Fix double free in ext/ftp data_accept() on accept failure

ext/ftp/ftp.c

@@ -1874,7 +1874,7 @@ data_accept(databuf_t *data, ftpbuf_t *ftp)
 	data->listener = -1;
 
 	if (data->fd == -1) {
-		efree(data);
+		/* data is still owned by ftp->data, the caller's data_close() frees it */
 		return NULL;
 	}
 

ext/ftp/tests/ftp_get_data_accept_timeout.phpt

@@ -0,0 +1,39 @@
+--TEST--
+ftp_get()/ftp_nb_get() fail cleanly when the active data connection is never opened
+--EXTENSIONS--
+ftp
+pcntl
+--FILE--
+<?php
+require 'server.inc';
+
+$ftp = ftp_connect('127.0.0.1', $port, 1);
+if (!$ftp) die("Couldn't connect to the server");
+
+var_dump(ftp_login($ftp, 'anonymous', 'IEUser@'));
+var_dump(ftp_pasv($ftp, false));
+
+$local_file = __DIR__ . DIRECTORY_SEPARATOR . "ftp_get_data_accept_timeout.txt";
+
+var_dump(ftp_get($ftp, $local_file, 'no_data_connection', FTP_BINARY));
+var_dump(ftp_nb_get($ftp, $local_file, 'no_data_connection', FTP_BINARY) === FTP_FAILED);
+
+ftp_close($ftp);
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . "ftp_get_data_accept_timeout.txt");
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+
+Warning: ftp_get(): %s timed out in %s on line %d
+
+Warning: ftp_get(): File status okay; about to open data connection. in %s on line %d
+bool(false)
+
+Warning: ftp_nb_get(): %s timed out in %s on line %d
+
+Warning: ftp_nb_get(): File status okay; about to open data connection. in %s on line %d
+bool(true)

ext/ftp/tests/server.inc

@@ -328,6 +328,11 @@ if ($pid) {
                 break;
             }
         }elseif (preg_match('/^RETR ([\/]*[\w\h]+)/', $buf, $matches)) {
+            if ($matches[1] === "no_data_connection") {
+                // Never open the active data connection.
+                fputs($s, "150 File status okay; about to open data connection.\r\n");
+                continue;
+            }
             if(!empty($pasv)){
                 ;
             }