Throw ValueError when a wrong flag value is provided to the second argument of scandir() (#19373)

alexandre-daubois · web-flow · commit 168fef361ea1 · 2026-04-10T11:42:17.000+02:00
diff --git a/NEWS b/NEWS
@@ -152,6 +152,8 @@ PHP                                                                        NEWS
   . Add enum SortDirection. (timwolla)
   . pathinfo() raises a ValueError with an invalid $flags argument.
     (David Carlier)
+  . Passing an invalid flag value to the second argument of scandir() will now
+    throw a ValueError. (alexandre-daubois)
 
 - Streams:
   . Added so_keepalive, tcp_keepidle, tcp_keepintvl and tcp_keepcnt stream
diff --git a/UPGRADING b/UPGRADING
@@ -139,6 +139,8 @@ PHP 8.6 UPGRADE NOTES
 - Standard:
   . pathinfo() now raises a ValueError when an invalid $flag argument
     value is passed.
+  . scandir() now raises a ValueError when an invalid $sorting_order
+    argument value is passed.
 
 - Zip:
   . ZipArchive::extractTo now raises a TypeError for the
diff --git a/ext/standard/dir.c b/ext/standard/dir.c
@@ -588,9 +588,13 @@ PHP_FUNCTION(scandir)
 		n = php_stream_scandir(dirn, &namelist, context, (void *) php_stream_dirent_alphasort);
 	} else if (flags == PHP_SCANDIR_SORT_NONE) {
 		n = php_stream_scandir(dirn, &namelist, context, NULL);
-	} else {
+	} else if (flags == PHP_SCANDIR_SORT_DESCENDING) {
 		n = php_stream_scandir(dirn, &namelist, context, (void *) php_stream_dirent_alphasortr);
-	}
+	} else {
+		zend_argument_value_error(2, "must be one of the SCANDIR_SORT_ASCENDING, SCANDIR_SORT_DESCENDING, or SCANDIR_SORT_NONE constants");
+		RETURN_THROWS();
+    }
+
 	if (n < 0) {
 		php_error_docref(NULL, E_WARNING, "(errno %d): %s", errno, strerror(errno));
 		RETURN_FALSE;
diff --git a/ext/standard/tests/dir/scandir_invalid_flag.phpt b/ext/standard/tests/dir/scandir_invalid_flag.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Provide wrong flags to scandir()
+--FILE--
+<?php
+try {
+    scandir('something', -1);
+} catch (ValueError $e) {
+    echo $e->getMessage() . "\n";
+}
+?>
+--EXPECT--
+scandir(): Argument #2 ($sorting_order) must be one of the SCANDIR_SORT_ASCENDING, SCANDIR_SORT_DESCENDING, or SCANDIR_SORT_NONE constants
diff --git a/ext/standard/tests/dir/scandir_variation9-win32-mb.phpt b/ext/standard/tests/dir/scandir_variation9-win32-mb.phpt
diff --git a/ext/standard/tests/dir/scandir_variation9.phpt b/ext/standard/tests/dir/scandir_variation9.phpt
