Description:
------------
exif_imagetype doesn’t ensure that pathnames lack NULL byte, which might allow attacker to manipulate the file path.

===============================================
Affected code:
PHP_FUNCTION(exif_imagetype)
{
    char *imagefile;
    size_t imagefile_len;
    php_stream * stream;
    int itype = 0;
 
    if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &imagefile, &imagefile_len) == FAILURE) { ⇐== THIS LINE
        return;
    }
===============================================

Test script:
---------------
<?php
var_dump(exif_imagetype("./image.png\x00.gallery.jpg"));
?>

Expected result:
----------------
expected parameter instead of string

Actual result:
--------------
$ php curl.php 
int(3)