Throw ValueError when a wrong flag value is provided to the second argument of scandir()

Author: alexandre-daubois

UPGRADING

@@ -142,6 +142,9 @@ PHP 8.5 UPGRADE NOTES
   . Using a printf-family function with a formatter that did not specify the
     precision previously incorrectly reset the precision instead of treating
     it as a precision of 0. See GH-18897.
+  . Passing an invalid flag value to the second argument of scandir() will now
+    throw a ValueError. Previously, it would silently use the
+    SCANDIR_SORT_DESCENDING value.
 
 ========================================
 2. New Features

ext/standard/dir.c

@@ -549,9 +549,13 @@ PHP_FUNCTION(scandir)
 		n = php_stream_scandir(dirn, &namelist, context, (void *) php_stream_dirent_alphasort);
 	} else if (flags == PHP_SCANDIR_SORT_NONE) {
 		n = php_stream_scandir(dirn, &namelist, context, NULL);
-	} else {
+	} else if (flags == PHP_SCANDIR_SORT_DESCENDING) {
 		n = php_stream_scandir(dirn, &namelist, context, (void *) php_stream_dirent_alphasortr);
-	}
+	} else {
+        zend_argument_value_error(2, "must be one of the SCANDIR_SORT_* constants");
+        RETURN_THROWS();
+    }
+
 	if (n < 0) {
 		php_error_docref(NULL, E_WARNING, "(errno %d): %s", errno, strerror(errno));
 		RETURN_FALSE;

ext/standard/tests/dir/scandir_invalid_flag.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Provide wrong flags to scandir()
+--FILE--
+<?php
+try {
+    scandir('something', -1);
+} catch (ValueError $e) {
+    echo $e->getMessage() . "\n";
+}
+?>
+--EXPECT--
+scandir(): Argument #2 ($sorting_order) must be one of the SCANDIR_SORT_* constants