make_ftp_cmd in main.c in ProFTPD prior to 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.
proftpd proftpd