From 9e3c35a88e9433fcc7edae4323605025f232f0bb Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 6 Oct 2025 09:54:39 +0200
Subject: [PATCH] ftp: fix the 213 scanner memchr buffer limit argument

Reported-by: Joshua Rogers
Closes #18867
---
 lib/ftp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ftp.c b/lib/ftp.c
index a3194c2a7b..10a61d3689 100644
--- a/lib/ftp.c
+++ b/lib/ftp.c
@@ -2319,7 +2319,7 @@ static CURLcode ftp_state_size_resp(struct Curl_easy *data,
        for all the digits at the end of the response and parse only those as a
        number. */
     char *start = &buf[4];
-    const char *fdigit = memchr(start, '\r', len);
+    const char *fdigit = memchr(start, '\r', len - 4);
     if(fdigit) {
       fdigit--;
       if(*fdigit == '\n')
-- 
2.47.3