Crap formatting, here's the text again:

In its current state, fread delegates the actual read call to php_stream_read.
It assumes that the return value of php_stream_read() is always >= 0 (this can
be easily seen because it writes the return value directly in the length field
of the allocated buffer). But there are cases when php_stream_read() returns
e.g. -1, for example compress.bzip2 can't decompress the stream on a read (just
test this with a file you pretend it's an bz2 but it's just a php source).

I also think the impact is wrote then just fread(). I've seen a few places in
streams.c where only == 0 is used for checking an error condition in the code.

This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.

The reported problem with bz2 has been fixed in CVS. In regard to negative return values of php_stream_read(), IMO it should be up to the caller of the function to handle negative return values.