Bug #12344: Handling of multiples responses in ftp client is buggy

From: at@rominet.net Operating system: FreeBSD 4.3-RELEASE PHP version: 4.0.6 PHP Bug Type: FTP related Bug description: Handling of multiples responses in ftp client is buggy When doing FTP on localhost with small files, "236 Transfer complete" response is sent in the same TCP segment as "150 Opening ...". Decoding of multiple response in same my_recv() is buggy, because buffer is shifted after numerical code compute, but ->extra data is not shifted, resulting in a timeout because response is never read. This patch fixes this problem. This patch implements too ftp_quit() properly (actual code was never called). There is also a problem if ftp_fget relating to error handling. I don't know if this fucking textarea will permit to properly insert a patch, you can get it at http://www.rominet.net/~at/php-4.0.6.ftp.patch diff -ru php-4.0.6/ext/ftp/ftp.c php-4.0.6.patched/ext/ftp/ftp.c --- php-4.0.6/ext/ftp/ftp.c Fri Nov 3 22:53:24 2000 +++ php-4.0.6.patched/ext/ftp/ftp.c Tue Jul 24 19:12:17 2001 @@ -841,6 +841,7 @@ (ftp->inbuf[2] - '0'); memmove(ftp->inbuf, ftp->inbuf + 4, FTP_BUFSIZE - 4); + if (ftp->extra) ftp->extra-=4; return 1; } diff -ru php-4.0.6/ext/ftp/php_ftp.c php-4.0.6.patched/ext/ftp/php_ftp.c --- php-4.0.6/ext/ftp/php_ftp.c Thu May 24 14:41:51 2001 +++ php-4.0.6.patched/ext/ftp/php_ftp.c Tue Jul 24 18:43:59 2001 @@ -512,7 +512,7 @@ convert_to_string(arg3); XTYPE(xtype, arg4); - if (!ftp_get(ftp, fp, Z_STRVAL_P(arg3), xtype) || ferror(fp)) { + if (!ftp_get(ftp, fp, Z_STRVAL_P(arg3), xtype)) { php_error(E_WARNING, "ftp_get: %s", ftp->inbuf); RETURN_FALSE; } @@ -847,6 +847,7 @@ { pval *arg1; int id, type; + ftpbuf_t *ftp; /* arg1 - ftp */ @@ -855,8 +856,11 @@ } id = Z_LVAL_P(arg1); - if (zend_list_find(id, &type) && type == le_ftpbuf) + if (zend_list_find(id, &type) && type == le_ftpbuf) { + FTPBUF(ftp, arg1); + ftp_quit(ftp); zend_list_delete(id); + } RETURN_TRUE; } -- Edit bug report at: http://bugs.php.net/?id=12344&edit=1