Description:
------------
Here's the bug. If someone wants to deliver a forced file download, in this case a zip file, and if they use php's output buffer along with the header("Content-length:"), readfile() - if there is any other content output in the output buffer, the file will download but it will not open because of an error with the length. If you remove the length line, the file will download, but the browser doesn't know how big the file is, which is bad for the user. The included code will illustrate this error. If you remove the echo message, the file will download without error.

Reproduce code:
---------------
<?php
ob_start();
echo 'message here';

$source = '../pathtofile/file.zip';

$pr_file_name ='downloadtest.zip';
$length = filesize($source);
     header('Pragma: private');
     header('Cache-control: private, must-revalidate');
     header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");     
     
     header("Content-type: application/zip");
     header("Content-Transfer-Encoding: Binary");
     header("Accept-Ranges: bytes");
     header("Content-length: $length");
    
     header("Content-disposition: attachment;
     filename=".$pr_file_name);    
     
     
     readfile($source);
ob_end_flush();
?>

Expected result:
----------------
I expect the file to be delivered without error!

Actual result:
--------------
File downloads, but won't open due to length error.