Age | Commit message (Collapse) | Author |
|
Follow-up to 84fcaa2e7. libressl does not have the API even if it says it is
late OpenSSL version...
Fixes #2246
Closes #2247
Reported-by: jungle-boogie on github
|
|
|
|
... to avoid excessive recursive calls. The number 5 is totally
arbitrary and could be modified if someone has a good motivation.
|
|
.... and avoid advancing the pointer to trigger an out of buffer read.
Detected by OSS-fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5251
Assisted-by: Max Dymond
|
|
1. don't use "ULL" suffix since unsupported in older MSVC
2. use curl_off_t instead of custom long long ifdefs
3. make get_posix_time() not do unaligned data access
Fixes #2211
Closes #2240
Reported-by: Chester Liu
|
|
Closes #2239
|
|
Follow-up commit to 615edc1f73 which was incomplete.
Assisted-by: Max Dymond
Detected by OSS-fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5206
|
|
Fixes #2210
Closes #2236
|
|
A mime tree attached to an easy handle using CURLOPT_MIMEPOST is
strongly bound to the handle: there is a pointer to the easy handle in
each item of the mime tree and following the parent pointer list
of mime items ends in a dummy part stored within the handle.
Because of this binding, a mime tree cannot be shared between different
easy handles, thus it needs to be cloned upon easy handle duplication.
There is no way for the caller to get the duplicated mime tree
handle: it is then set to be automatically destroyed upon freeing the
new easy handle.
New test 654 checks proper mime structure duplication/release.
Add a warning note in curl_mime_data_cb() documentation about sharing
user data between duplicated handles.
Closes #2235
|
|
|
|
|
|
|
|
|
|
... and make the max filesize check trigger if the value is too big.
Updates test 178.
Reported-by: Brad Spencer
Fixes #2212
Closes #2223
|
|
Link order should list libraries after the libraries that use them,
so when we're guessing that we might also need to add -ldl in order
to use -lssl, we should add -ldl after -lssl.
Closes https://github.com/curl/curl/pull/2234
|
|
|
|
Broken since f121575 (precedes 7.56.1).
Bug: https://github.com/curl/curl/issues/2225
Reported-by: cmfrolick@users.noreply.github.com
Closes https://github.com/curl/curl/pull/2227
|
|
This also upgrades ILE/RPG bindings with latest setopt options.
Reported-By: jonrumsey on github
Fixes #2230
Closes #2233
|
|
Prior to this change the stored byte count of each trailer was
miscalculated and 1 less than required. It appears any trailer
after the first that was passed to Curl_client_write would be truncated
or corrupted as well as the size. Potentially the size of some
subsequent trailer could be erroneously extracted from the contents of
that trailer, and since that size is used by client write an
out-of-bounds read could occur and cause a crash or be otherwise
processed by client write.
The bug appears to have been born in 0761a51 (precedes 7.49.0).
Closes https://github.com/curl/curl/pull/2231
|
|
Before calling Curl_client_chop_write(), change the owner of connection
to the current Curl_easy handle. This will fix the issue #2217.
Fixes https://github.com/curl/curl/issues/2217
Closes https://github.com/curl/curl/pull/2221
|
|
__SIZEOF_LONG__ was introduced in GCC 4.4, __LONG_MAX__ was introduced
in GCC 3.3.
Closes #2216
|
|
|
|
to increase accuracy for quick transfers
Fixes #2200
Closes #2206
|
|
- Enable execute permission (chmod +x)
- Change interpreter to /usr/bin/env perl
Closes https://github.com/curl/curl/pull/2222
|
|
|
|
.. because limits.h presence isn't optional, it's required by C89.
Ref: http://port70.net/~nsz/c/c89/c89-draft.html#2.2.4.2
Closes https://github.com/curl/curl/pull/2215
|
|
- Free the copy of SSLKEYLOGFILE env returned by curl_getenv during ossl
initialization.
Caught by ASAN.
|
|
This reverts commit c97648b55080343bb371522bf4233e94a2a13a99.
SIZEOF_LONG should not be checked in system.h since that macro is only
defined when building libcurl.
Ref: https://github.com/curl/curl/pull/2186#issuecomment-354767080
Ref: https://gcc.gnu.org/onlinedocs/cpp/Common-Predefined-Macros.html
|
|
|
|
|
|
Reported-by: Pete Lomax
Bug: https://curl.haxx.se/mail/lib-2017-12/0074.html
|
|
Decoding loop implementation did not concern the case when all
received data is consumed by Brotli decoder and the size of decoded
data internally hold by Brotli decoder is greater than CURL_MAX_WRITE_SIZE.
For content with unencoded length greater than CURL_MAX_WRITE_SIZE this
can result in the loss of data at the end of content.
Closes #2194
|
|
- Ignore X509_R_CERT_ALREADY_IN_HASH_TABLE errors in the CTX callback
since it's possible the cert may have already been loaded by libcurl.
- Remove the EXAMPLE code in the CURLOPT_SSL_CTX_FUNCTION.3 doc.
Instead have it direct the reader to this cacertinmem.c example.
- Fix the CA certificate to use the right CA for example.com, Digicert.
Bug: https://curl.haxx.se/mail/lib-2017-12/0057.html
Reported-by: Thomas van Hesteren
Closes https://github.com/curl/curl/pull/2182
|
|
- Move the size modifier detection code from limit-rate to its own
function so that it can also be used with max-filesize.
Size modifiers are the suffixes such as G (gigabyte), M (megabyte) etc.
For example --max-filesize 1G
Ref: https://curl.haxx.se/mail/archive-2017-12/0000.html
Closes https://github.com/curl/curl/pull/2179
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Closes https://github.com/curl/curl/pull/2186
|
|
Closes https://github.com/curl/curl/pull/2185
|
|
Move curl_mime_initpart() and curl_mime_cleanpart() calls to lower-level
functions dealing with UserDefined structure contents.
This avoids memory leakages on curl-generated part mime headers.
New test 2073 checks this using the cli tool --next option: it
triggers a valgrind error if bug is present.
Bug: https://curl.haxx.se/mail/lib-2017-12/0060.html
Reported-by: Martin Galvan
|
|
- When zlib version is < 1.2.0.4, process gzip trailer before considering
extra data as an error.
- Inflate with Z_BLOCK instead of Z_SYNC_FLUSH to maximize correct data
and minimize corrupt data output.
- Do not try to restart deflate decompression in raw mode if output has
started or if the leading data is not available anymore.
- New test 232 checks inflating raw-deflated content.
Closes #2068
|
|
Some error codes were not yet defined in brotli 0.6.0: do not issue code
for them in this case.
|
|
Bug: #2175
[ci skip]
|
|
scan-build would warn on a potential access of an uninitialized
buffer. I deem it a false positive and had to add this somewhat ugly
work-around to silence it.
|
|
A scan-build warning.
|
|
This broke in 07cb27c98e. Make sure to return 'result' properly. Pointed
out by scan-build!
|
|
Bug: #2174
|