So I looked into this - that code up there looks like it's corrupting the package backups made by SMF on installing a mod, because it's reading twice from the file handle but only outputting one of the two reads that it makes.
I'd personally suggest the replacement should be:
$fp = @fopen($real_file, 'rb');
while ($fp && !feof($fp))
{
$buffer = fread($fp, 16384);
if (strlen($buffer) == 0)
break;
$fwrite($output, $buffer);
}
@fclose($fp);
This way, if the file can't be opened for whatever reason (which is conceivable, if unlikely), we won't have a valid file pointer, or if the file pointer becomes invalid through EOF at the end of a read, or we have an empty read, either way we escape the loop safely. This appears to work consistently and correctly for the testing I've done.
I'm glad this was investigated a second time because in the testing of the suggested fix I've found another bug that needs fixing.