ftp: avoid accessing EPSV response one byte past the NULL

If the response is just a single "(".

Reported-by: Andrew Nesbit
Closes #21545

diff --git a/lib/ftp.c b/lib/ftp.c
index 17cedb335398172b44694a9d21dc917601b97836..3f55f68d8287c3a3471c10ffc510467903067757 100644 (file)
--- a/lib/ftp.c
+++ b/lib/ftp.c
@@ -2073,7 +2073,7 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
       ptr++;
       /* |||12345| */
       sep = ptr[0];
-      if((ptr[1] == sep) && (ptr[2] == sep) && ISDIGIT(ptr[3])) {
+      if(sep && (ptr[1] == sep) && (ptr[2] == sep) && ISDIGIT(ptr[3])) {
         const char *p = &ptr[3];
         curl_off_t num;
         if(curlx_str_number(&p, &num, 0xffff) || (*p != sep)) {