Fixed bug #30027 (Possible crash inside ftp_get()).

# Patch by cfield at affinitysolutions dot com

diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
index 0615e4ba682a432fb129ecf5298866f0144f68c1..345cbc5731ec705653a328a4ea3cacc455663e25 100644 (file)
--- a/ext/ftp/ftp.c
+++ b/ext/ftp/ftp.c
@@ -860,12 +860,12 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
                                ptr = s;
                        }
 #else
-                       while ((s = memchr(ptr, '\r', (e - ptr)))) {
+                       while (e > ptr && (s = memchr(ptr, '\r', (e - ptr)))) {
                                php_stream_write(outstream, ptr, (s - ptr));
                                if (*(s + 1) == '\n') {
                                        s++;
+                                       php_stream_putc(outstream, '\n');
                                }
-                               php_stream_putc(outstream, '\n');
                                ptr = s + 1;
                        }
 #endif