Index: php-5.3.17/ext/phar/phar.c
===================================================================
--- php-5.3.17.orig/ext/phar/phar.c
+++ php-5.3.17/ext/phar/phar.c
@@ -2277,6 +2277,11 @@ int phar_split_fname(char *filename, int
 #endif
 	int ext_len, free_filename = 0;
 
+	if (strlen(filename) != filename_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return FAILURE;
+	}
+
 	if (!strncasecmp(filename, "phar://", 7)) {
 		filename += 7;
 		filename_len -= 7;
Index: php-5.3.17/ext/phar/phar_object.c
===================================================================
--- php-5.3.17.orig/ext/phar/phar_object.c
+++ php-5.3.17/ext/phar/phar_object.c
@@ -479,6 +479,16 @@ PHP_METHOD(Phar, mount)
 		return;
 	}
 
+	if (strlen(path) != path_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
+	if (strlen(actual) != actual_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	fname = zend_get_executed_filename(TSRMLS_C);
 	fname_len = strlen(fname);
 
@@ -972,6 +982,16 @@ PHP_METHOD(Phar, createDefaultStub)
 		return;
 	}
 
+	if (strlen(index) != index_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
+	if (strlen(webindex) != webindex_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	stub = phar_create_default_stub(index, webindex, &stub_len, &error TSRMLS_CC);
 
 	if (error) {
@@ -1016,6 +1036,11 @@ PHP_METHOD(Phar, loadPhar)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	phar_request_initialize(TSRMLS_C);
 
 	RETVAL_BOOL(phar_open_from_filename(fname, fname_len, alias, alias_len, REPORT_ERRORS, NULL, &error TSRMLS_CC) == SUCCESS);
@@ -1095,6 +1120,11 @@ PHP_METHOD(Phar, isValidPharFilename)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	is_executable = executable;
 	RETVAL_BOOL(phar_detect_phar_fname_ext(fname, fname_len, &ext_str, &ext_len, is_executable, 2, 1 TSRMLS_CC) == SUCCESS);
 }
@@ -1175,6 +1205,11 @@ PHP_METHOD(Phar, __construct)
 		}
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (phar_obj->arc.archive) {
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "Cannot call constructor twice");
 		return;
@@ -1342,6 +1377,11 @@ PHP_METHOD(Phar, unlinkArchive)
 		RETURN_FALSE;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (!fname_len) {
 		zend_throw_exception_ex(phar_ce_PharException, 0 TSRMLS_CC, "Unknown phar archive \"\"");
 		return;
@@ -1827,6 +1867,11 @@ PHP_METHOD(Phar, buildFromDirectory)
 		RETURN_FALSE;
 	}
 
+	if (strlen(dir) != dir_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	MAKE_STD_ZVAL(iter);
 
 	if (SUCCESS != object_init_ex(iter, spl_ce_RecursiveDirectoryIterator)) {
@@ -2693,6 +2738,11 @@ PHP_METHOD(Phar, delete)
 		RETURN_FALSE;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (phar_obj->arc.archive->is_persistent && FAILURE == phar_copy_on_write(&(phar_obj->arc.archive) TSRMLS_CC)) {
 		zend_throw_exception_ex(phar_ce_PharException, 0 TSRMLS_CC, "phar \"%s\" is persistent, unable to copy on write", phar_obj->arc.archive->fname);
 		return;
@@ -3505,6 +3555,16 @@ PHP_METHOD(Phar, copy)
 		return;
 	}
 
+	if (strlen(oldfile) != oldfile_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
+	if (strlen(newfile) != newfile_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (PHAR_G(readonly) && !phar_obj->arc.archive->is_data) {
 		zend_throw_exception_ex(spl_ce_UnexpectedValueException, 0 TSRMLS_CC,
 			"Cannot copy \"%s\" to \"%s\", phar is read-only", oldfile, newfile);
@@ -3615,6 +3675,11 @@ PHP_METHOD(Phar, offsetExists)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (zend_hash_exists(&phar_obj->arc.archive->manifest, fname, (uint) fname_len)) {
 		if (SUCCESS == zend_hash_find(&phar_obj->arc.archive->manifest, fname, (uint) fname_len, (void**)&entry)) {
 			if (entry->is_deleted) {
@@ -3652,6 +3717,11 @@ PHP_METHOD(Phar, offsetGet)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	/* security is 0 here so that we can get a better error message than "entry doesn't exist" */
 	if (!(entry = phar_get_entry_info_dir(phar_obj->arc.archive, fname, fname_len, 1, &error, 0 TSRMLS_CC))) {
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "Entry %s does not exist%s%s", fname, error?", ":"", error?error:"");
@@ -3806,6 +3876,11 @@ PHP_METHOD(Phar, offsetSet)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (fname_len == sizeof(".phar/stub.php")-1 && !memcmp(fname, ".phar/stub.php", sizeof(".phar/stub.php")-1)) {
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "Cannot set stub \".phar/stub.php\" directly in phar \"%s\", use setStub", phar_obj->arc.archive->fname);
 		return;
@@ -3844,6 +3919,11 @@ PHP_METHOD(Phar, offsetUnset)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (zend_hash_exists(&phar_obj->arc.archive->manifest, fname, (uint) fname_len)) {
 		if (SUCCESS == zend_hash_find(&phar_obj->arc.archive->manifest, fname, (uint) fname_len, (void**)&entry)) {
 			if (entry->is_deleted) {
@@ -3891,6 +3971,11 @@ PHP_METHOD(Phar, addEmptyDir)
 		return;
 	}
 
+	if (strlen(dirname) != dirname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (dirname_len >= sizeof(".phar")-1 && !memcmp(dirname, ".phar", sizeof(".phar")-1)) {
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "Cannot create a directory in magic \".phar\" directory");
 		return;
@@ -3916,6 +4001,11 @@ PHP_METHOD(Phar, addFile)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 #if PHP_API_VERSION < 20100412
 	if (PG(safe_mode) && (!php_checkuid(fname, NULL, CHECKUID_ALLOW_ONLY_FILE))) {
 		zend_throw_exception_ex(spl_ce_RuntimeException, 0 TSRMLS_CC, "phar error: unable to open file \"%s\" to add to phar archive, safe_mode restrictions prevent this", fname);
@@ -3960,6 +4050,11 @@ PHP_METHOD(Phar, addFromString)
 		return;
 	}
 
+	if (strlen(localname) != localname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	phar_add_file(&(phar_obj->arc.archive), localname, localname_len, cont_str, cont_len, NULL TSRMLS_CC);
 }
 /* }}} */
@@ -4386,6 +4481,11 @@ PHP_METHOD(Phar, extractTo)
 		return;
 	}
 
+	if (strlen(pathto) != pathto_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	fp = php_stream_open_wrapper(phar_obj->arc.archive->fname, "rb", IGNORE_URL|STREAM_MUST_SEEK, &actual);
 
 	if (!fp) {
@@ -4535,6 +4635,11 @@ PHP_METHOD(PharFileInfo, __construct)
 		return;
 	}
 
+	if (strlen(fname) != fname_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+		return;
+	}
+
 	entry_obj = (phar_entry_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 
 	if (entry_obj->ent.entry) {
