MFH: Fixed bug #30027 (Possible crash inside ftp_get()).

diff --git a/NEWS b/NEWS
index 9738f203023a827ec4e94e760a1ac6e42afad18b..48f74f14deb5393f0e4cc228101c80ee4a75b8e9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,8 @@ PHP                                                                        NEWS
 - Fixed bug #30147 (OO sqlite_fetch_object did not reset error handler). (Wez)
 - Fixed bug #30133 (get_current_user() crashes on Windows). (Edin)
 - Fixed bug #30057 (did not detect IPV6 on FreeBSD 4.1). (Wez)
+- Fixed bug #30027 (Possible crash inside ftp_get()).
+  (cfield at affinitysolutions dot com)
 - Fixed bug #27798 (private / protected variables not exposed by 
   get_object_vars() inside class). (Marcus)
 

diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
index 8e5e746e0d11bf060e32e2bf127930480d3d06bd..dd686682b1272bac210f0339f2f66690e3626c18 100644 (file)
--- a/ext/ftp/ftp.c
+++ b/ext/ftp/ftp.c
@@ -864,12 +864,12 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
                                ptr = s;
                        }
 #else
-                       while ((s = memchr(ptr, '\r', (e - ptr)))) {
+                       while (e > ptr && (s = memchr(ptr, '\r', (e - ptr)))) {
                                php_stream_write(outstream, ptr, (s - ptr));
                                if (*(s + 1) == '\n') {
                                        s++;
+                                       php_stream_putc(outstream, '\n');
                                }
-                               php_stream_putc(outstream, '\n');
                                ptr = s + 1;
                        }
 #endif