aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-02-25RELEASE-NOTES: syncedDaniel Stenberg
2019-02-25OpenSSL: add support for TLS ASYNC stateBernd Mueller
Closes #3591
2019-02-25acinclude: add additional libraries to check for LDAP supportMichael Felt
- Add an additional check for LDAP that also checks for OpenSSL since on AIX those libraries may be required to link LDAP properly. Fixes https://github.com/curl/curl/issues/3595 Closes https://github.com/curl/curl/pull/3596
2019-02-25schannel: support CALG_ECDH_EPHEM algorithmgeorgeok
Add support for Ephemeral elliptic curve Diffie-Hellman key exchange algorithm option when selecting ciphers. This became available on the Win10 SDK. Closes https://github.com/curl/curl/pull/3608
2019-02-24multi: call multi_done on connect timeoutsDaniel Stenberg
Failing to do so would make the CURLINFO_TOTAL_TIME timeout to not get updated correctly and could end up getting reported to the application completely wrong (way too small). Reported-by: accountantM on github Fixes #3602 Closes #3605
2019-02-23examples: remove recursive calls to curl_multi_socket_actionDaniel Stenberg
From within the timer callbacks. Recursive is problematic for several reasons. They should still work, but this way the examples and the documentation becomes simpler. I don't think we need to encourage recursive calls. Discussed in #3537 Closes #3601
2019-02-23configure: remove CURL_CHECK_FUNC_FDOPEN callMarcel Raad
The macro itself has been removed in commit 11974ac859c5d82def59e837e0db56fef7f6794e. Closes https://github.com/curl/curl/pull/3604
2019-02-23wolfssl: stop custom-adding curvesDaniel Stenberg
since wolfSSL PR https://github.com/wolfSSL/wolfssl/pull/717 (shipped in wolfSSL 3.10.2 and later) it sends these curves by default already. Pointed-out-by: David Garske Closes #3599
2019-02-22configure: remove the unused fdopen macroDaniel Stenberg
and the two remaining #ifdefs for it Closes #3600
2019-02-22url: change conn shutdown order to unlink data as last stepJay Satiro
- Split off connection shutdown procedure from Curl_disconnect into new function conn_shutdown. - Change the shutdown procedure to close the sockets before disassociating the transfer. Prior to this change the sockets were closed after disassociating the transfer so SOCKETFUNCTION wasn't called since the transfer was already disassociated. That likely came about from recent work started in Jan 2019 (#3442) to separate transfers from connections. Bug: https://curl.haxx.se/mail/lib-2019-02/0101.html Reported-by: Pavel Löbl Closes https://github.com/curl/curl/issues/3597 Closes https://github.com/curl/curl/pull/3598
2019-02-22Fix strict-prototypes GCC warningMarcel Raad
As seen in the MinGW autobuilds. Caused by commit f26bc29cfec0be84c67cf74065cf8e5e78fd68b7.
2019-02-21tests: Fixed XML validation errors in some test files.Dan Fandrich
2019-02-20TODO: Allow SAN names in HTTP/2 server pushDaniel Stenberg
Suggested-by: Nicolas Grekas
2019-02-20RELEASE-NOTES: syncedDaniel Stenberg
2019-02-20curl: remove MANUAL from -M outputDaniel Stenberg
... and remove it from the dist tarball. It has served its time, it barely gets updated anymore and "everything curl" is now convering all this document once tried to include, and does it more and better. In the compressed scenario, this removes ~15K data from the binary, which is 25% of the -M output. It remains in the git repo for now for as long as the web site builds a page using that as source. It renders poorly on the site (especially for mobile users) so its not even good there. Closes #3587
2019-02-20http2: verify :athority in push promise requestsDaniel Stenberg
RFC 7540 says we should verify that the push is for an "authoritative" server. We make sure of this by only allowing push with an :athority header that matches the host that was asked for in the URL. Fixes #3577 Reported-by: Nicolas Grekas Bug: https://curl.haxx.se/mail/lib-2019-02/0057.html Closes #3581
2019-02-20singlesocket: fix the 'sincebefore' placementDaniel Stenberg
The variable wasn't properly reset within the loop and thus could remain set for sockets that hadn't been set before and miss notifying the app. This is a follow-up to 4c35574 (shipped in curl 7.64.0) Reported-by: buzo-ffm on github Detected-by: Jan Alexander Steffens Fixes #3585 Closes #3589
2019-02-19connection: never reuse CONNECT_ONLY conectionsDaniel Stenberg
and make CONNECT_ONLY conections never reuse any existing ones either. Reported-by: Pavel Löbl Bug: https://curl.haxx.se/mail/lib-2019-02/0064.html Closes #3586
2019-02-19cli tool: fix mime post with --disable-libcurl-option configure optionPatrick Monnerat
Reported-by: Marcel Raad Fixes #3576 Closes #3583
2019-02-19x509asn1: cleanup and unify code layoutDaniel Stenberg
- rename 'n' to buflen in functions, and use size_t for them. Don't pass in negative buffer lengths. - move most function comments to above the function starts like we use to - remove several unnecessary typecasts (especially of NULL) Reviewed-by: Patrick Monnerat Closes #3582
2019-02-19curl_multi_remove_handle.3: use at any time, just not from within callbacksDaniel Stenberg
[ci skip]
2019-02-19http: make adding a blank header thread-safeDaniel Stenberg
Previously the function would edit the provided header in-place when a semicolon is used to signify an empty header. This made it impossible to use the same set of custom headers in multiple threads simultaneously. This approach now makes a local copy when it needs to edit the string. Reported-by: d912e3 on github Fixes #3578 Closes #3579
2019-02-19unit1651: survive curl_easy_init() failsDaniel Stenberg
2019-02-18rand: Fix a mismatch between comments in source and header.Frank Gevaerts
Reported-by: Björn Stenberg <bjorn@haxx.se> Closes #3584
2019-02-18x509asn1: replace single char with an arrayPatrick Monnerat
Although safe in this context, using a single char as an array may cause invalid accesses to adjacent memory locations. Detected by Coverity.
2019-02-18examples/http2-serverpush: add some sensible error checksDaniel Stenberg
To avoid NULL pointer dereferences etc in the case of problems. Closes #3580
2019-02-18easy: fix win32 init to work without CURL_GLOBAL_WIN32Jay Satiro
- Change the behavior of win32_init so that the required initialization procedures are not affected by CURL_GLOBAL_WIN32 flag. libcurl via curl_global_init supports initializing for win32 with an optional flag CURL_GLOBAL_WIN32, which if omitted was meant to stop Winsock initialization. It did so internally by skipping win32_init() when that flag was set. Since then win32_init() has been expanded to include required initialization routines that are separate from Winsock and therefore must be called in all cases. This commit fixes it so that CURL_GLOBAL_WIN32 only controls the optional win32 initialization (which is Winsock initialization, according to our doc). The only users affected by this change are those that don't pass CURL_GLOBAL_WIN32 to curl_global_init. For them this commit removes the risk of a potential crash. Ref: https://github.com/curl/curl/pull/3573 Fixes https://github.com/curl/curl/issues/3313 Closes https://github.com/curl/curl/pull/3575
2019-02-17cookie: Add support for cookie prefixesDaniel Gustafsson
The draft-ietf-httpbis-rfc6265bis-02 draft, specify a set of prefixes and how they should affect cookie initialization, which has been adopted by the major browsers. This adds support for the two prefixes defined, __Host- and __Secure, and updates the testcase with the supplied examples from the draft. Closes #3554 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-02-16mbedtls: release sessionid resources on errorDaniel Gustafsson
If mbedtls_ssl_get_session() fails, it may still have allocated memory that needs to be freed to avoid leaking. Call the library API function to release session resources on this errorpath as well as on Curl_ssl_addsessionid() errors. Closes: #3574 Reported-by: Michał Antoniak <M.Antoniak@posnet.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-02-16cli tool: refactor encoding conversion sequence for switch case fallthrough.Patrick Monnerat
2019-02-16version.c: silent scan-build even when librtmp is not enabledPatrick Monnerat
2019-02-15RELEASE-NOTES: syncedDaniel Stenberg
2019-02-15Curl_now: figure out windows version in win32_initDaniel Stenberg
... and avoid use of static variables that aren't thread safe. Fixes regression from e9ababd4f5a (present in the 7.64.0 release) Reported-by: Paul Groke Fixes #3572 Closes #3573
2019-02-15unit1307: just fail without FTP supportMarcel Raad
I missed to check this in with commit 71786c0505926aaf7e9b2477b2fb7ee16a915ec6, which only disabled the test. This fixes the actual linker error. Closes https://github.com/curl/curl/pull/3568
2019-02-15travis: enable valgrind for the iconv tests tooDaniel Stenberg
Closes #3571
2019-02-14travis: add scan-buildDaniel Stenberg
Closes #3564
2019-02-14examples/sftpuploadresume: Value stored to 'result' is never readDaniel Stenberg
Detected by scan-build
2019-02-14examples/http2-upload: cleaned upDaniel Stenberg
Fix scan-build warnings, no globals, no silly handle scan. Also remove handles from the multi before cleaning up.
2019-02-14examples/http2-download: cleaned upDaniel Stenberg
To avoid scan-build warnings and global variables.
2019-02-14examples/postinmemory: Potential leak of memory pointed to by 'chunk.memory'Daniel Stenberg
Detected by scan-build
2019-02-14examples/httpcustomheader: Value stored to 'res' is never readDaniel Stenberg
Detected by scan-build
2019-02-14examples: remove superfluous null-pointer checksDaniel Stenberg
in ftpget, ftpsget and sftpget, so that scan-build stops warning for potential NULL pointer dereference below! Detected by scan-build
2019-02-14strip_trailing_dot: make sure NULL is never used for strlenDaniel Stenberg
scan-build warning: Null pointer passed as an argument to a 'nonnull' parameter
2019-02-14connection_check: restore original conn->data after the checkJay Satiro
- Save the original conn->data before it's changed to the specified data transfer for the connection check and then restore it afterwards. This is a follow-up to 38d8e1b 2019-02-11. History: It was discovered a month ago that before checking whether to extract a dead connection that that connection should be associated with a "live" transfer for the check (ie original conn->data ignored and set to the passed in data). A fix was landed in 54b201b which did that and also cleared conn->data after the check. The original conn->data was not restored, so presumably it was thought that a valid conn->data was no longer needed. Several days later it was discovered that a valid conn->data was needed after the check and follow-up fix was landed in bbae24c which partially reverted the original fix and attempted to limit the scope of when conn->data was changed to only when pruning dead connections. In that case conn->data was not cleared and the original conn->data not restored. A month later it was discovered that the original fix was somewhat correct; a "live" transfer is needed for the check in all cases because original conn->data could be null which could cause a bad deref at arbitrary points in the check. A fix was landed in 38d8e1b which expanded the scope to all cases. conn->data was not cleared and the original conn->data not restored. A day later it was discovered that not restoring the original conn->data may lead to busy loops in applications that use the event interface, and given this observation it's a pretty safe assumption that there is some code path that still needs the original conn->data. This commit is the follow-up fix for that, it restores the original conn->data after the connection check. Assisted-by: tholin@users.noreply.github.com Reported-by: tholin@users.noreply.github.com Fixes https://github.com/curl/curl/issues/3542 Closes #3559
2019-02-14memdebug: bring back curl_mark_scloseDaniel Stenberg
Used by debug builds with NSS. Reverted from 05b100aee247bb
2019-02-14transfer.c: do not compute length of undefined hex buffer.Patrick Monnerat
On non-ascii platforms, the chunked hex header was measured for char code conversion length, even for chunked trailers that do not have an hex header. In addition, the efective length is already known: use it. Since the hex length can be zero, only convert if needed. Reported by valgrind.
2019-02-14KNOWN_BUGS: Cannot compile against a static build of OpenLDAPDaniel Stenberg
Closes #2367
2019-02-14x509asn1: "Dereference of null pointer"Patrick Monnerat
Detected by scan-build (false positive).
2019-02-14configure: show features as well in the final summaryDaniel Stenberg
Closes #3569
2019-02-14KNOWN_BUGS: curl compiled on OSX 10.13 failed to run on OSX 10.10Daniel Stenberg
Closes #2905
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 08:41:16 +0000