Commit df30187db98 for php

commit df30187db9808c4c68a41255b7c73d427b581b5b
Author: Daniel Scherzer <daniel.e.scherzer+phpf@gmail.com>
Date:   Mon Oct 19 12:02:55 2026 -0700

    `php_ftp_fopen_connect()`: Confirm no extra commands are smuggled in (#23856)

    Add a debug-only assertion that the parsed resource path has no remaining
    "\r\n" substrings which would separate commands. Intended as a hardening
    measure - at the moment all supported parsing backends handle included "\r\n"
    properly.

diff --git a/ext/standard/ftp_fopen_wrapper.c b/ext/standard/ftp_fopen_wrapper.c
index cf529e40085..97879a5c700 100644
--- a/ext/standard/ftp_fopen_wrapper.c
+++ b/ext/standard/ftp_fopen_wrapper.c
@@ -142,6 +142,14 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 		return NULL;
 	}

+	/* Searching for a substring is a bit expensive, and this is just a
+	 * hardening assertion to confirm php_uri_parse_to_struct() stripped any
+	 * CRLF sequence, only run in debug mode. */
+#if ZEND_DEBUG
+	char *pos = strstr(ZSTR_VAL(resource->path), "\r\n");
+	ZEND_ASSERT(pos == NULL);
+#endif
+
 	use_ssl = resource->scheme && (ZSTR_LEN(resource->scheme) > 3) && ZSTR_VAL(resource->scheme)[3] == 's';

 	/* use port 21 if one wasn't specified */