MFH: Fixed bug #30027 (Possible crash inside ftp_get()).

diff --git a/NEWS b/NEWS
index df4a33b6a72c908811e5020575473d94c20887d8..1ea43b35c60464c9d956df6f72141bfef9805b71 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,8 @@ PHP 4                                                                      NEWS
 - Fixed bug #30224 (Sybase date strings are sometimes not null terminated).
   (Ilia)
 - Fixed bug #30057 (did not detect IPV6 on FreeBSD 4.1). (Wez)
+- Fixed bug #30027 (Possible crash inside ftp_get()).
+  (cfield at affinitysolutions dot com
 - Fixed bug #29805 (HTTP Authentication Issues). (Uwe Schindler)
 - Fixed bug #28325 (Circular references not properly serialised). (Moriyoshi)
 - Fixed bug #27469 (serialize() objects of incomplete class). (Dmitry)

diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
index ee17f5dce0ba5b568f23ca7e12d9d0d6596b4a4b..d6bf5a95de0a9eb9caf0db3851a4d18c9ce070e2 100644 (file)
--- a/ext/ftp/ftp.c
+++ b/ext/ftp/ftp.c
@@ -727,12 +727,12 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
                                ptr = s;
                        }
 #else 
-                       while ((s = memchr(ptr, '\r', (e - ptr)))) {
+                       while (e > ptr && (s = memchr(ptr, '\r', (e - ptr)))) {
                                php_stream_write(outstream, ptr, (s - ptr));
                                if (*(s + 1) == '\n') {
                                        s++;
+                                       php_stream_putc(outstream, '\n');
                                }
-                               php_stream_putc(outstream, '\n');
                                ptr = s + 1;
                        }
 #endif