Public reproducer details (from [4]):
-------------------------------------
.. the php ip2long() function can be tricked to return a valid IPv4 Internet
network address instead of "-1" even if the ip address argument is not a valid
one, through the injection of some chars, ex:

<?php
 for ($i=0; $i<=255; $i++)
 {
  echo $i.":".ip2long("1.1.1.1".chr($i)."'or'a'='a'/*")."\r\n";
 }
?>

when chr($i) is chr(0), chr(9), chr(10), chr(11), chr(12), chr(13) or chr(32)

it gives the following (valid) result:

16843009

..

This issue affects the versions of the php and php53 packages, as shipped with Red Hat Enterprise Linux 5.

--

This issue affects the version of the php package, as shipped with Red Hat Enterprise Linux 6.

--

This issue affects the versions of the php package, as shipped with Fedora release of 17 and 18. Please schedule an update (once there is upstream patch available).

Created php tracking bugs for this issue

Affects: fedora-all [bug 920519]

Statement:

(none)

Since PHP 5.2.10, ip2long use "inet_pton" system function
(when available, which is the case in RHEL/Fedora).

So, with php >= 5.3, only when chr(0) returns a valid result.