Age | Commit message (Collapse) | Author |
|
|
|
|
|
The HTML files are long gone from the dist, now remove the last HTML
file pointing to those missing files.
d
|
|
Closes #2570
|
|
|
|
Reported-by: Rikard Falkeborn
Bug: #2560
Closes #2569
|
|
Fixes gcc-8 picky compiler warnings
Reported-by: Rikard Falkeborn
Bug: #2560
Closes #2568
|
|
... and remove the github markdown syntax so that it renders better on
the web site. Also, don't use back-ticks inlined to allow the CSS to
highlight source code better.
|
|
Closes #2561
|
|
|
|
|
|
|
|
|
|
|
|
When there's an upload in progress, make sure to wait for the socket to
become writable.
Detected-by: steini2000 on github
Bug: #2520
Closes #2567
|
|
Response data for a handle with a large buffer might be cached and then
used with the "closure" handle when it has a smaller buffer and then the
larger cache will be copied and overflow the new smaller heap based
buffer.
Reported-by: Dario Weisser
CVE: CVE-2018-1000300
Bug: https://curl.haxx.se/docs/adv_2018-82c2.html
|
|
... leaving the k->str could lead to buffer over-reads later on.
CVE: CVE-2018-1000301
Assisted-by: Max Dymond
Detected by OSS-Fuzz.
Bug: https://curl.haxx.se/docs/adv_2018-b138.html
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105
|
|
RFC 6265 section 4.2.1 does not set restrictions on cookie names.
This is a follow-up to commit 7f7fcd0.
Also explicitly check proper syntax of cookie name/value pair.
New test 1155 checks that cookie names are not reserved words.
Reported-By: anshnd at github
Fixes #2564
Closes #2566
|
|
Assisted-by: Max Dymond
Detected by OSS-Fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8245
|
|
Detected by Coverity; CID 1435559. Follow-up to f8d608f38d00. It would
index the array with -1 if neither index was a socket.
|
|
Closes #2558
|
|
To make builds with VS2015 work. Recent changes in VS2015 _IOB_ENTRIES
handling is causing problems. This fix changes the OpenSSL backend code
to use BIO functions instead of FILE I/O functions to circumvent those
problems.
Closes #2512
|
|
Assisted-by: Dan Fandrich
Closes #2528
|
|
|
|
|
|
This file wasn't included in commit 4af40b3646d3b09 which updated all
haxx.se http urls to https. The file was committed prior to that update,
but may have been merged after it and hence didn't get updated.
Closes #2550
|
|
|
|
follow-up to e66cca046cef
|
|
... instead of previous separate struct fields, to make it easier to
extend and change individual backends without having to modify them all.
closes #2547
|
|
Curl_setup_transfer() can be called to setup a new individual transfer
over a multiplexed connection so it shouldn't unset writesockfd.
Bug: #2520
Closes #2549
|
|
They are removed from the compiler flags.
This ensures that make dependency tracking will force a rebuild whenever
configure --enable-debug or --enable-curldebug changes.
Closes #2548
|
|
It triggers an assert.
Detected by OSS-Fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8144
Closes #2546
|
|
Closes #2531
|
|
When only building with SSL backends that don't use the CA bundle file
(by default), skip the check.
Fixes #2543
Fixes #2180
Closes #2545
|
|
ssh-libssh.c:2429:21: warning: result of '1 << 31' requires 33 bits to
represent, but 'int' only has 32 bits [-Wshift-overflow=]
'len' will never be that big anyway so I converted the run-time check to
a regular assert.
|
|
Commit 3c630f9b0af097663a64e5c875c580aa9808a92b partially reverted the
changes from commit dd7521bcc1b7a6fcb53c31f9bd1192fcc884bd56 because of
the problem that strcpy_url() was modified unilaterally without also
modifying strlen_url(). As a consequence strcpy_url() was again
depending on ASCII encoding.
This change fixes strlen_url() and strcpy_url() in parallel to use a
common host-encoding independent criterion for deciding whether an URL
character must be %-escaped.
Closes #2535
|
|
Closes #2544
|
|
|
|
This reverts commit d5d683a97f9765bddfd964fe32e137aa6e703ed3.
--disable-pthreads can be used to disable pthreads and get the threaded
resolver to use the windows threading when building with mingw.
|
|
... as it defines it (too)
|
|
|
|
Closes https://github.com/curl/curl/pull/2542
|
|
Feedback-by: Michael Kilburn
|
|
Closes #1411
|
|
Closes #1508
|
|
Closes #2051
|
|
Closes #1332
|
|
It seems to not be detected by default anymore (which is a bug I
believe)
Closes #2541
|
|
Closes #2299
|
|
Closes #2252
|