Index: ext/dom/document.c
===================================================================
--- ext/dom/document.c.orig	2012-09-12 23:27:16.000000000 +0200
+++ ext/dom/document.c	2015-06-22 14:42:35.681146683 +0200
@@ -1573,6 +1573,9 @@
 	xmlInitParser();
 
 	if (mode == DOM_LOAD_FILE) {
+		if (strlen(source) != source_len) {
+			return NULL;
+		}
 		char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (file_dest) {
 			ctxt = xmlCreateFileParserCtxt(file_dest);
@@ -2164,6 +2167,11 @@
 		return;
 	}
 
+	if (strlen(source) != source_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (!source_len) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty string supplied as input");
 		RETURN_FALSE;
Index: ext/fileinfo/fileinfo.c
===================================================================
--- ext/fileinfo/fileinfo.c.orig	2012-09-12 23:27:16.000000000 +0200
+++ ext/fileinfo/fileinfo.c	2015-06-22 14:44:28.288624230 +0200
@@ -512,6 +512,12 @@
 				goto clean;
 			}
 
+			if (strlen(buffer) != buffer_len) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid filename or path");
+				RETVAL_FALSE;
+				goto clean;
+			}
+
 			wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);
 
 			if (wrap) {
Index: ext/gd/gd.c
===================================================================
--- ext/gd/gd.c.orig	2012-09-12 23:27:16.000000000 +0200
+++ ext/gd/gd.c	2015-06-22 15:31:00.105634776 +0200
@@ -1461,6 +1461,7 @@
 PHP_FUNCTION(imageloadfont)
 {
 	char *file;
+        /*  vvvvvvvvv should have been file_len, probably */
 	int file_name, hdr_size = sizeof(gdFont) - sizeof(char *);
 	int ind, body_size, n = 0, b, i, body_size_check;
 	gdFontPtr font;
@@ -1470,6 +1471,11 @@
 		return;
 	}
 
+	if (strlen(file) != file_name) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
+
 	stream = php_stream_open_wrapper(file, "rb", ENFORCE_SAFE_MODE | IGNORE_PATH | IGNORE_URL_WIN | REPORT_ERRORS, NULL);
 	if (stream == NULL) {
 		RETURN_FALSE;
@@ -2421,6 +2427,10 @@
 			return;
 		}
 	}
+	if (strlen(file) != file_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
 
 	stream = php_stream_open_wrapper(file, "rb", ENFORCE_SAFE_MODE|REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL);
 	if (stream == NULL)	{
@@ -4023,6 +4033,11 @@
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
 		return;
 	}
+	
+	if (strlen(file) != file_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
 
 #ifdef PHP_WIN32
 	if (VCWD_STAT(file, &st) < 0) {
@@ -4131,6 +4146,11 @@
 		return;
 	}
 
+	if (strlen(enc) != enc_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
+
 	ZEND_FETCH_RESOURCE(f_ind, int *, &fnt, -1, "Type 1 font", le_ps_font);
 
 	if ((enc_vector = T1_LoadEncoding(enc)) == NULL) {
Index: ext/hash/hash.c
===================================================================
--- ext/hash/hash.c.orig	2012-09-12 23:27:16.000000000 +0200
+++ ext/hash/hash.c	2015-06-22 15:09:30.204761176 +0200
@@ -136,6 +136,10 @@
 		RETURN_FALSE;
 	}
 	if (isfilename) {
+		if (strlen(data) != data_len) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+			RETURN_FALSE;
+		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS | ENFORCE_SAFE_MODE, NULL, DEFAULT_CONTEXT);
 		if (!stream) {
 			/* Stream will report errors opening file */
@@ -214,6 +218,10 @@
 		RETURN_FALSE;
 	}
 	if (isfilename) {
+		if (strlen(data) != data_len) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+			RETURN_FALSE;
+		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS | ENFORCE_SAFE_MODE, NULL, DEFAULT_CONTEXT);
 		if (!stream) {
 			/* Stream will report errors opening file */
@@ -445,6 +453,11 @@
 		return;
 	}
 
+	if (strlen(filename) != filename_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;	
+	}
+
 	ZEND_FETCH_RESOURCE(hash, php_hash_data*, &zhash, -1, PHP_HASH_RESNAME, php_hash_le_hash);
 	context = php_stream_context_from_zval(zcontext, 0);
 
Index: ext/pgsql/pgsql.c
===================================================================
--- ext/pgsql/pgsql.c.orig	2015-06-19 12:27:58.721675691 +0200
+++ ext/pgsql/pgsql.c	2015-06-22 15:19:07.410444695 +0200
@@ -2873,6 +2873,11 @@
 		return;
 	}
 
+	if (strlen(z_filename) != z_filename_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
+
 	if (argc < 3) {
 		CHECK_DEFAULT_LINK(id);
 	}		
Index: ext/standard/streamsfuncs.c
===================================================================
--- ext/standard/streamsfuncs.c.orig	2012-09-12 23:27:16.000000000 +0200
+++ ext/standard/streamsfuncs.c	2015-06-22 15:22:40.243187907 +0200
@@ -1495,6 +1495,11 @@
 		return;
 	}
 
+	if (strlen(filename) != filename_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
+
 	resolved_path = zend_resolve_path(filename, filename_len TSRMLS_CC);
 
 	if (resolved_path) {
Index: ext/xmlwriter/php_xmlwriter.c
===================================================================
--- ext/xmlwriter/php_xmlwriter.c.orig	2012-09-12 23:27:16.000000000 +0200
+++ ext/xmlwriter/php_xmlwriter.c	2015-06-22 15:24:32.917639771 +0200
@@ -1764,6 +1764,11 @@
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &source, &source_len) == FAILURE) {
 		return;
 	}
+
+	if (strlen(source) != source_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
 	
 #ifdef ZEND_ENGINE_2
 	if (this) {
Index: ext/zlib/zlib.c
===================================================================
--- ext/zlib/zlib.c.orig	2012-09-12 23:27:16.000000000 +0200
+++ ext/zlib/zlib.c	2015-06-22 15:35:08.451948741 +0200
@@ -445,6 +445,11 @@
 		return;
 	}
 
+	if (strlen(filename) != filename_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
+
 	use_include_path = flags ? USE_PATH : 0;
 
 	stream = php_stream_gzopen(NULL, filename, mode, use_include_path | ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL, NULL STREAMS_CC TSRMLS_CC);
@@ -474,6 +479,11 @@
 		return;
 	}
 
+	if (strlen(filename) != filename_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		RETURN_FALSE;
+	}
+
 	use_include_path = flags ? USE_PATH : 0;
 
 	stream = php_stream_gzopen(NULL, filename, "rb", use_include_path | ENFORCE_SAFE_MODE, NULL, NULL STREAMS_CC TSRMLS_CC);
