aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-09-22RELEASE-NOTES: syncedDaniel Stenberg
2019-09-22openssl: fix compiler warning with LibreSSLMarcel Raad
It was already fixed for BoringSSL in commit a0f8fccb1e0. LibreSSL has had the second argument to SSL_CTX_set_min_proto_version as uint16_t ever since the function was added in [0]. [0] https://github.com/libressl-portable/openbsd/commit/56f107201baefb5533486d665a58d8f57fd3aeda Closes https://github.com/curl/curl/pull/4397
2019-09-22curl: exit the create_transfers loop on errorsDaniel Stenberg
When looping around the ranges and given URLs to create transfers, all errors should exit the loop and return. Previously it would keep looping. Reported-by: SumatraPeter on github Bug: #4393 Closes #4396
2019-09-21socks: Fix destination host shown on SOCKS5 errorJay Satiro
Prior to this change when a server returned a socks5 connect error then curl would parse the destination address:port from that data and show it to the user as the destination: curld -v --socks5 10.0.3.1:1080 http://google.com:99 * SOCKS5 communication to google.com:99 * SOCKS5 connect to IPv4 172.217.12.206 (locally resolved) * Can't complete SOCKS5 connection to 253.127.0.0:26673. (1) curl: (7) Can't complete SOCKS5 connection to 253.127.0.0:26673. (1) That's incorrect because the address:port included in the connect error is actually a bind address:port (typically unused) and not the destination address:port. This fix changes curl to show the destination information that curl sent to the server instead: curld -v --socks5 10.0.3.1:1080 http://google.com:99 * SOCKS5 communication to google.com:99 * SOCKS5 connect to IPv4 172.217.7.14:99 (locally resolved) * Can't complete SOCKS5 connection to 172.217.7.14:99. (1) curl: (7) Can't complete SOCKS5 connection to 172.217.7.14:99. (1) curld -v --socks5-hostname 10.0.3.1:1080 http://google.com:99 * SOCKS5 communication to google.com:99 * SOCKS5 connect to google.com:99 (remotely resolved) * Can't complete SOCKS5 connection to google.com:99. (1) curl: (7) Can't complete SOCKS5 connection to google.com:99. (1) Ref: https://tools.ietf.org/html/rfc1928#section-6 Closes https://github.com/curl/curl/pull/4394
2019-09-21travis: enable ngtcp2 h3-23 buildsDaniel Stenberg
2019-09-21altsvc: both backends run h3-23 nowDaniel Stenberg
Closes #4395
2019-09-21http: fix warning on conversion from int to bitDaniel Stenberg
Follow-up from 03ebe66d70
2019-09-21urldata: use 'bool' for the bit type on MSVC compilersDaniel Stenberg
Closes #4387 Fixes #4379
2019-09-21appveyor: upgrade VS2017 to VS2019Daniel Stenberg
Closes #4383
2019-09-21FTP: FTPFILE_NOCWD: avoid redundant CWDsZenju
Closes #4382
2019-09-21cookie: pass in the correct cookie amount to qsort()Daniel Stenberg
As the loop discards cookies without domain set. This bug would lead to qsort() trying to sort uninitialized pointers. We have however not found it a security problem. Reported-by: Paul Dreik Closes #4386
2019-09-21urlapi: avoid index underflow for short ipv6 hostnamesPaul Dreik
If the input hostname is "[", hlen will underflow to max of size_t when it is subtracted with 2. hostname[hlen] will then cause a warning by ubsanitizer: runtime error: addition of unsigned offset to 0x<snip> overflowed to 0x<snip> I think that in practice, the generated code will work, and the output of hostname[hlen] will be the first character "[". This can be demonstrated by the following program (tested in both clang and gcc, with -O3) int main() { char* hostname=strdup("["); size_t hlen = strlen(hostname); hlen-=2; hostname++; printf("character is %d\n",+hostname[hlen]); free(hostname-1); } I found this through fuzzing, and even if it seems harmless, the proper thing is to return early with an error. Closes #4389
2019-09-21ngtcp2: compile with latest ngtcp2 + nghttp3 draft-23Tatsuhiro Tsujikawa
Closes #4392
2019-09-20THANKS-filter: deal with my typos 'Jat' => 'Jay'Daniel Stenberg
2019-09-20travis: use go masterDaniel Stenberg
... as the boringssl builds needs a very recent version Co-authored-by: Jat Satiro Closes #4361
2019-09-20tool_operate: removed unused variable 'done'Daniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20tool_operate: Expression 'config->resume_from' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20tool_getparam: remove duplicate switch caseDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20libssh2: part of conditional expression is always true: !resultDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20urlapi: Expression 'storep' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20urlapi: 'scheme' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20urlapi: part of conditional expression is always true: (relurl[0] == '/')Daniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20setopt: store CURLOPT_RTSP_SERVER_CSEQ correctlyDaniel Stenberg
Fixes bug detected by PVS-Studio Fixes #4374
2019-09-20mime: make Curl_mime_duppart() assert if called without valid dstDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20http_proxy: part of conditional expression is always true: !errorDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20imap: merged two case-branches performing the same actionDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20multi: value '2L' is assigned to a booleanDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20easy: part of conditional expression is always true: !resultDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20netrc: part of conditional expression is always true: !doneDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20version: Expression 'left > 1' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20url: remove dead codeDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20url: part of expression is always true: (bundle->multiuse == 0)Daniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: the conditional expression is always trueDaniel Stenberg
... both !result and (ftp->transfer != FTPTRANSFER_BODY)! Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: Expression 'ftpc->wait_data_conn' is always falseDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: Expression 'ftpc->wait_data_conn' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: part of conditional expression is always true: !resultDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20http: fix Expression 'http->postdata' is always falseDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374 Reported-by: Valerii Zapodovnikov
2019-09-19doh: avoid truncating DNS QTYPE to lower octetNiall O'Reilly
Closes #4381
2019-09-19urlapi: CURLU_NO_AUTHORITY allows empty authority/host partJens Finkhaeuser
CURLU_NO_AUTHORITY is intended for use with unknown schemes (i.e. not "file:///") to override cURL's default demand that an authority exists. Closes #4349
2019-09-19version: next release will be 7.67.0Daniel Stenberg
2019-09-19RELEASE-NOTES: syncedDaniel Stenberg
2019-09-19url: only reuse TLS connections with matching pinningDaniel Stenberg
If the requests have different CURLOPT_PINNEDPUBLICKEY strings set, the connection should not be reused. Bug: https://curl.haxx.se/mail/lib-2019-09/0061.html Reported-by: Sebastian Haglund Closes #4347
2019-09-19README: add OSS-Fuzz badge [skip ci]Daniel Stenberg
Closes #4380
2019-09-18http: merge two "case" statementsMichael Kaufmann
2019-09-18FTP: remove trailing slash from path for LIST/MLSDZenju
Closes #4348
2019-09-18mime: when disabled, avoid C99 macroDaniel Stenberg
Closes #4368
2019-09-18url: cleanup dangling DOH request headers tooDaniel Stenberg
Follow-up to 9bc44ff64d9081 Credit to OSS-Fuzz Bug: https://crbug.com/oss-fuzz/17269 Closes #4372
2019-09-16http2: relax verification of :authority in push promise requestsChristoph M. Becker
If the :authority pseudo header field doesn't contain an explicit port, we assume it is valid for the default port, instead of rejecting the request for all ports. Ref: https://curl.haxx.se/mail/lib-2019-09/0041.html Closes #4365
2019-09-16doh: clean up dangling DOH handles and memory on easy closeDaniel Stenberg
If you set the same URL for target as for DoH (and it isn't a DoH server), like "https://example.com" in both, the easy handles used for the DoH requests could be left "dangling" and end up not getting freed. Reported-by: Paul Dreik Closes #4366
2019-09-16unit1655: make it C90 compliantDaniel Stenberg
Unclear why this was not detected in the CI. Follow-up to b7666027296a
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-07 21:53:38 +0000