| Age | Commit message (Collapse) | Author |
|---|
|
|
|
Regression introduced in 5f5b62635 (released in 7.48.0)
Reported-by: Fabian Ruff
Fixes #875
|
|
|
|
|
|
|
|
Bug: https://github.com/curl/curl/pull/874
Reported-by: Sergei Nikulov
|
|
When CURLOPT_POSTFIELDS is set to an empty string libcurl will send a
zero-byte POST. Prior to this change it was documented as sending data
from the read callback.
This also changes the wording of what happens when empty or NULL so that
it's hopefully easier to understand for people whose primary language
isn't English.
Bug: https://github.com/curl/curl/issues/862
Reported-by: Askar Safin
|
|
- Remove some erroneous text.
Closes https://github.com/curl/curl/pull/865
|
|
- Enable protocol family logic for IPv6 resolves even when support
for synthesized addresses is enabled.
This is a follow up to the parent commit that added support for
synthesized IPv6 addresses from IPv4 on iOS/OS X. The protocol family
logic needed for IPv6 was inadvertently excluded if support for
synthesized addresses was enabled.
Bug: https://github.com/curl/curl/issues/863
Ref: https://github.com/curl/curl/pull/866
Ref: https://github.com/curl/curl/pull/867
|
|
Use getaddrinfo() to resolve the IPv4 address literal on iOS/Mac OS X.
If the current network interface doesn’t support IPv4, but supports
IPv6, NAT64, and DNS64.
Closes #866
Fixes #863
|
|
1701 and 1702
|
|
|
|
... and have test 1700 use that to strip out the nghttpx server: headers
|
|
It requires that 'nghttpx' is in the PATH, and it will run the tests
using nghttpx as a front-end proxy in front of the standard HTTP/1 test
server. This uses HTTP/2 over plain TCP.
If you like me have nghttpx installed in a custom path, you can run test 1700
like this:
$ PATH=$PATH:$HOME/build-nghttp2/bin/ ./runtests.pl 1700
|
|
|
|
Calling QueryContextAttributes with SECPKG_ATTR_APPLICATION_PROTOCOL
fails on Windows < 8.1 so we need to disable ALPN on these OS versions.
Inspiration provide by: Daniel Seither
Closes #848
Fixes #840
|
|
LoadLibrary was supplanted by Curl_load_library for security
reasons in 6df916d.
|
|
- Change the parser to not require a minor version for HTTP/2.
HTTP/2 connection reuse broke when we changed from HTTP/2.0 to HTTP/2
in 8243a95 because the parser still expected a minor version.
Bug: https://github.com/curl/curl/issues/855
Reported-by: Andrew Robbins, Frank Gevaerts
|
|
connect.c:952:5: warning: suggest explicit braces to avoid ambiguous 'else'
|
|
Closes #845
|
|
|
|
|
|
... causing SIGSEGV while parsing URL with too many globs.
Minimal example:
$ curl $(for i in $(seq 101); do printf '{a}'; done)
Reported-by: Romain Coltel
Bug: https://bugzilla.redhat.com/1340757
|
|
Closes #850
|
|
Dependency added by 6cabd78
Closes #849
|
|
Sessionid cache management is inseparable from managing individual
session lifetimes. E.g. for reference-counted sessions (like those in
SChannel and OpenSSL engines) every session addition and removal
should be accompanied with refcount increment and decrement
respectively. Failing to do so synchronously leads to a race condition
that causes symptoms like use-after-free and memory corruption.
This commit:
- makes existing session cache locking explicit, thus allowing
individual engines to manage lock's scope.
- fixes OpenSSL and SChannel engines by putting refcount management
inside this lock's scope in relevant places.
- adds these explicit locking calls to other engines that use
sessionid cache to accommodate for this change. Note, however,
that it is unknown whether any of these engines could also have
this race.
Bug: https://github.com/curl/curl/issues/815
Fixes #815
Closes #847
|
|
Closes #822
|
|
|
|
... to make it not look like an OpenSSL function
|
|
Closes #844
|
|
This broke in 7.49.0 with commit e200034425a7625
Fixes #842
|
|
Mostly in order to support broken web sites that redirect to broken URLs
that are accepted by browsers.
Browsers are typically even more leniant than this as the WHATWG URL
spec they should allow an _infinite_ amount. I tested 8000 slashes with
Firefox and it just worked.
Added test case 1141, 1142 and 1143 to verify the new parser.
Closes #791
|
|
Closes #837
|
|
Closes #838
|
|
Adds access to the effectively used http version to both libcurl and
curl.
Closes #799
|
|
|
|
With OPENSSL_NO_COMP defined, there is no function
SSL_COMP_free_compression_methods
Closes #836
|
|
Fixes #828
|
|
Closes #834
|
|
|
|
|
|
Inspiration provided by: Daniel Stenberg and Ray Satiro
Bug: https://curl.haxx.se/docs/adv_20160530.html
Ref: Windows DLL hijacking with curl, CVE-2016-4802
|
|
|
|
Bug: https://github.com/curl/curl/issues/826
Reported-by: Michael Wallner
|
|
The statvfs functionality was added to libssh2 in that version, so we
switch off that functionality when built with older libraries.
Fixes #831
|
|
Regression from the previous *printf() rearrangements, this file missed to
include the correct header to make sure snprintf() works universally.
Reported-by: Moti Avrahami
Bug: https://curl.haxx.se/mail/lib-2016-05/0196.html
|
|
Added support for checking the tchar, unicode and mbcs variants of
strcat() and strncat() in the banned function list.
|
|
|
|
Now giving credit properly to github user names, fixed some UTF-8 issues
and added names discovered when contrithanks was improved.
|
|
|
