ftp: fix the 213 scanner memchr buffer limit argument

Reported-by: Joshua Rogers
Closes #18867

diff --git a/lib/ftp.c b/lib/ftp.c
index a3194c2a7b37a42dcc64673d8f32cd0e7539c55d..10a61d36891c8347417ae9a1661d34e2cc06059a 100644 (file)
--- a/lib/ftp.c
+++ b/lib/ftp.c
@@ -2319,7 +2319,7 @@ static CURLcode ftp_state_size_resp(struct Curl_easy *data,
        for all the digits at the end of the response and parse only those as a
        number. */
     char *start = &buf[4];
-    const char *fdigit = memchr(start, '\r', len);
+    const char *fdigit = memchr(start, '\r', len - 4);
     if(fdigit) {
       fdigit--;
       if(*fdigit == '\n')