Description:
------------
ip2long() is supposed to return -1 on an invalid ip address.  Because of PHP's method of storing strings, and a careless calling of standard C library functions that use null-terminated strings, it will not return -1 on invalid ip addresses that contain embedded null characters in appropriate places.

" The function ip2long() generates an IPv4 Internet network address from its Internet standard format (dotted string) representation. If ip_address is invalid than -1 is returned. Note that -1  does not evaluate as FALSE in PHP."

Reproduce code:
---------------
if(ip2long($_GET[ip]) != -1)
 echo($_GET[ip]);

http://something.net/somescript.php?ip=127.0.0.1%00<b>foo</b>

Expected result:
----------------
Arbitrary HTML insertion.  Worse effects may be possible depending on the application.