From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 5 Oct 2004 23:55:21 +0000 (+0000)
Subject: MFH: Fixed bug #30027 (Possible crash inside ftp_get()).
X-Git-Tag: php-4.3.10RC1~58
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a360086291044295151d65a0fff9aefb1c770c14;p=php

MFH: Fixed bug #30027 (Possible crash inside ftp_get()).
---

diff --git a/NEWS b/NEWS
index df4a33b6a7..1ea43b35c6 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,8 @@ PHP 4                                                                      NEWS
 - Fixed bug #30224 (Sybase date strings are sometimes not null terminated).
   (Ilia)
 - Fixed bug #30057 (did not detect IPV6 on FreeBSD 4.1). (Wez)
+- Fixed bug #30027 (Possible crash inside ftp_get()).
+  (cfield at affinitysolutions dot com
 - Fixed bug #29805 (HTTP Authentication Issues). (Uwe Schindler)
 - Fixed bug #28325 (Circular references not properly serialised). (Moriyoshi)
 - Fixed bug #27469 (serialize() objects of incomplete class). (Dmitry)
diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
index ee17f5dce0..d6bf5a95de 100644
--- a/ext/ftp/ftp.c
+++ b/ext/ftp/ftp.c
@@ -727,12 +727,12 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
 				ptr = s;
 			}
 #else 
-			while ((s = memchr(ptr, '\r', (e - ptr)))) {
+			while (e > ptr && (s = memchr(ptr, '\r', (e - ptr)))) {
 				php_stream_write(outstream, ptr, (s - ptr));
 				if (*(s + 1) == '\n') {
 					s++;
+					php_stream_putc(outstream, '\n');
 				}
-				php_stream_putc(outstream, '\n');
 				ptr = s + 1;
 			}
 #endif