aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2019-09-21urlapi: avoid index underflow for short ipv6 hostnamesPaul Dreik
If the input hostname is "[", hlen will underflow to max of size_t when it is subtracted with 2. hostname[hlen] will then cause a warning by ubsanitizer: runtime error: addition of unsigned offset to 0x<snip> overflowed to 0x<snip> I think that in practice, the generated code will work, and the output of hostname[hlen] will be the first character "[". This can be demonstrated by the following program (tested in both clang and gcc, with -O3) int main() { char* hostname=strdup("["); size_t hlen = strlen(hostname); hlen-=2; hostname++; printf("character is %d\n",+hostname[hlen]); free(hostname-1); } I found this through fuzzing, and even if it seems harmless, the proper thing is to return early with an error. Closes #4389
2019-09-21ngtcp2: compile with latest ngtcp2 + nghttp3 draft-23Tatsuhiro Tsujikawa
Closes #4392
2019-09-20libssh2: part of conditional expression is always true: !resultDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20urlapi: Expression 'storep' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20urlapi: 'scheme' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20urlapi: part of conditional expression is always true: (relurl[0] == '/')Daniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20setopt: store CURLOPT_RTSP_SERVER_CSEQ correctlyDaniel Stenberg
Fixes bug detected by PVS-Studio Fixes #4374
2019-09-20mime: make Curl_mime_duppart() assert if called without valid dstDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20http_proxy: part of conditional expression is always true: !errorDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20imap: merged two case-branches performing the same actionDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20multi: value '2L' is assigned to a booleanDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20easy: part of conditional expression is always true: !resultDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20netrc: part of conditional expression is always true: !doneDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20version: Expression 'left > 1' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20url: remove dead codeDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20url: part of expression is always true: (bundle->multiuse == 0)Daniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: the conditional expression is always trueDaniel Stenberg
... both !result and (ftp->transfer != FTPTRANSFER_BODY)! Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: Expression 'ftpc->wait_data_conn' is always falseDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: Expression 'ftpc->wait_data_conn' is always trueDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20ftp: part of conditional expression is always true: !resultDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374
2019-09-20http: fix Expression 'http->postdata' is always falseDaniel Stenberg
Fixes warning detected by PVS-Studio Fixes #4374 Reported-by: Valerii Zapodovnikov
2019-09-19doh: avoid truncating DNS QTYPE to lower octetNiall O'Reilly
Closes #4381
2019-09-19urlapi: CURLU_NO_AUTHORITY allows empty authority/host partJens Finkhaeuser
CURLU_NO_AUTHORITY is intended for use with unknown schemes (i.e. not "file:///") to override cURL's default demand that an authority exists. Closes #4349
2019-09-19url: only reuse TLS connections with matching pinningDaniel Stenberg
If the requests have different CURLOPT_PINNEDPUBLICKEY strings set, the connection should not be reused. Bug: https://curl.haxx.se/mail/lib-2019-09/0061.html Reported-by: Sebastian Haglund Closes #4347
2019-09-18http: merge two "case" statementsMichael Kaufmann
2019-09-18FTP: remove trailing slash from path for LIST/MLSDZenju
Closes #4348
2019-09-18mime: when disabled, avoid C99 macroDaniel Stenberg
Closes #4368
2019-09-18url: cleanup dangling DOH request headers tooDaniel Stenberg
Follow-up to 9bc44ff64d9081 Credit to OSS-Fuzz Bug: https://crbug.com/oss-fuzz/17269 Closes #4372
2019-09-16http2: relax verification of :authority in push promise requestsChristoph M. Becker
If the :authority pseudo header field doesn't contain an explicit port, we assume it is valid for the default port, instead of rejecting the request for all ports. Ref: https://curl.haxx.se/mail/lib-2019-09/0041.html Closes #4365
2019-09-16doh: clean up dangling DOH handles and memory on easy closeDaniel Stenberg
If you set the same URL for target as for DoH (and it isn't a DoH server), like "https://example.com" in both, the easy handles used for the DoH requests could be left "dangling" and end up not getting freed. Reported-by: Paul Dreik Closes #4366
2019-09-16smb: check for full size message before reading message detailsDaniel Stenberg
To avoid reading of uninitialized data. Assisted-by: Max Dymond Bug: https://crbug.com/oss-fuzz/16907 Closes #4363
2019-09-16quiche: persist connection detailsDaniel Stenberg
... like we do for other protocols at connect time. This makes "curl -I" and other things work. Reported-by: George Liu Fixes #4358 Closes #4360
2019-09-16openssl: fix warning with boringssl and SSL_CTX_set_min_proto_versionDaniel Stenberg
Follow-up to ffe34b7b59 Closes #4359
2019-09-15doh: fix undefined behaviour and open up for gcc and clang optimizationPaul Dreik
The undefined behaviour is annoying when running fuzzing with sanitizers. The codegen is the same, but the meaning is now not up for dispute. See https://cppinsights.io/s/516a2ff4 By incrementing the pointer first, both gcc and clang recognize this as a bswap and optimizes it to a single instruction. See https://godbolt.org/z/994Zpx Closes #4350
2019-09-15doh: fix (harmless) buffer overrunPaul Dreik
Added unit test case 1655 to verify. Close #4352 the code correctly finds the flaws in the old code, if one temporarily restores doh.c to the old version.
2019-09-13FTP: allow "rubbish" prepended to the SIZE responseDaniel Stenberg
This is a protocol violation but apparently there are legacy proprietary servers doing this. Added test 336 and 337 to verify. Reported-by: Philippe Marguinaud Closes #4339
2019-09-13FTP: skip CWD to entry dir when target is absoluteZenju
Closes #4332
2019-09-13parsedate: still provide the name arrays when disabledDaniel Stenberg
If FILE or FTP are enabled, since they also use them! Reported-by: Roland Hieber Fixes #4325 Closes #4343
2019-09-13openssl: close_notify on the FTP data connection doesn't mean closureDaniel Stenberg
For FTPS transfers, curl gets close_notify on the data connection without that being a signal to close the control connection! Regression since 3f5da4e59a556fc (7.65.0) Reported-by: Zenju on github Reviewed-by: Jay Satiro Fixes #4329 Closes #4340
2019-09-12setopt: make it easier to add new enum valuesZenju
... by using the *_LAST define names better. Closes #4321
2019-09-12asyn-thread: s/AF_LOCAL/AF_UNIX for SolarisDaniel Stenberg
Reported-by: Dagobert Michelsen Fixes #4328 Closes #4333
2019-09-11ldap: Stop using wide char version of ldapp_err2stringJay Satiro
Despite ldapp_err2string being documented by MS as returning a PCHAR (char *), when UNICODE it is mapped to ldap_err2stringW and returns PWCHAR (wchar_t *). We have lots of code that expects ldap_err2string to return char *, most of it failf used like this: failf(data, "LDAP local: Some error: %s", ldap_err2string(rc)); Closes https://github.com/curl/curl/pull/4272
2019-09-10urlapi: one colon is enough for the strspn() input (typo)Daniel Stenberg
2019-09-10urlapi: verify the IPv6 numerical addressDaniel Stenberg
It needs to parse correctly. Otherwise it could be tricked into letting through a-f using host names that libcurl would then resolve. Like '[ab.be]'. Reported-by: Thomas Vegas Closes #4315
2019-09-10openssl: use SSL_CTX_set_<min|max>_proto_version() when availableClément Notin
OpenSSL 1.1.0 adds SSL_CTX_set_<min|max>_proto_version() that we now use when available. Existing code is preserved for older versions of OpenSSL. Closes #4304
2019-09-10openssl: indent, re-organize and add commentsClément Notin
2019-09-10sspi: fix memory leaksmigueljcrum
Closes #4299
2019-09-09Curl_fillreadbuffer: avoid double-free trailer buf on errorDaniel Stenberg
Reviewed-by: Jay Satiro Reported-by: Thomas Vegas Closes #4307
2019-09-09security:read_data fix bad realloc()Daniel Stenberg
... that could end up a double-free CVE-2019-5481 Bug: https://curl.haxx.se/docs/CVE-2019-5481.html
2019-09-09tftp: Alloc maximum blksize, and use default unless OACK is receivedThomas Vegas
Fixes potential buffer overflow from 'recvfrom()', should the server return an OACK without blksize. Bug: https://curl.haxx.se/docs/CVE-2019-5482.html CVE-2019-5482
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-07 19:38:28 +0000