Stas, Was the patch I supplied not ok? I seem to be unable to view what you have changed, or even see the patch I uploaded

That was the patch that was supplied, no other patch was attached to the bug before that.

Go ahead, 5.4+, not sure Johannes likes it in 5.3 too :)

Go ahead, 5.4+, not sure Johannes likes it in 5.3 too :)

I think the risk of exploiting this is quite small as it requires users to take unverified paths and the attacker can access only images of a specific type to which he also has to know the path (unless error reporting is switched on the attacker can't even distinguish between "file does not exist" and "file is not an image of that type")

Nonetheless the fix is quite trivial, so adding it to 5.3 looks fine.

Note on 5.3: In 5.3 we already have the check

 94         if (strlen(file) != file_len) {
 95             RETURN_FALSE;
 96         }

The issue was introduced with 5.4 while cleaning up stream usage after safe_mode removal. My previous comment on 5.3 can therefore be ignored.

The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

Fix was done in commit 706aefb78112a44d4932d4c9430c6a898696f51f