aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2016-08-03mbedtls: Added support for NTLMBill Nagel
2016-08-03TLS: only reuse connections with the same client certDaniel Stenberg
CVE-2016-5420 Bug: https://curl.haxx.se/docs/adv_20160803B.html
2016-08-03TLS: switch off SSL session id when client cert is usedDaniel Stenberg
CVE-2016-5419 Bug: https://curl.haxx.se/docs/adv_20160803A.html Reported-by: Bru Rom Contributions-by: Eric Rescorla and Ray Satiro
2016-08-03curl_multi_cleanup: clear connection pointer for easy handlesDaniel Stenberg
CVE-2016-5421 Bug: https://curl.haxx.se/docs/adv_20160803C.html Reported-by: Marcelo Echeverria and Fernando Muñoz
2016-08-01mbedtls: Fix debug function nameThomas Glanzmann
This patch is necessary so that curl compiles if MBEDTLS_DEBUG is defined. Bug: https://curl.haxx.se/mail/lib-2016-08/0001.html
2016-08-01win32: fix a potential memory leak in Curl_load_libraryMartin Vejnár
If a call to GetSystemDirectory fails, the `path` pointer that was previously allocated would be leaked. This makes sure that `path` is always freed. Closes #938
2016-07-23vauth.h: No need to query HAVE_GSSAPI || USE_WINDOWS_SSPI for SPNEGOSteve Holme
As SPNEGO is only defined when these pre-processor variables are defined there is no need to query them explicitly.
2016-07-23spnego: Corrected miss-placed * in Curl_auth_spnego_cleanup() declarationSteve Holme
Typo introduced in commit ad5e9bfd5d.
2016-07-20vauth: Fix memleak by freeing credentials if out of memoryJay Satiro
This is a follow up to the parent commit dcdd4be which fixes one leak but creates another by failing to free the credentials handle if out of memory. Also there's a second location a few lines down where we fail to do same. This commit fixes both of those issues.
2016-07-20vauth: Fixed memory leak due to function returning without freeSaurav Babu
This patch allocates memory to "output_token" only when it is required so that memory is not leaked if function returns.
2016-07-20connect: disable TFO on Linux when using SSLJay Satiro
- Linux TFO + TLS is not implemented yet. Bug: https://github.com/curl/curl/issues/907
2016-07-18curl_global_init: Check if IPv6 worksBrian Prodoehl
- Curl_ipv6works() is not thread-safe until after the first call, so call it once during global init to avoid a possible race condition. Bug: https://github.com/curl/curl/issues/915 PR: https://github.com/curl/curl/pull/918
2016-07-14library: Fix memory leaks found during static analysisMiroslav Franc
Closes https://github.com/curl/curl/pull/913
2016-07-13cookie.c: Fix misleading indentationViktor Szakats
Closes https://github.com/curl/curl/pull/911
2016-06-29conn: don't free easy handle data in handler->disconnectDaniel Stenberg
Reported-by: Gou Lingfeng Bug: https://curl.haxx.se/mail/lib-2016-06/0139.html
2016-06-28cleanup: minor code cleanup in Curl_http_readwrite_headers()Michael Kaufmann
- the expression of an 'if' was always true - a 'while' contained a condition that was always true - use 'if(k->exp100 > EXP100_SEND_DATA)' instead of 'if(k->exp100)' - fixed a typo Closes #889
2016-06-28SFTP: set a generic error when no SFTP one exists...Daniel Stenberg
... as otherwise we could get a 0 which would count as no error and we'd wrongly continue and could end up segfaulting. Bug: https://curl.haxx.se/mail/lib-2016-06/0052.html Reported-by: 暖和的和暖
2016-06-22Makefile.vc: link with crypt32.lib for winssl buildsDaniel Stenberg
Necessary since 6cabd78531f Fixes #853
2016-06-22vc: fix the build for schannel certinfo supportDaniel Stenberg
Broken since 6cabd785, which adds use of the Curl_extract_certinfo function from the x509asn1.c file.
2016-06-22typedefs: use the full structs in internal code...Daniel Stenberg
... and save the typedef'ed names for headers and external APIs.
2016-06-22internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg
2016-06-22vtls: Only call add/getsession if session id is enabledJay Satiro
Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-21cleanup: fix method names in code commentsMichael Kaufmann
Closes #887
2016-06-19openssl: use more 'const' to fix build warnings with 1.1.0 branchDaniel Stenberg
2016-06-16openssl: fix cert check with non-DNS name fields presentDaniel Stenberg
Regression introduced in 5f5b62635 (released in 7.48.0) Reported-by: Fabian Ruff Fixes #875
2016-06-16axtls: Use Curl_wait_ms instead of the less-portable usleepDan Fandrich
2016-06-16axtls: Fixed compile after compile 31c521b0Dan Fandrich
2016-06-07resolve: enable protocol family logic for synthesized IPv6Luo Jinghua
- Enable protocol family logic for IPv6 resolves even when support for synthesized addresses is enabled. This is a follow up to the parent commit that added support for synthesized IPv6 addresses from IPv4 on iOS/OS X. The protocol family logic needed for IPv6 was inadvertently excluded if support for synthesized addresses was enabled. Bug: https://github.com/curl/curl/issues/863 Ref: https://github.com/curl/curl/pull/866 Ref: https://github.com/curl/curl/pull/867
2016-06-07resolve: add support for IPv6 DNS64/NAT64 Networks on OS X + iOSLuo Jinghua
Use getaddrinfo() to resolve the IPv4 address literal on iOS/Mac OS X. If the current network interface doesn’t support IPv4, but supports IPv6, NAT64, and DNS64. Closes #866 Fixes #863
2016-06-06schannel: Disable ALPN on Windows < 8.1Steve Holme
Calling QueryContextAttributes with SECPKG_ATTR_APPLICATION_PROTOCOL fails on Windows < 8.1 so we need to disable ALPN on these OS versions. Inspiration provide by: Daniel Seither Closes #848 Fixes #840
2016-06-05checksrc: Add LoadLibrary to the banned functions listJay Satiro
LoadLibrary was supplanted by Curl_load_library for security reasons in 6df916d.
2016-06-05http: Fix HTTP/2 connection reuseJay Satiro
- Change the parser to not require a minor version for HTTP/2. HTTP/2 connection reuse broke when we changed from HTTP/2.0 to HTTP/2 in 8243a95 because the parser still expected a minor version. Bug: https://github.com/curl/curl/issues/855 Reported-by: Andrew Robbins, Frank Gevaerts
2016-06-04connect.c: Fixed compilation warning from commit 332e8d6164Steve Holme
connect.c:952:5: warning: suggest explicit braces to avoid ambiguous 'else'
2016-06-04win32: Used centralised verify windows version functionSteve Holme
Closes #845
2016-06-04win32: Added verify windows version functionalitySteve Holme
2016-06-04win32: Introduced centralised verify windows version functionSteve Holme
2016-06-01makefile.m32: add crypt32 for winssl buildsViktor Szakats
Dependency added by 6cabd78 Closes #849
2016-06-01vtls: fix ssl session cache race conditionIvan Avdeev
Sessionid cache management is inseparable from managing individual session lifetimes. E.g. for reference-counted sessions (like those in SChannel and OpenSSL engines) every session addition and removal should be accompanied with refcount increment and decrement respectively. Failing to do so synchronously leads to a race condition that causes symptoms like use-after-free and memory corruption. This commit: - makes existing session cache locking explicit, thus allowing individual engines to manage lock's scope. - fixes OpenSSL and SChannel engines by putting refcount management inside this lock's scope in relevant places. - adds these explicit locking calls to other engines that use sessionid cache to accommodate for this change. Note, however, that it is unknown whether any of these engines could also have this race. Bug: https://github.com/curl/curl/issues/815 Fixes #815 Closes #847
2016-06-01schannel: add CURLOPT_CERTINFO supportAndrew Kurushin
Closes #822
2016-05-31openssl: rename the private SSL_strerrorDaniel Stenberg
... to make it not look like an OpenSSL function
2016-05-31openssl: Use correct buffer sizes for error messagesMichael Kaufmann
Closes #844
2016-05-30URL parser: allow URLs to use one, two or three slashesDaniel Stenberg
Mostly in order to support broken web sites that redirect to broken URLs that are accepted by browsers. Browsers are typically even more leniant than this as the WHATWG URL spec they should allow an _infinite_ amount. I tested 8000 slashes with Firefox and it just worked. Added test case 1141, 1142 and 1143 to verify the new parser. Closes #791
2016-05-30cmake: Added missing mbedTLS supportRenaud Lehoux
Closes #837
2016-05-30mbedtls: removed unused variablesRenaud Lehoux
Closes #838
2016-05-30http: add CURLINFO_HTTP_VERSION and %{http_version}Frank Gevaerts
Adds access to the effectively used http version to both libcurl and curl. Closes #799
2016-05-30openssl: fix build with OPENSSL_NO_COMPMarcel Raad
With OPENSSL_NO_COMP defined, there is no function SSL_COMP_free_compression_methods Closes #836
2016-05-30memdebug: fix MSVC crash with -DMEMDEBUG_LOG_SYNCGisle Vanem
Fixes #828
2016-05-30loadlibrary: Only load system DLLs from the system directorySteve Holme
Inspiration provided by: Daniel Stenberg and Ray Satiro Bug: https://curl.haxx.se/docs/adv_20160530.html Ref: Windows DLL hijacking with curl, CVE-2016-4802
2016-05-30ssh: fix version number check typoDaniel Stenberg
2016-05-29ssh: fix build for libssh2 before 1.2.6Daniel Stenberg
The statvfs functionality was added to libssh2 in that version, so we switch off that functionality when built with older libraries. Fixes #831
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-14 04:53:18 +0000