD(DirectoryIterator, getFilename)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	RETURN_STRING(intern->u.dir.entry.d_name, 1);
@@ -1017,21 +1017,21 @@ SPL_METHOD(SplFileInfo, getBasename)
 
 	php_basename(fname, flen, suffix, slen, &fname, &flen TSRMLS_CC);
 
 	RETURN_STRINGL(fname, flen, 0);
 }
-/* }}}*/   
+/* }}}*/
 
 /* {{{ proto string DirectoryIterator::getBasename([string $suffix]) U
    Returns filename component of current dir entry */
 SPL_METHOD(DirectoryIterator, getBasename)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char *suffix = 0, *fname;
 	int slen = 0;
 	size_t flen;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|s", &suffix, &slen) == FAILURE) {
 		return;
 	}
 
 	php_basename(intern->u.dir.entry.d_name, strlen(intern->u.dir.entry.d_name), suffix, slen, &fname, &flen TSRMLS_CC);
@@ -1063,11 +1063,11 @@ SPL_METHOD(SplFileInfo, getPathname)
 /* {{{ proto string FilesystemIterator::key()
    Return getPathname() or getFilename() depending on flags */
 SPL_METHOD(FilesystemIterator, key)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (SPL_FILE_DIR_KEY(intern, SPL_FILE_DIR_KEY_AS_FILENAME)) {
@@ -1082,11 +1082,11 @@ SPL_METHOD(FilesystemIterator, key)
 /* {{{ proto string FilesystemIterator::current()
    Return getFilename(), getFileInfo() or $this depending on flags */
 SPL_METHOD(FilesystemIterator, current)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (SPL_FILE_DIR_CURRENT(intern, SPL_FILE_DIR_CURRENT_AS_PATHNAME)) {
@@ -1105,11 +1105,11 @@ SPL_METHOD(FilesystemIterator, current)
 /* {{{ proto bool DirectoryIterator::isDot()
    Returns true if current entry is '.' or  '..' */
 SPL_METHOD(DirectoryIterator, isDot)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	RETURN_BOOL(spl_filesystem_is_dot(intern->u.dir.entry.d_name));
@@ -1119,12 +1119,12 @@ SPL_METHOD(DirectoryIterator, isDot)
 /* {{{ proto void SplFileInfo::__construct(string file_name)
  Cronstructs a new SplFileInfo from a path. */
 /* zend_replace_error_handling() is used to throw exceptions in case
    the constructor fails. Here we use this to ensure the object
    has a valid directory resource.
-   
-   When the constructor gets called the object is already created 
+
+   When the constructor gets called the object is already created
    by the engine, so we must only call 'additional' initializations.
  */
 SPL_METHOD(SplFileInfo, __construct)
 {
 	spl_filesystem_object *intern;
@@ -1138,15 +1138,15 @@ SPL_METHOD(SplFileInfo, __construct)
 		zend_restore_error_handling(&error_handling TSRMLS_CC);
 		return;
 	}
 
 	intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	spl_filesystem_info_set_filename(intern, path, len, 1 TSRMLS_CC);
 
 	zend_restore_error_handling(&error_handling TSRMLS_CC);
-	
+
 	/* intern->type = SPL_FS_INFO; already set */
 }
 /* }}} */
 
 /* {{{ FileInfoFunction */
@@ -1247,11 +1247,11 @@ SPL_METHOD(SplFileInfo, getLinkTarget)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	int ret;
 	char buff[MAXPATHLEN];
 	zend_error_handling error_handling;
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
@@ -1295,24 +1295,24 @@ SPL_METHOD(SplFileInfo, getRealPath)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char buff[MAXPATHLEN];
 	char *filename;
 	zend_error_handling error_handling;
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
 
 	if (intern->type == SPL_FS_DIR && !intern->file_name && intern->u.dir.entry.d_name[0]) {
 		spl_filesystem_object_get_file_name(intern TSRMLS_CC);
 	}
-	
+
 	if (intern->orig_path) {
 		filename = intern->orig_path;
-	} else { 
+	} else {
 		filename = intern->file_name;
 	}
 
 
 	if (filename && VCWD_REALPATH(filename, buff)) {
@@ -1346,11 +1346,11 @@ SPL_METHOD(SplFileInfo, openFile)
 SPL_METHOD(SplFileInfo, setFileClass)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	zend_class_entry *ce = spl_ce_SplFileObject;
 	zend_error_handling error_handling;
-	
+
 	zend_replace_error_handling(EH_THROW, spl_ce_UnexpectedValueException, &error_handling TSRMLS_CC);
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|C", &ce) == SUCCESS) {
 		intern->file_class = ce;
 	}
@@ -1364,11 +1364,11 @@ SPL_METHOD(SplFileInfo, setFileClass)
 SPL_METHOD(SplFileInfo, setInfoClass)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	zend_class_entry *ce = spl_ce_SplFileInfo;
 	zend_error_handling error_handling;
-	
+
 	zend_replace_error_handling(EH_THROW, spl_ce_UnexpectedValueException, &error_handling  TSRMLS_CC);
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|C", &ce) == SUCCESS) {
 		intern->info_class = ce;
 	}
@@ -1382,11 +1382,11 @@ SPL_METHOD(SplFileInfo, setInfoClass)
 SPL_METHOD(SplFileInfo, getFileInfo)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	zend_class_entry *ce = intern->info_class;
 	zend_error_handling error_handling;
-	
+
 	zend_replace_error_handling(EH_THROW, spl_ce_UnexpectedValueException, &error_handling TSRMLS_CC);
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|C", &ce) == SUCCESS) {
 		spl_filesystem_object_create_type(ht, intern, SPL_FS_INFO, ce, return_value TSRMLS_CC);
 	}
@@ -1400,11 +1400,11 @@ SPL_METHOD(SplFileInfo, getFileInfo)
 SPL_METHOD(SplFileInfo, getPathInfo)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	zend_class_entry *ce = intern->info_class;
 	zend_error_handling error_handling;
-	
+
 	zend_replace_error_handling(EH_THROW, spl_ce_UnexpectedValueException, &error_handling TSRMLS_CC);
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|C", &ce) == SUCCESS) {
 		int path_len;
 		char *path = spl_filesystem_object_get_pathname(intern, &path_len TSRMLS_CC);
@@ -1461,11 +1461,11 @@ SPL_METHOD(FilesystemIterator, rewind)
 /* {{{ proto int FilesystemIterator::getFlags()
    Get handling flags */
 SPL_METHOD(FilesystemIterator, getFlags)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	RETURN_LONG(intern->flags & (SPL_FILE_DIR_KEY_MODE_MASK | SPL_FILE_DIR_CURRENT_MODE_MASK | SPL_FILE_DIR_OTHERS_MASK));
@@ -1517,15 +1517,15 @@ SPL_METHOD(RecursiveDirectoryIterator, getChildren)
 {
 	zval *zpath, *zflags;
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	spl_filesystem_object *subdir;
 	char slash = SPL_HAS_FLAG(intern->flags, SPL_FILE_DIR_UNIXPATHS) ? '/' : DEFAULT_SLASH;
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-	
+
 	spl_filesystem_object_get_file_name(intern TSRMLS_CC);
 
 	MAKE_STD_ZVAL(zflags);
 	MAKE_STD_ZVAL(zpath);
 	ZVAL_LONG(zflags, intern->flags);
@@ -1552,11 +1552,11 @@ SPL_METHOD(RecursiveDirectoryIterator, getChildren)
 /* {{{ proto void RecursiveDirectoryIterator::getSubPath()
    Get sub path */
 SPL_METHOD(RecursiveDirectoryIterator, getSubPath)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (intern->u.dir.sub_path) {
@@ -1573,11 +1573,11 @@ SPL_METHOD(RecursiveDirectoryIterator, getSubPathname)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char *sub_name;
 	int len;
 	char slash = SPL_HAS_FLAG(intern->flags, SPL_FILE_DIR_UNIXPATHS) ? '/' : DEFAULT_SLASH;
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (intern->u.dir.sub_path) {
@@ -1609,11 +1609,11 @@ SPL_METHOD(GlobIterator, __construct)
 /* {{{ proto int GlobIterator::cont()
    Return the number of directories and files found by globbing */
 SPL_METHOD(GlobIterator, count)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (php_stream_is(intern->u.dir.dirp ,&php_glob_stream_ops)) {
@@ -1664,11 +1664,11 @@ zend_object_iterator *spl_filesystem_dir_get_iterator(zend_class_entry *ce, zval
 		/* ->current must be initialized; rewind doesn't set it and valid
 		 * doesn't check whether it's set */
 		iterator->current = object;
 	}
 	zval_add_ref(&object);
-	
+
 	return (zend_object_iterator*)iterator;
 }
 /* }}} */
 
 /* {{{ spl_filesystem_dir_it_dtor */
@@ -1699,11 +1699,11 @@ static int spl_filesystem_dir_it_valid(zend_object_iterator *iter TSRMLS_DC)
 
 /* {{{ spl_filesystem_dir_it_current_data */
 static void spl_filesystem_dir_it_current_data(zend_object_iterator *iter, zval ***data TSRMLS_DC)
 {
 	spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter;
-	
+
 	*data = &iterator->current;
 }
 /* }}} */
 
 /* {{{ spl_filesystem_dir_it_current_key */
@@ -1717,11 +1717,11 @@ static void spl_filesystem_dir_it_current_key(zend_object_iterator *iter, zval *
 
 /* {{{ spl_filesystem_dir_it_move_forward */
 static void spl_filesystem_dir_it_move_forward(zend_object_iterator *iter TSRMLS_DC)
 {
 	spl_filesystem_object *object = spl_filesystem_iterator_to_object((spl_filesystem_iterator *)iter);
-	
+
 	object->u.dir.index++;
 	spl_filesystem_dir_read(object TSRMLS_CC);
 	if (object->file_name) {
 		efree(object->file_name);
 		object->file_name = NULL;
@@ -1731,11 +1731,11 @@ static void spl_filesystem_dir_it_move_forward(zend_object_iterator *iter TSRMLS
 
 /* {{{ spl_filesystem_dir_it_rewind */
 static void spl_filesystem_dir_it_rewind(zend_object_iterator *iter TSRMLS_DC)
 {
 	spl_filesystem_object *object = spl_filesystem_iterator_to_object((spl_filesystem_iterator *)iter);
-	
+
 	object->u.dir.index = 0;
 	if (object->u.dir.dirp) {
 		php_stream_rewinddir(object->u.dir.dirp);
 	}
 	spl_filesystem_dir_read(object TSRMLS_CC);
@@ -1801,11 +1801,11 @@ static void spl_filesystem_tree_it_current_key(zend_object_iterator *iter, zval
 /* {{{ spl_filesystem_tree_it_move_forward */
 static void spl_filesystem_tree_it_move_forward(zend_object_iterator *iter TSRMLS_DC)
 {
 	spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter;
 	spl_filesystem_object   *object   = spl_filesystem_iterator_to_object(iterator);
-	
+
 	object->u.dir.index++;
 	do {
 		spl_filesystem_dir_read(object TSRMLS_CC);
 	} while (spl_filesystem_is_dot(object->u.dir.entry.d_name));
 	if (object->file_name) {
@@ -1822,11 +1822,11 @@ static void spl_filesystem_tree_it_move_forward(zend_object_iterator *iter TSRML
 /* {{{ spl_filesystem_tree_it_rewind */
 static void spl_filesystem_tree_it_rewind(zend_object_iterator *iter TSRMLS_DC)
 {
 	spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter;
 	spl_filesystem_object   *object   = spl_filesystem_iterator_to_object(iterator);
-	
+
 	object->u.dir.index = 0;
 	if (object->u.dir.dirp) {
 		php_stream_rewinddir(object->u.dir.dirp);
 	}
 	do {
@@ -1866,11 +1866,11 @@ zend_object_iterator *spl_filesystem_tree_get_iterator(zend_class_entry *ce, zva
 	if (iterator->intern.data == NULL) {
 		iterator->intern.data = object;
 		iterator->intern.funcs = &spl_filesystem_tree_it_funcs;
 	}
 	zval_add_ref(&object);
-	
+
 	return (zend_object_iterator*)iterator;
 }
 /* }}} */
 
 /* {{{ spl_filesystem_object_cast */
@@ -1922,11 +1922,11 @@ static int spl_filesystem_object_cast(zval *readobj, zval *writeobj, int type TS
 }
 /* }}} */
 
 /* {{{ declare method parameters */
 /* supply a name and default to call by parameter */
-ZEND_BEGIN_ARG_INFO(arginfo_info___construct, 0) 
+ZEND_BEGIN_ARG_INFO(arginfo_info___construct, 0)
 	ZEND_ARG_INFO(0, file_name)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_info_openFile, 0, 0, 0)
 	ZEND_ARG_INFO(0, open_mode)
@@ -1981,15 +1981,15 @@ static const zend_function_entry spl_SplFileInfo_functions[] = {
 	SPL_ME(SplFileInfo,       _bad_state_ex, NULL,							ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	SPL_MA(SplFileInfo,       __toString, SplFileInfo, getPathname, arginfo_splfileinfo_void, ZEND_ACC_PUBLIC)
 	PHP_FE_END
 };
 
-ZEND_BEGIN_ARG_INFO(arginfo_dir___construct, 0) 
+ZEND_BEGIN_ARG_INFO(arginfo_dir___construct, 0)
 	ZEND_ARG_INFO(0, path)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO(arginfo_dir_it_seek, 0) 
+ZEND_BEGIN_ARG_INFO(arginfo_dir_it_seek, 0)
 	ZEND_ARG_INFO(0, position)
 ZEND_END_ARG_INFO();
 
 /* the method table */
 /* each method can have its own parameters and visibility */
@@ -2007,11 +2007,11 @@ static const zend_function_entry spl_DirectoryIterator_functions[] = {
 	SPL_ME(DirectoryIterator, seek,          arginfo_dir_it_seek, ZEND_ACC_PUBLIC)
 	SPL_MA(DirectoryIterator, __toString, DirectoryIterator, getFilename, arginfo_splfileinfo_void, ZEND_ACC_PUBLIC)
 	PHP_FE_END
 };
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_r_dir___construct, 0, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_r_dir___construct, 0, 0, 1)
 	ZEND_ARG_INFO(0, path)
 	ZEND_ARG_INFO(0, flags)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_r_dir_hasChildren, 0, 0, 0)
@@ -2056,11 +2056,11 @@ static int spl_filesystem_file_read(spl_filesystem_object *intern, int silent TS
 	char *buf;
 	size_t line_len = 0;
 	long line_add = (intern->u.file.current_line || intern->u.file.current_zval) ? 1 : 0;
 
 	spl_filesystem_file_free_line(intern TSRMLS_CC);
-	
+
 	if (php_stream_eof(intern->u.file.stream)) {
 		if (!silent) {
 			zend_throw_exception_ex(spl_ce_RuntimeException, 0 TSRMLS_CC, "Cannot read from file %s", intern->file_name);
 		}
 		return FAILURE;
@@ -2084,11 +2084,11 @@ static int spl_filesystem_file_read(spl_filesystem_object *intern, int silent TS
 	} else {
 		if (SPL_HAS_FLAG(intern->flags, SPL_FILE_OBJECT_DROP_NEW_LINE)) {
 			line_len = strcspn(buf, "\r\n");
 			buf[line_len] = '\0';
 		}
-	
+
 		intern->u.file.current_line = buf;
 		intern->u.file.current_line_len = line_len;
 	}
 	intern->u.file.current_line_num += line_add;
 
@@ -2105,11 +2105,11 @@ static int spl_filesystem_file_call(spl_filesystem_object *intern, zend_function
 	int num_args = pass_num_args + (arg2 ? 2 : 1);
 
 	zval ***params = (zval***)safe_emalloc(num_args, sizeof(zval**), 0);
 
 	params[0] = &zresource_ptr;
-	
+
 	if (arg2) {
 		params[1] = &arg2;
 	}
 
 	zend_get_parameters_array_ex(pass_num_args, params+(arg2 ? 2 : 1));
@@ -2131,11 +2131,11 @@ static int spl_filesystem_file_call(spl_filesystem_object *intern, zend_function
 	fcic.calling_scope = NULL;
 	fcic.called_scope = NULL;
 	fcic.object_ptr = NULL;
 
 	result = zend_call_function(&fci, &fcic TSRMLS_CC);
-	
+
 	if (result == FAILURE) {
 		RETVAL_FALSE;
 	} else {
 		ZVAL_ZVAL(return_value, retval, 1, 1);
 	}
@@ -2157,15 +2157,15 @@ static int spl_filesystem_file_call(spl_filesystem_object *intern, zend_function
 } /* }}} */
 
 static int spl_filesystem_file_read_csv(spl_filesystem_object *intern, char delimiter, char enclosure, char escape, zval *return_value TSRMLS_DC) /* {{{ */
 {
 	int ret = SUCCESS;
-	
+
 	do {
 		ret = spl_filesystem_file_read(intern, 1 TSRMLS_CC);
 	} while (ret == SUCCESS && !intern->u.file.current_line_len && SPL_HAS_FLAG(intern->flags, SPL_FILE_OBJECT_SKIP_EMPTY));
-	
+
 	if (ret == SUCCESS) {
 		size_t buf_len = intern->u.file.current_line_len;
 		char *buf = estrndup(intern->u.file.current_line, buf_len);
 
 		if (intern->u.file.current_zval) {
@@ -2235,11 +2235,11 @@ static int spl_filesystem_file_is_empty_line(spl_filesystem_object *intern TSRML
 			return Z_STRLEN_P(intern->u.file.current_zval) == 0;
 		case IS_ARRAY:
 			if (SPL_HAS_FLAG(intern->flags, SPL_FILE_OBJECT_READ_CSV)
 			&& zend_hash_num_elements(Z_ARRVAL_P(intern->u.file.current_zval)) == 1) {
 				zval ** first = Z_ARRVAL_P(intern->u.file.current_zval)->pListHead->pData;
-					
+
 				return Z_TYPE_PP(first) == IS_STRING && Z_STRLEN_PP(first) == 0;
 			}
 			return zend_hash_num_elements(Z_ARRVAL_P(intern->u.file.current_zval)) == 0;
 		case IS_NULL:
 			return 1;
@@ -2258,11 +2258,11 @@ static int spl_filesystem_file_read_line(zval * this_ptr, spl_filesystem_object
 
 	while (SPL_HAS_FLAG(intern->flags, SPL_FILE_OBJECT_SKIP_EMPTY) && ret == SUCCESS && spl_filesystem_file_is_empty_line(intern TSRMLS_CC)) {
 		spl_filesystem_file_free_line(intern TSRMLS_CC);
 		ret = spl_filesystem_file_read_line_ex(this_ptr, intern, silent TSRMLS_CC);
 	}
-	
+
 	return ret;
 }
 /* }}} */
 
 static void spl_filesystem_file_rewind(zval * this_ptr, spl_filesystem_object *intern TSRMLS_DC) /* {{{ */
@@ -2292,20 +2292,20 @@ SPL_METHOD(SplFileObject, __construct)
 	zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
 
 	intern->u.file.open_mode = NULL;
 	intern->u.file.open_mode_len = 0;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sbr!", 
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sbr!",
 			&intern->file_name, &intern->file_name_len,
-			&intern->u.file.open_mode, &intern->u.file.open_mode_len, 
-			&use_include_path, &intern->u.file.zcontext) == FAILURE) {		
+			&intern->u.file.open_mode, &intern->u.file.open_mode_len,
+			&use_include_path, &intern->u.file.zcontext) == FAILURE) {
 		intern->u.file.open_mode = NULL;
 		intern->file_name = NULL;
 		zend_restore_error_handling(&error_handling TSRMLS_CC);
 		return;
 	}
-	
+
 	if (intern->u.file.open_mode == NULL) {
 		intern->u.file.open_mode = "r";
 		intern->u.file.open_mode_len = 1;
 	}
 
@@ -2366,11 +2366,11 @@ SPL_METHOD(SplTempFileObject, __construct)
 		intern->file_name_len = 10;
 	}
 	intern->u.file.open_mode = "wb";
 	intern->u.file.open_mode_len = 1;
 	intern->u.file.zcontext = NULL;
-	
+
 	if (spl_filesystem_file_open(intern, 0, 0 TSRMLS_CC) == SUCCESS) {
 		intern->_path_len = 0;
 		intern->_path = estrndup("", 0);
 	}
 	zend_restore_error_handling(&error_handling TSRMLS_CC);
@@ -2379,11 +2379,11 @@ SPL_METHOD(SplTempFileObject, __construct)
 /* {{{ proto void SplFileObject::rewind()
    Rewind the file and read the first line */
 SPL_METHOD(SplFileObject, rewind)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	spl_filesystem_file_rewind(getThis(), intern TSRMLS_CC);
@@ -2392,11 +2392,11 @@ SPL_METHOD(SplFileObject, rewind)
 /* {{{ proto void SplFileObject::eof()
    Return whether end of file is reached */
 SPL_METHOD(SplFileObject, eof)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	RETURN_BOOL(php_stream_eof(intern->u.file.stream));
@@ -2405,11 +2405,11 @@ SPL_METHOD(SplFileObject, eof)
 /* {{{ proto void SplFileObject::valid()
    Return !eof() */
 SPL_METHOD(SplFileObject, valid)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (SPL_HAS_FLAG(intern->flags, SPL_FILE_OBJECT_READ_AHEAD)) {
@@ -2422,11 +2422,11 @@ SPL_METHOD(SplFileObject, valid)
 /* {{{ proto string SplFileObject::fgets()
    Rturn next line from file */
 SPL_METHOD(SplFileObject, fgets)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (spl_filesystem_file_read(intern, 0 TSRMLS_CC) == FAILURE) {
@@ -2438,11 +2438,11 @@ SPL_METHOD(SplFileObject, fgets)
 /* {{{ proto string SplFileObject::current()
    Return current line from file */
 SPL_METHOD(SplFileObject, current)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	if (!intern->u.file.current_line && !intern->u.file.current_zval) {
@@ -2459,11 +2459,11 @@ SPL_METHOD(SplFileObject, current)
 /* {{{ proto int SplFileObject::key()
    Return line number */
 SPL_METHOD(SplFileObject, key)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 /*	Do not read the next line to support correct counting with fgetc()
@@ -2476,11 +2476,11 @@ SPL_METHOD(SplFileObject, key)
 /* {{{ proto void SplFileObject::next()
    Read next line */
 SPL_METHOD(SplFileObject, next)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	spl_filesystem_file_free_line(intern TSRMLS_CC);
@@ -2528,20 +2528,20 @@ SPL_METHOD(SplFileObject, setMaxLineLen)
 
 	if (max_len < 0) {
 		zend_throw_exception_ex(spl_ce_DomainException, 0 TSRMLS_CC, "Maximum line length must be greater than or equal zero");
 		return;
 	}
-	
+
 	intern->u.file.max_line_len = max_len;
 } /* }}} */
 
 /* {{{ proto int SplFileObject::getMaxLineLen()
    Get maximum line length */
 SPL_METHOD(SplFileObject, getMaxLineLen)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-	
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
 	RETURN_LONG((long)intern->u.file.max_line_len);
@@ -2552,11 +2552,11 @@ SPL_METHOD(SplFileObject, getMaxLineLen)
 SPL_METHOD(SplFileObject, hasChildren)
 {
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-	
+
 	RETURN_FALSE;
 } /* }}} */
 
 /* {{{ proto bool SplFileObject::getChildren()
    Read NULL */
@@ -2583,11 +2583,11 @@ SPL_METHOD(SplFileObject, fgetcsv)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char delimiter = intern->u.file.delimiter, enclosure = intern->u.file.enclosure, escape = intern->u.file.escape;
 	char *delim = NULL, *enclo = NULL, *esc = NULL;
 	int d_len = 0, e_len = 0, esc_len = 0;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sss", &delim, &d_len, &enclo, &e_len, &esc, &esc_len) == SUCCESS) {
 		switch(ZEND_NUM_ARGS())
 		{
 		case 3:
 			if (esc_len != 1) {
@@ -2625,11 +2625,11 @@ SPL_METHOD(SplFileObject, fputcsv)
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char delimiter = intern->u.file.delimiter, enclosure = intern->u.file.enclosure, escape = intern->u.file.escape;
 	char *delim = NULL, *enclo = NULL, *esc = NULL;
 	int d_len = 0, e_len = 0, esc_len = 0, ret;
 	zval *fields = NULL;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "a|sss", &fields, &delim, &d_len, &enclo, &e_len, &esc, &esc_len) == SUCCESS) {
 		switch(ZEND_NUM_ARGS())
 		{
 		case 4:
 			if (esc_len != 1) {
@@ -2668,11 +2668,11 @@ SPL_METHOD(SplFileObject, setCsvControl)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char delimiter = ',', enclosure = '"', escape='\\';
 	char *delim = NULL, *enclo = NULL, *esc = NULL;
 	int d_len = 0, e_len = 0, esc_len = 0;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sss", &delim, &d_len, &enclo, &e_len, &esc, &esc_len) == SUCCESS) {
 		switch(ZEND_NUM_ARGS())
 		{
 		case 3:
 			if (esc_len != 1) {
@@ -2711,11 +2711,11 @@ SPL_METHOD(SplFileObject, getCsvControl)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	char delimiter[2], enclosure[2];
 
 	array_init(return_value);
-	
+
 	delimiter[0] = intern->u.file.delimiter;
 	delimiter[1] = '\0';
 	enclosure[0] = intern->u.file.enclosure;
 	enclosure[1] = '\0';
 
@@ -2740,11 +2740,11 @@ SPL_METHOD(SplFileObject, fflush)
 
 /* {{{ proto int SplFileObject::ftell()
    Return current file position */
 SPL_METHOD(SplFileObject, ftell)
 {
-	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);	
+	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	long ret = php_stream_tell(intern->u.file.stream);
 
 	if (ret == -1) {
 		RETURN_FALSE;
 	} else {
@@ -2870,10 +2870,14 @@ SPL_METHOD(SplFileObject, fread)
 
 	if (length <= 0) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater than 0");
 		RETURN_FALSE;
 	}
+	if (length > INT_MAX) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX);
+		RETURN_FALSE;
+	}
 
 	Z_STRVAL_P(return_value) = emalloc(length + 1);
 	Z_STRLEN_P(return_value) = php_stream_read(intern->u.file.stream, Z_STRVAL_P(return_value), length);
 
 	/* needed because recv/read/gzread doesnt put a null at the end*/
@@ -2890,40 +2894,40 @@ FileFunction(fstat)
    Truncate file to 'size' length */
 SPL_METHOD(SplFileObject, ftruncate)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	long size;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &size) == FAILURE) {
 		return;
 	}
 
 	if (!php_stream_truncate_supported(intern->u.file.stream)) {
 		zend_throw_exception_ex(spl_ce_LogicException, 0 TSRMLS_CC, "Can't truncate file %s", intern->file_name);
 		RETURN_FALSE;
 	}
-	
+
 	RETURN_BOOL(0 == php_stream_truncate_set_size(intern->u.file.stream, size));
 } /* }}} */
 
 /* {{{ proto void SplFileObject::seek(int line_pos)
    Seek to specified line */
 SPL_METHOD(SplFileObject, seek)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	long line_pos;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &line_pos) == FAILURE) {
 		return;
 	}
 	if (line_pos < 0) {
 		zend_throw_exception_ex(spl_ce_LogicException, 0 TSRMLS_CC, "Can't seek file %s to negative line %ld", intern->file_name, line_pos);
-		RETURN_FALSE;		
+		RETURN_FALSE;
 	}
-	
+
 	spl_filesystem_file_rewind(getThis(), intern TSRMLS_CC);
-	
+
 	while(intern->u.file.current_line_num < line_pos) {
 		if (spl_filesystem_file_read_line(getThis(), intern, 1 TSRMLS_CC) == FAILURE) {
 			break;
 		}
 	}
@@ -2956,42 +2960,42 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fputcsv, 0, 0, 1)
 	ZEND_ARG_INFO(0, delimiter)
 	ZEND_ARG_INFO(0, enclosure)
 	ZEND_ARG_INFO(0, escape)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_flock, 0, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_flock, 0, 0, 1)
 	ZEND_ARG_INFO(0, operation)
 	ZEND_ARG_INFO(1, wouldblock)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fseek, 0, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fseek, 0, 0, 1)
 	ZEND_ARG_INFO(0, pos)
 	ZEND_ARG_INFO(0, whence)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fgetss, 0, 0, 0) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fgetss, 0, 0, 0)
 	ZEND_ARG_INFO(0, allowable_tags)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1)
 	ZEND_ARG_INFO(0, format)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1)
 	ZEND_ARG_INFO(0, str)
 	ZEND_ARG_INFO(0, length)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fread, 0, 0, 1)
 	ZEND_ARG_INFO(0, length)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_ftruncate, 0, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_ftruncate, 0, 0, 1)
 	ZEND_ARG_INFO(0, size)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_seek, 0, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_seek, 0, 0, 1)
 	ZEND_ARG_INFO(0, line_pos)
 ZEND_END_ARG_INFO()
 
 static const zend_function_entry spl_SplFileObject_functions[] = {
 	SPL_ME(SplFileObject, __construct,    arginfo_file_object___construct,   ZEND_ACC_PUBLIC)
@@ -3076,11 +3080,11 @@ PHP_MINIT_FUNCTION(spl_directory)
 
 	spl_ce_FilesystemIterator->get_iterator = spl_filesystem_tree_get_iterator;
 
 	REGISTER_SPL_SUB_CLASS_EX(RecursiveDirectoryIterator, FilesystemIterator, spl_filesystem_object_new, spl_RecursiveDirectoryIterator_functions);
 	REGISTER_SPL_IMPLEMENTS(RecursiveDirectoryIterator, RecursiveIterator);
-	
+
 	memcpy(&spl_filesystem_object_check_handlers, &spl_filesystem_object_handlers, sizeof(zend_object_handlers));
 	spl_filesystem_object_check_handlers.get_method = spl_filesystem_object_get_method_check;
 
 #ifdef HAVE_GLOB
 	REGISTER_SPL_SUB_CLASS_EX(GlobIterator, FilesystemIterator, spl_filesystem_object_new_check, spl_GlobIterator_functions);
@@ -3093,11 +3097,11 @@ PHP_MINIT_FUNCTION(spl_directory)
 
 	REGISTER_SPL_CLASS_CONST_LONG(SplFileObject, "DROP_NEW_LINE", SPL_FILE_OBJECT_DROP_NEW_LINE);
 	REGISTER_SPL_CLASS_CONST_LONG(SplFileObject, "READ_AHEAD",    SPL_FILE_OBJECT_READ_AHEAD);
 	REGISTER_SPL_CLASS_CONST_LONG(SplFileObject, "SKIP_EMPTY",    SPL_FILE_OBJECT_SKIP_EMPTY);
 	REGISTER_SPL_CLASS_CONST_LONG(SplFileObject, "READ_CSV",      SPL_FILE_OBJECT_READ_CSV);
-	
+
 	REGISTER_SPL_SUB_CLASS_EX(SplTempFileObject, SplFileObject, spl_filesystem_object_new_check, spl_SplTempFileObject_functions);
 	return SUCCESS;
 }
 /* }}} */
 

Vulnerable code: 	
	
		}		
/* creates the object by 
   - allocating memory 
   called from 
	
   Load the 'other' object 
	
	
	
	
	
		
		
			if (ht && zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sbr", 
					&intern->u.file.open_mode, &intern->u.file.open_mode_len, 
		
	case SPL_FS_DIR:	
		
	
	
	
	
	
	
	
	
	
	
/* }}}*/   
	
	
	
	
   
   When the constructor gets called the object is already created 
	
	
	
	
	
	} else { 
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
ZEND_BEGIN_ARG_INFO(arginfo_info___construct, 0) 
ZEND_BEGIN_ARG_INFO(arginfo_dir___construct, 0) 
ZEND_BEGIN_ARG_INFO(arginfo_dir_it_seek, 0) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_r_dir___construct, 0, 0, 1) 
	
	
	
	
	
	
					
	
	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sbr!", 
			&intern->u.file.open_mode, &intern->u.file.open_mode_len, 
			&use_include_path, &intern->u.file.zcontext) == FAILURE) {		
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);	
	
	
	
		RETURN_FALSE;		
	
	
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_flock, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fseek, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fgetss, 0, 0, 0) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_ftruncate, 0, 0, 1) 
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_seek, 0, 0, 1) 
	
	
Fixed code: 

		}
/* creates the object by
   - allocating memory
   called from

   Load the 'other' object







			if (ht && zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sbr",
					&intern->u.file.open_mode, &intern->u.file.open_mode_len,

	case SPL_FS_DIR:











/* }}}*/





   When the constructor gets called the object is already created





	} else {

















ZEND_BEGIN_ARG_INFO(arginfo_info___construct, 0)
ZEND_BEGIN_ARG_INFO(arginfo_dir___construct, 0)
ZEND_BEGIN_ARG_INFO(arginfo_dir_it_seek, 0)
ZEND_BEGIN_ARG_INFO_EX(arginfo_r_dir___construct, 0, 0, 1)








	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sbr!",
			&intern->u.file.open_mode, &intern->u.file.open_mode_len,
			&use_include_path, &intern->u.file.zcontext) == FAILURE) {
















	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
	if (length > INT_MAX) {
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX);
		RETURN_FALSE;
	}



		RETURN_FALSE;


ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_flock, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fseek, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fgetss, 0, 0, 0)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_ftruncate, 0, 0, 1)
ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_seek, 0, 0, 1)