aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-05-14pingpong: fix response cache memcpy overflowDaniel Stenberg
Response data for a handle with a large buffer might be cached and then used with the "closure" handle when it has a smaller buffer and then the larger cache will be copied and overflow the new smaller heap based buffer. Reported-by: Dario Weisser CVE: CVE-2018-1000300 Bug: https://curl.haxx.se/docs/adv_2018-82c2.html
2018-05-14http: restore buffer pointer when bad response-line is parsedDaniel Stenberg
... leaving the k->str could lead to buffer over-reads later on. CVE: CVE-2018-1000301 Assisted-by: Max Dymond Detected by OSS-Fuzz. Bug: https://curl.haxx.se/docs/adv_2018-b138.html Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105
2018-05-13cookies: do not take cookie name as a parameterPatrick Monnerat
RFC 6265 section 4.2.1 does not set restrictions on cookie names. This is a follow-up to commit 7f7fcd0. Also explicitly check proper syntax of cookie name/value pair. New test 1155 checks that cookie names are not reserved words. Reported-By: anshnd at github Fixes #2564 Closes #2566
2018-05-12smb: reject negative file sizesDaniel Stenberg
Assisted-by: Max Dymond Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8245
2018-05-11setup_transfer: deal with both sockets being -1Daniel Stenberg
Detected by Coverity; CID 1435559. Follow-up to f8d608f38d00. It would index the array with -1 if neither index was a socket.
2018-05-10travis: add build using NSSDaniel Stenberg
Closes #2558
2018-05-10openssl: change FILE ops to BIO opsSunny Purushe
To make builds with VS2015 work. Recent changes in VS2015 _IOB_ENTRIES handling is causing problems. This fix changes the OpenSSL backend code to use BIO functions instead of FILE I/O functions to circumvent those problems. Closes #2512
2018-05-09travis: add a build using WolfSSLDaniel Stenberg
Assisted-by: Dan Fandrich Closes #2528
2018-05-07RELEASE-NOTES: typoDaniel Stenberg
2018-05-07RELEASE-NOTES: syncedDaniel Stenberg
2018-05-05URLs: fix one more http urlDaniel Gustafsson
This file wasn't included in commit 4af40b3646d3b09 which updated all haxx.se http urls to https. The file was committed prior to that update, but may have been merged after it and hence didn't get updated. Closes #2550
2018-05-05github/lock: auto-lock closed issues after 90 days of inactivityDaniel Stenberg
2018-05-04vtls: fix missing commasDaniel Stenberg
follow-up to e66cca046cef
2018-05-04vtls: use unified "supports" bitfield member in backendsDaniel Stenberg
... instead of previous separate struct fields, to make it easier to extend and change individual backends without having to modify them all. closes #2547
2018-05-04transfer: don't unset writesockfd on setup of multiplexed connsDaniel Stenberg
Curl_setup_transfer() can be called to setup a new individual transfer over a multiplexed connection so it shouldn't unset writesockfd. Bug: #2520 Closes #2549
2018-05-04configure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.hFrank Gevaerts
They are removed from the compiler flags. This ensures that make dependency tracking will force a rebuild whenever configure --enable-debug or --enable-curldebug changes. Closes #2548
2018-05-04http: don't set the "rewind" flag when not uploading anythingDaniel Stenberg
It triggers an assert. Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8144 Closes #2546
2018-05-04travis: add an mbedtls buildDaniel Stenberg
Closes #2531
2018-05-03configure: only check for CA bundle for file-using SSL backendsDaniel Stenberg
When only building with SSL backends that don't use the CA bundle file (by default), skip the check. Fixes #2543 Fixes #2180 Closes #2545
2018-05-03ssh-libssh.c: fix left shift compiler warningDaniel Stenberg
ssh-libssh.c:2429:21: warning: result of '1 << 31' requires 33 bits to represent, but 'int' only has 32 bits [-Wshift-overflow=] 'len' will never be that big anyway so I converted the run-time check to a regular assert.
2018-05-03URL: fix ASCII dependency in strcpy_url and strlen_urlStephan Mühlstrasser
Commit 3c630f9b0af097663a64e5c875c580aa9808a92b partially reverted the changes from commit dd7521bcc1b7a6fcb53c31f9bd1192fcc884bd56 because of the problem that strcpy_url() was modified unilaterally without also modifying strlen_url(). As a consequence strcpy_url() was again depending on ASCII encoding. This change fixes strlen_url() and strcpy_url() in parallel to use a common host-encoding independent criterion for deciding whether an URL character must be %-escaped. Closes #2535
2018-05-03docs: remove extraneous commas in man pagesDenis Ollier
Closes #2544
2018-05-03RELEASE-NOTES: syncedDaniel Stenberg
2018-05-03Revert "TODO: remove configure --disable-pthreads"Daniel Stenberg
This reverts commit d5d683a97f9765bddfd964fe32e137aa6e703ed3. --disable-pthreads can be used to disable pthreads and get the threaded resolver to use the windows threading when building with mingw.
2018-05-02vtls: don't define MD5_DIGEST_LENGTH for wolfsslDaniel Stenberg
... as it defines it (too)
2018-05-02TODO: remove configure --disable-pthreadsDaniel Stenberg
2018-05-02wolfssl: Fix non-blocking connectDavid Garske
Closes https://github.com/curl/curl/pull/2542
2018-04-30CURLOPT_URL.3: add ENCODING section [ci skip]Daniel Stenberg
Feedback-by: Michael Kilburn
2018-04-30KNOWN_BUGS: Client cert with Issuer DN differs between backendsDaniel Stenberg
Closes #1411
2018-04-30KNOWN_BUGS: Passive transfer tries only one IP addressDaniel Stenberg
Closes #1508
2018-04-30KNOWN_BUGS: --upload-file . hang if delay in STDINDaniel Stenberg
Closes #2051
2018-04-30KNOWN_BUGS: Connection information when using TCP Fast OpenDaniel Stenberg
Closes #1332
2018-04-30travis: enable libssh2 on both macos and LinuxDaniel Stenberg
It seems to not be detected by default anymore (which is a bug I believe) Closes #2541
2018-04-30TODO: Support the clienthello extensionDaniel Stenberg
Closes #2299
2018-04-30TODO: CLOEXECDaniel Stenberg
Closes #2252
2018-04-29tests: provide 'manual' as a feature to optionally requireDaniel Stenberg
... and make test 1026 rely on that feature so that --disable-manual builds don't cause test failures. Reported-by: Max Dymond and Anders Roxell Fixes #2533 Closes #2540
2018-04-27CURLINFO_PROTOCOL.3: mention the existing defined namesDaniel Stenberg
2018-04-27cookies: remove unused macroDaniel Gustafsson
Commit 2bc230de63 made the macro MAX_COOKIE_LINE_TXT become unused, so remove as it's not part of the published API. Closes https://github.com/curl/curl/pull/2537
2018-04-27checksrc: force indentation of lines after an elseDaniel Gustafsson
This extends the INDENTATION case to also handle 'else' statements and require proper indentation on the following line. Also fixes the offending cases found in the codebase. Closes #2532
2018-04-26http2: fix null pointer dereference in http2_connisdeadDaniel Stenberg
This function can get called on a connection that isn't setup enough to have the 'recv_underlying' function pointer initialized so it would try to call the NULL pointer. Reported-by: Dario Weisser Follow-up to db1b2c7fe9b093f8 (never shipped in a release) Closes #2536
2018-04-26http2: get rid of another strstr()Daniel Stenberg
Follow-up to 1514c44655e12e: replace another strstr() call done on a buffer that might not be zero terminated - with a memchr() call, even if we know the substring will be found. Assisted-by: Max Dymond Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8021 Closes #2534
2018-04-26cyassl: adapt to libraries without TLS 1.0 support built-inDaniel Stenberg
WolfSSL doesn't enable it by default anymore
2018-04-26configure: provide --with-wolfssl as an alias for --with-cyasslDaniel Stenberg
2018-04-25RELEASE-NOTES: syncedDaniel Stenberg
2018-04-25os400.c: fix ASSIGNWITHINCONDITION checksrc warningsDaniel Gustafsson
All occurrences of assignment within conditional expression in os400sys.c rewritten into two steps: first assignment and then the check on the success of the assignment. Also adjust related incorrect brace positions to match project indentation style. This was spurred by seeing "if((inp = input_token))", but while in there all warnings were fixed. There should be no functional change from these changes. Closes #2525
2018-04-25cookies: ensure that we have cookies before writing jarDaniel Gustafsson
The jar should be written iff there are cookies, so ensure that we still have cookies after expiration to avoid creating an empty file. Closes #2529
2018-04-25strcpy_url: only %-encode values >= 0x80Daniel Stenberg
OSS-Fuzz detected https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8000 Broke in dd7521bcc1b7
2018-04-24mime: avoid NULL pointer dereference riskDaniel Stenberg
Coverity detected, CID 1435120 Closes #2527
2018-04-24ctype: restore character classification for non-ASCII platformsStephan Mühlstrasser
With commit 4272a0b0fc49a1ac0ceab5c4a365c9f6ab8bf8e2 curl-speficic character classification macros and functions were introduced in curl_ctype.[ch] to avoid dependencies on the locale. This broke curl on non-ASCII, e.g. EBCDIC platforms. This change restores the previous set of character classification macros when CURL_DOES_CONVERSIONS is defined. Closes #2494
2018-04-24ftplistparser: keep state between invokesDaniel Stenberg
Fixes FTP wildcard parsing when done over a number of read buffers. Regression from f786d1f14 Reported-by: wncboy on github Fixes #2445 Closes #2526
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-22 13:07:43 +0000