improve fix for Bug #69545

smalyshev · smalyshev · commit 0765623d6991 · 2015-05-31T17:29:00.000-07:00
diff --git a/NEWS b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2015 PHP 5.4.42
 
+- Core:
+  . Imroved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in
+    heap overflow). (Max Spelsberg)
+
 - Postgres:
   . Fixed bug #69667 (segfault in php_pgsql_meta_data). (Remi)
 
diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
@@ -1668,8 +1668,6 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 		for (ptr = data->buf; rcvd; rcvd--, ptr++) {
 			if (*ptr == '\n' && lastch == '\r') {
 				lines++;
-			} else {
-				size++;
 			}
 			lastch = *ptr;
 		}

Original file line number	Diff line number	Diff line change
`@@ -1668,8 +1668,6 @@ ftp_genlist(ftpbuf_t ftp, const char cmd, const char *path TSRMLS_DC)`
`1668`	`1668`	`for (ptr = data->buf; rcvd; rcvd--, ptr++) {`
`1669`	`1669`	`if (*ptr == '\n' && lastch == '\r') {`
`1670`	`1670`	`lines++;`
`1671`		`- } else {`
`1672`		`- size++;`
`1673`	`1671`	`}`
`1674`	`1672`	`lastch = *ptr;`
`1675`	`1673`	`}`