aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2014-11-05tool_strdup.c: include the tool strdup.hDaniel Stenberg
... not the lib/ one that the tool no longer uses!
2014-11-05curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of boundsDaniel Stenberg
When duplicating a handle, the data to post was duplicated using strdup() when it could be binary and contain zeroes and it was not even zero terminated! This caused read out of bounds crashes/segfaults. Since the lib/strdup.c file no longer is easily shared with the curl tool with this change, it now uses its own version instead. Bug: http://curl.haxx.se/docs/adv_20141105.html CVE: CVE-2014-3707 Reported-By: Symeon Paraschoudis
2014-10-29Added NetWare support to build with nghttp2.Guenter Knauf
2014-10-26src/: remove version.h.dist from gitignoreDaniel Stenberg
It has not been used since commit f7bfdbab in 2011
2014-10-24Added MinGW support to build with nghttp2.Guenter Knauf
2014-10-12cmake: build tool_hugehelp (ENABLE_MANUAL)Peter Wu
Rather than always outputting an empty manual page for the '-M' option, generate a full manual page as done by autotools. For simplicity in CMake, always generate the gzipped page as it will not be used anyway when zlib is not available. Signed-off-by: Peter Wu <peter@lekensteyn.nl>
2014-10-09get_url_file_name: make no slash equal empty stringDaniel Stenberg
2014-10-09get_url_file_name: never return a NULL string *and* OKDaniel Stenberg
Change 987a4a73 assumes that as it simplifies life in the calling function. Reported-by: Fabian Keil
2014-10-09Cmake: Got rid of setup_curl_dependenciesJakub Zakrzewski
There is no need for such function. Include_directories propagate by themselves and having a function with one simple link statement makes little sense.
2014-10-08operate: avoid NULL dereferenceDaniel Stenberg
Coverity CID 1241948. dumpeasysrc() would get called with config->current set to NULL which could be dereferenced by a warnf() call.
2014-10-08operate_do: skip superfluous check for NULL pointerDaniel Stenberg
Coverity CID 1243583. get_url_file_name() cannot fail and return a NULL file name pointer so skip the check for that - it tricks coverity into believing it can happen and it then warns later on when we use 'outfile' without checking for NULL.
2014-10-07SSL: implement public key pinningmoparisthebest
Option --pinnedpubkey takes a path to a public key in DER format and only connect if it matches (currently only implemented with OpenSSL). Provides CURLOPT_PINNEDPUBLICKEY for curl_easy_setopt(). Extract a public RSA key from a website like so: openssl s_client -connect google.com:443 2>&1 < /dev/null | \ sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey \ | openssl rsa -pubin -outform DER > google.com.der
2014-10-07parseconfig: skip a NULL checkDaniel Stenberg
Coverity CID 1154198. This NULL check implies that the pointer _can_ be NULL at this point, which it can't. Thus it is dead code. It tricks static analyzers to warn about dereferencing the pointer since the code seems to imply it can be NULL.
2014-10-06tool_go_sleep: use (void) to spell out we ignore the return valueDaniel Stenberg
Coverity CID 1222080.
2014-10-04getparameter: remove dead codeDaniel Stenberg
Coverity CID 1061126. 'parse' will always be non-NULL here.
2014-10-04getparameter: comment a switch FALLTHROUGHDaniel Stenberg
Coverity CID 1061118. Point out that it is on purpose.
2014-08-19help output: minor whitespace editsDaniel Stenberg
Should've been amended in the previous commit but wasn't due to a mistake.
2014-08-19help output: use ≥2 spaces between option and descriptionZearin
... and some other cleanups
2014-08-10tool_hugehelp.c.cvs: Added copyrightSteve Holme
Added copyright due to warning from checksrc.pl.
2014-08-08tool_getparam.c: Fixed compilation warningSteve Holme
warning: `orig_opt' might be used uninitialized in this function
2014-07-23docs: Improve inline GSS-API naming in code documentationMichael Osipov
2014-07-23curl.h/features: Deprecate GSS-Negotiate macros due to bad namingMichael Osipov
- Replace CURLAUTH_GSSNEGOTIATE with CURLAUTH_NEGOTIATE - CURL_VERSION_GSSNEGOTIATE is deprecated which is served by CURL_VERSION_SSPI, CURL_VERSION_GSSAPI and CURUL_VERSION_SPNEGO now. - Remove display of feature 'GSS-Negotiate'
2014-07-23configure/features: Add feature and version info for GSS-API and SPNEGOMichael Osipov
2014-07-18build: link curl to NSS libraries when NSS support is enabledAlessandro Ghedini
This fixes a build failure on Debian caused by commit 24c3cdce88f39731506c287cb276e8bf4a1ce393. Bug: http://curl.haxx.se/mail/lib-2014-07/0209.html
2014-07-17src/Makefile.am: add .DELETE_ON_ERRORDave Reisner
This prevents targets like tool_hugehelp.c from leaving around half-constructed files if the rule fails with GNU make. Reported-by: Rafaël Carré <funman@videolan.org>
2014-07-16Remove all traces of FBOpenSSL SPNEGO supportDavid Woodhouse
This is just fundamentally broken. SPNEGO (RFC4178) is a protocol which allows client and server to negotiate the underlying mechanism which will actually be used to authenticate. This is *often* Kerberos, and can also be NTLM and other things. And to complicate matters, there are various different OIDs which can be used to specify the Kerberos mechanism too. A SPNEGO exchange will identify *which* GSSAPI mechanism is being used, and will exchange GSSAPI tokens which are appropriate for that mechanism. But this SPNEGO implementation just strips the incoming SPNEGO packet and extracts the token, if any. And completely discards the information about *which* mechanism is being used. Then we *assume* it was Kerberos, and feed the token into gss_init_sec_context() with the default mechanism (GSS_S_NO_OID for the mech_type argument). Furthermore... broken as this code is, it was never even *used* for input tokens anyway, because higher layers of curl would just bail out if the server actually said anything *back* to us in the negotiation. We assume that we send a single token to the server, and it accepts it. If the server wants to continue the exchange (as is required for NTLM and for SPNEGO to do anything useful), then curl was broken anyway. So the only bit which actually did anything was the bit in Curl_output_negotiate(), which always generates an *initial* SPNEGO token saying "Hey, I support only the Kerberos mechanism and this is its token". You could have done that by manually just prefixing the Kerberos token with the appropriate bytes, if you weren't going to do any proper SPNEGO handling. There's no need for the FBOpenSSL library at all. The sane way to do SPNEGO is just to *ask* the GSSAPI library to do SPNEGO. That's what the 'mech_type' argument to gss_init_sec_context() is for. And then it should all Just Work™. That 'sane way' will be added in a subsequent patch, as will bug fixes for our failure to handle any exchange other than a single outbound token to the server which results in immediate success.
2014-07-12Fixed some "statement not reached" warningsDan Fandrich
2014-07-03tool: oops, forgot to include <plarenas.h>Kamil Dudka
... that contains the declaration of PL_ArenaFinish()
2014-07-03tool: call PL_ArenaFinish() on exit if NSPR is usedKamil Dudka
This prevents valgrind from reporting still reachable memory allocated by NSPR arenas (mainly the freelist). Reported-by: Hubert Kario
2014-07-02tool: call PR_Cleanup() on exit if NSPR is usedKamil Dudka
This prevents valgrind from reporting possibly lost memory that NSPR uses for file descriptor cache and other globally allocated internal data structures.
2014-06-17tool_metalink: Support polarssl as digest providerMichał Górny
2014-05-22tool_getparam.c: Fixed compilation warningsSteve Holme
There is an implicit conversion from "unsigned long" to "long"
2014-05-22build: Fixed incorrect reference to curl_setup.h in Visual Studio filesSteve Holme
Fixed a copy / paste error from my 2011 project files.
2014-05-21Makefile.inc: Added curlx headers to assist Visual Studio project generationSteve Holme
2014-05-21build: Renamed CURLX_ONES file list definition to CURLX_CFILESSteve Holme
Renamed the CURLX_ONES file list definition in order to a) try and be consistent with other file lists and b) to allow for the addition of the curlx header files, which will assist with Visual Studio project files generation rather than hard coding those files.
2014-05-17Makefile.inc: Added resource file to assist Visual Studio project generationSteve Holme
2014-05-10tool_operate.c: Fixed compilation warningSteve Holme
An enumerated type is mixed with another type.
2014-05-09tool_operate.c: Fixed TAB is white space from commit 5b8ae0a985Steve Holme
2014-05-09tool_urlglob.c: Fixed compilation warningSteve Holme
An enumerated type is mixed with another type.
2014-05-09tool_operate.c: Fixed compilation warningsSteve Holme
An enumerated type is mixed with another type.
2014-05-07tool_help: Fixed missing --login-options optionSteve Holme
...and removed ;OPTIONS from --user as that functionality was removed in 7.34.0.
2014-05-06curl: bail on cookie use when built with disabled cookiesDaniel Stenberg
2014-04-19tool_writeout.c: initialize string pointer variableMarc Hoersken
2014-04-19tool_formparse.c: fix possible use of non-null-terminated stringsMarc Hoersken
2014-04-18tool_urlglob.c: added some comments to clarify for loop conditionsMarc Hoersken
I was tempted to change those to >= 0 until I saw that this is actually a for loop that terminates once i underflows.
2014-04-06Makefile.vc6: Follow up fix to commit 45d3f00803Steve Holme
2014-04-05Makefile.vc6: added warnless.c to fix buildMarc Hoersken
2014-04-04curl: add --proxy-headerMaciej Puzio
2014-03-30curl: stop interpreting IPv6 literals as glob patterns.Paul Marks
This makes it possible to fetch from an IPv6 literal without specifying the -g option. Globbing remains available elsehwere in the URL. For example: curl http://[::1]/file[1-3].txt This creates no ambiguity, because there is no overlap between the syntax of valid globs and valid IPv6 literals. Globs contain hyphens and at most 1 colon, while IPv6 literals have no hyphens, and at least 2 colons. The peek_ipv6() parser simply whitelists a set of characters and counts colons, because the real validation happens later on. The character set includes A-Z, in case someone decides to implement support for scopes like [fe80::1%25eth0] in the future. Signed-off-by: Paul Marks <pmarks@google.com>
2014-03-26mkhelp: generate code for --disable-manual as wellDaniel Stenberg
This allows configure --disable-manual to run and build without having to regenerate the src/tool_hugehelp.c file which otherwise is necessary since we ship tarballs with that file present. Reported-by: Remi Gacogne Bug: http://curl.haxx.se/bug/view.cgi?id=1350
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-09 16:05:58 +0000