That code made no sense - fix it to do what was originally intended

1 files changed, 5 insertions, 4 deletions

diff --git a/main/rfc1867.c b/main/rfc1867.c
index f6cf7940e9..3e3ab8e398 100644
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -162,20 +162,21 @@ static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr T
 						SAFE_RETURN;
 					}
 					/* some other headerfield found, skip it */
-					loc = (char *) memchr(ptr, '\n', rem)+1;
+					loc = (char *) memchr(ptr, '\n', rem);
 					if (!loc) {
 						/* broken */
 						php_error(E_WARNING, "File Upload Mime headers garbled ptr: [%c%c%c%c%c]", *ptr, *(ptr + 1), *(ptr + 2), *(ptr + 3), *(ptr + 4));
 						SAFE_RETURN;
-					}
+					} else loc++;
+
 					while (*loc == ' ' || *loc == '\t') {
 						/* other field is folded, skip it */
-						loc = (char *) memchr(loc, '\n', rem-(loc-ptr))+1;
+						loc = (char *) memchr(loc, '\n', rem-(loc-ptr));
 						if (!loc) {
 							/* broken */
 							php_error(E_WARNING, "File Upload Mime headers garbled ptr: [%c%c%c%c%c]", *ptr, *(ptr + 1), *(ptr + 2), *(ptr + 3), *(ptr + 4));
 							SAFE_RETURN;
-						}
+						} else loc++;
 					}
 					rem -= (loc - ptr);
 					ptr = loc;