Description:
------------
NUL character (C string terminator) is allowed in file paths passed to OS functions, which causes unexpected truncation of string.

This is a security risk for popular, sloppy code like:
 include($_GET['page'].'.i-feel-safe.php');
because ?page=/etc/passwd%00 circumvents such "protection".

IMHO PHP should throw an error if PHP string can't be safely converted to C string.


Reproduce code:
---------------
<?php
fopen(urldecode("test%00.html"),"r");

Expected result:
----------------
Error: illegal path

Actual result:
--------------
Warning: fopen(test) [function.fopen]: failed to open stream: No such file or directory in c:\www\test.php5 on line 2