Commit 4ffcce53bb3 for php

commit 4ffcce53bb32806fbebcfe0a827a182567d4b04b
Merge: 4f2302adc3f eab8f9c4fdd
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Tue Nov 3 08:24:56 2026 +0100

    Merge branch 'PHP-8.6'

    * PHP-8.6:
      Fix out-of-bounds reads parsing ftp:// wrapper server replies

diff --cc ext/ftp/tests/server.inc
index ac467428d0e,f5e5b1dec97..4a4ee958fc6
--- a/ext/ftp/tests/server.inc
+++ b/ext/ftp/tests/server.inc
@@@ -393,8 -422,14 +393,12 @@@ if ($pid)
                      fputs($s, "550 {$matches[1]}: No such file or directory \r\n");
                      break;
              }
 -            if(isset($fs))
 -                fclose($fs);


+         }elseif (preg_match('/^PASV/', $buf, $matches) && isset($pasv_reply_at_buffer_end)) {
+             // The address ends at the 510th byte and the port is cut off.
+             fputs($s, "227 " . str_repeat("x", 496) . "127,0,0,1,4,210)\r\n");
+
          }elseif (preg_match('/^PASV/', $buf, $matches)) {
              $pasv=true;
              $host = "127.0.0.1";
@@@ -497,19 -566,42 +501,26 @@@
                  continue;
              }

 -            if(empty($pasv)) {
 -                fputs($s, "150 File status okay; about to open data connection\r\n");
 -                if(!$fs = stream_socket_client("tcp://$host:$port")) {
 -                    fputs($s, "425 Can't open data connection\r\n");
 -                    continue;
 +            with_data_connection(function ($fs) use ($m) {
 +                if(empty($m[1]) || $m[1] !== 'emptydir') {
 +                    fputs($fs, "modify=20170127230002;perm=flcdmpe;type=cdir;unique=811U4340002;UNIX.group=33;UNIX.mode=0755;UNIX.owner=33; .\r\n");
 +                    fputs($fs, "modify=20170127230002;perm=flcdmpe;type=pdir;unique=811U4340002;UNIX.group=33;UNIX.mode=0755;UNIX.owner=33; ..\r\n");
 +                    fputs($fs, "modify=20170126121225;perm=adfrw;size=4729;type=file;unique=811U4340CB9;UNIX.group=33;UNIX.mode=0644;UNIX.owner=33; foobar\r\n");
 +                    fputs($fs, "fact=val=ue;empty=; path;name\r\n");
 +                    fputs($fs, "no_space\r\n");
 +                    fputs($fs, "no_semi pathname\r\n");
 +                    fputs($fs, "no_eq; pathname\r\n");
                  }
 -            } else {
 -                fputs($s, "125 Data connection already open; transfer starting.\r\n");
 -                $fs = $pasvs;
 -            }
 -
 -            if((!empty($ssl)) && (!stream_socket_enable_crypto($pasvs, TRUE, STREAM_CRYPTO_METHOD_SSLv23_SERVER))) {
 -                die("SSLv23 handshake failed.\n");
 -            }
 -
 -            if(empty($m[1]) || $m[1] !== 'emptydir') {
 -                fputs($fs, "modify=20170127230002;perm=flcdmpe;type=cdir;unique=811U4340002;UNIX.group=33;UNIX.mode=0755;UNIX.owner=33; .\r\n");
 -                fputs($fs, "modify=20170127230002;perm=flcdmpe;type=pdir;unique=811U4340002;UNIX.group=33;UNIX.mode=0755;UNIX.owner=33; ..\r\n");
 -                fputs($fs, "modify=20170126121225;perm=adfrw;size=4729;type=file;unique=811U4340CB9;UNIX.group=33;UNIX.mode=0644;UNIX.owner=33; foobar\r\n");
 -                fputs($fs, "fact=val=ue;empty=; path;name\r\n");
 -                fputs($fs, "no_space\r\n");
 -                fputs($fs, "no_semi pathname\r\n");
 -                fputs($fs, "no_eq; pathname\r\n");
 -            }
 -
 -            fputs($s, "226 Closing data Connection.\r\n");
 -            fclose($fs);
 +            });
          }elseif (preg_match('/^SIZE \/bug73457/', $buf)) {
              fputs($s, "213 10\r\n");
+         }elseif (preg_match('/^SIZE \/pasvbufferend/', $buf)) {
+             fputs($s, "213 10\r\n");
+         }elseif (preg_match('/^SIZE \/mdtmnodigits/', $buf)) {
+             // A longer line with digits, read into the same buffer before MDTM.
+             fputs($s, "213 10 bytes (19991005213102)\r\n");
+         }elseif (preg_match('/^MDTM \/mdtmnodigits/', $buf)) {
+             fputs($s, "213 unknown\r\n");
          }elseif (preg_match("/^SITE/", $buf)) {
              fputs($s, "500 Syntax error, command unrecognized.\r\n");
          }else {