From 503b9a932000bc0c0809dba6ff9214322cc82392 Mon Sep 17 00:00:00 2001
From: Alexandre Daubois <alex.daubois@gmail.com>
Date: Tue, 5 Aug 2025 15:17:39 +0200
Subject: [PATCH] Throw ValueError when a wrong flag value is provided to the
 second argument of `scandir()`

---
 UPGRADING                                     |  3 +
 ext/standard/dir.c                            |  8 ++-
 .../tests/dir/scandir_invalid_flag.phpt       | 12 ++++
 .../dir/scandir_variation9-win32-mb.phpt      | 71 -------------------
 .../tests/dir/scandir_variation9.phpt         | 65 -----------------
 5 files changed, 21 insertions(+), 138 deletions(-)
 create mode 100644 ext/standard/tests/dir/scandir_invalid_flag.phpt
 delete mode 100644 ext/standard/tests/dir/scandir_variation9-win32-mb.phpt
 delete mode 100644 ext/standard/tests/dir/scandir_variation9.phpt

diff --git a/UPGRADING b/UPGRADING
index f3a7494d3c839..4d2dc907f2fb1 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -142,6 +142,9 @@ PHP 8.5 UPGRADE NOTES
   . Using a printf-family function with a formatter that did not specify the
     precision previously incorrectly reset the precision instead of treating
     it as a precision of 0. See GH-18897.
+  . Passing an invalid flag value to the second argument of scandir() will now
+    throw a ValueError. Previously, it would silently use the
+    SCANDIR_SORT_DESCENDING value.
 
 ========================================
 2. New Features
diff --git a/ext/standard/dir.c b/ext/standard/dir.c
index cced88e4ac8a5..764f58881bf36 100644
--- a/ext/standard/dir.c
+++ b/ext/standard/dir.c
@@ -549,9 +549,13 @@ PHP_FUNCTION(scandir)
 		n = php_stream_scandir(dirn, &namelist, context, (void *) php_stream_dirent_alphasort);
 	} else if (flags == PHP_SCANDIR_SORT_NONE) {
 		n = php_stream_scandir(dirn, &namelist, context, NULL);
-	} else {
+	} else if (flags == PHP_SCANDIR_SORT_DESCENDING) {
 		n = php_stream_scandir(dirn, &namelist, context, (void *) php_stream_dirent_alphasortr);
-	}
+	} else {
+        zend_argument_value_error(2, "must be one of the SCANDIR_SORT_ASCENDING, SCANDIR_SORT_DESCENDING and SCANDIR_SORT_NONE constants");
+        RETURN_THROWS();
+    }
+
 	if (n < 0) {
 		php_error_docref(NULL, E_WARNING, "(errno %d): %s", errno, strerror(errno));
 		RETURN_FALSE;
diff --git a/ext/standard/tests/dir/scandir_invalid_flag.phpt b/ext/standard/tests/dir/scandir_invalid_flag.phpt
new file mode 100644
index 0000000000000..1cde17c75d5bb
--- /dev/null
+++ b/ext/standard/tests/dir/scandir_invalid_flag.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Provide wrong flags to scandir()
+--FILE--
+<?php
+try {
+    scandir('something', -1);
+} catch (ValueError $e) {
+    echo $e->getMessage() . "\n";
+}
+?>
+--EXPECT--
+scandir(): Argument #2 ($sorting_order) must be one of the SCANDIR_SORT_ASCENDING, SCANDIR_SORT_DESCENDING and SCANDIR_SORT_NONE constants
diff --git a/ext/standard/tests/dir/scandir_variation9-win32-mb.phpt b/ext/standard/tests/dir/scandir_variation9-win32-mb.phpt
deleted file mode 100644
index 44d8b6daa5f9e..0000000000000
--- a/ext/standard/tests/dir/scandir_variation9-win32-mb.phpt
+++ /dev/null
@@ -1,71 +0,0 @@
---TEST--
-Test scandir() function : usage variations - different ints as $sorting_order arg
---SKIPIF--
-<?php
-if (substr(PHP_OS, 0, 3) != 'WIN') {
-  die("skip Valid only on Windows");
-}
-?>
---FILE--
-<?php
-/*
- * Pass different integers as $sorting_order argument to test how scandir()
- * re-orders the array
- */
-
-echo "*** Testing scandir() : usage variations ***\n";
-
-// include for create_files/delete_files functions
-include(__DIR__ . '/../file/file.inc');
-
-// create directory and files
-$dir = __DIR__ . '/私はガラスを食べられますscandir_variation9';
-mkdir($dir);
-@create_files($dir, 2, "numeric", 0755, 1, "w", "私はガラスを食べられますfile");
-
-// different ints to pass as $sorting_order argument
-$ints = array (PHP_INT_MAX, -PHP_INT_MAX, 0);
-
-foreach($ints as $sorting_order) {
-    var_dump( scandir($dir, $sorting_order) );
-}
-
-delete_files($dir, 2, "私はガラスを食べられますfile");
-?>
---CLEAN--
-<?php
-$dir = __DIR__ . '/私はガラスを食べられますscandir_variation9';
-rmdir($dir);
-?>
---EXPECT--
-*** Testing scandir() : usage variations ***
-array(4) {
-  [0]=>
-  string(45) "私はガラスを食べられますfile2.tmp"
-  [1]=>
-  string(45) "私はガラスを食べられますfile1.tmp"
-  [2]=>
-  string(2) ".."
-  [3]=>
-  string(1) "."
-}
-array(4) {
-  [0]=>
-  string(45) "私はガラスを食べられますfile2.tmp"
-  [1]=>
-  string(45) "私はガラスを食べられますfile1.tmp"
-  [2]=>
-  string(2) ".."
-  [3]=>
-  string(1) "."
-}
-array(4) {
-  [0]=>
-  string(1) "."
-  [1]=>
-  string(2) ".."
-  [2]=>
-  string(45) "私はガラスを食べられますfile1.tmp"
-  [3]=>
-  string(45) "私はガラスを食べられますfile2.tmp"
-}
diff --git a/ext/standard/tests/dir/scandir_variation9.phpt b/ext/standard/tests/dir/scandir_variation9.phpt
deleted file mode 100644
index 56e5575e55904..0000000000000
--- a/ext/standard/tests/dir/scandir_variation9.phpt
+++ /dev/null
@@ -1,65 +0,0 @@
---TEST--
-Test scandir() function : usage variations - different ints as $sorting_order arg
---FILE--
-<?php
-/*
- * Pass different integers as $sorting_order argument to test how scandir()
- * re-orders the array
- */
-
-echo "*** Testing scandir() : usage variations ***\n";
-
-// include for create_files/delete_files functions
-include(__DIR__ . '/../file/file.inc');
-
-// create directory and files
-$dir = __DIR__ . '/scandir_variation9';
-mkdir($dir);
-@create_files($dir, 2);
-
-// different ints to pass as $sorting_order argument
-$ints = array (PHP_INT_MAX, -PHP_INT_MAX, 0);
-
-foreach($ints as $sorting_order) {
-    var_dump( scandir($dir, $sorting_order) );
-}
-
-delete_files($dir, 2);
-?>
---CLEAN--
-<?php
-$dir = __DIR__ . '/scandir_variation9';
-rmdir($dir);
-?>
---EXPECT--
-*** Testing scandir() : usage variations ***
-array(4) {
-  [0]=>
-  string(9) "file2.tmp"
-  [1]=>
-  string(9) "file1.tmp"
-  [2]=>
-  string(2) ".."
-  [3]=>
-  string(1) "."
-}
-array(4) {
-  [0]=>
-  string(9) "file2.tmp"
-  [1]=>
-  string(9) "file1.tmp"
-  [2]=>
-  string(2) ".."
-  [3]=>
-  string(1) "."
-}
-array(4) {
-  [0]=>
-  string(1) "."
-  [1]=>
-  string(2) ".."
-  [2]=>
-  string(9) "file1.tmp"
-  [3]=>
-  string(9) "file2.tmp"
-}