CHANGES

                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Daniel Stenberg (23 Mar 2010)
- Hauke Duden provided an example program that made the multi interface crash.
  His example simply used the multi interface and did first one FTP transfer
  and after completion it used a second easy handle and did another FTP
  transfer on the same FTP server.

  This triggered a bug in the "delayed easy handle kill" system that curl
  uses: when an FTP connection is left alive it must keep an easy handle
  around internally - only for the purpose of having an easy handle when it
  later disconnects it. The code assumed that when the easy handle was removed
  and an internal reference was made, that version could be killed later on
  when a new easy handle came using the same connection. This was wrong as
  Hauke's example showed that the removed handle wasn't killed for real until
  later. This caused a double close attempt => segfault.

Daniel Stenberg (22 Mar 2010)
- Thomas Lopatic fixed the alarm()-based DNS timeout:

  Looking at the code of Curl_resolv_timeout() in hostip.c, I think that in
  case of a timeout, the signal handler for SIGALRM never gets removed. I
  think that in my case it gets executed at some point later on when execution
  has long left Curl_resolv_timeout() or even the cURL library.
  
  The code that is jumped to with siglongjmp() simply sets the error message
  to "name lookup timed out" and then returns with CURLRESOLV_ERROR. I guess
  that instead of simply returning without cleaning up, the code should have a
  goto that jumps to the spot right after the call to Curl_resolv().

Kamil Dudka (22 Mar 2010)
- Douglas Steinwand contributed a patch fixing insufficient initialization in
  Curl_clone_ssl_config()

Daniel Stenberg (21 Mar 2010)
- Ben Greear improved TFTP: the error code returning and the treatment
  of TSIZE == 0 when uploading.

- We've switched from CVS to git. See http://curl.haxx.se/source.html

Kamil Dudka (19 Mar 2010)
- Improved Curl_read() to not ignore the error returned from Curl_ssl_recv().

Daniel Stenberg (15 Mar 2010)
- Constantine Sapuntzakis brought a patch:

  The problem mentioned on Dec 10 2009
  (http://curl.haxx.se/bug/view.cgi?id=2905220) was only partially fixed.
  Partially because an easy handle can be associated with many connections in
  the cache (e.g. if there is a redirect during the lifetime of the easy
  handle).  The previous patch only cleaned up the first one. The new fix now
  removes the easy handle from all connections, not just the first one.

Daniel Stenberg (6 Mar 2010)
- Ben Greear brought a patch that fixed the rate limiting logic for TFTP when
  the easy interface was used.

Daniel Stenberg (5 Mar 2010)
- Daniel Johnson provided fixes for building curl with the clang compiler.

Yang Tse (5 Mar 2010)
- Constantine Sapuntzakis detected and fixed a double free in builds done
  with threaded resolver enabled (Windows default configuration) that would
  get triggered when a curl handle is closed while doing DNS resolution.

Daniel Stenberg (2 Mar 2010)
- [Daniel Johnson] I've been trying to build libcurl with clang on Darwin and
  ran into some issues with the GSSAPI tests in configure.ac. The tests first
  try to determine the include dirs and libs and set CPPFLAGS and LIBS
  accordingly. It then checks for the headers and finally sets LIBS a second
  time, causing the libs to be included twice. The first setting of LIBS seems
  redundant and should be left out, since the first part is otherwise just
  about finding headers.

  My second issue is that 'krb5-config --libs gssapi' on Darwin is less than
  useless and returns junk that, while it happens to work with gcc, causes
  clang to choke. For example, --libs returns $CFLAGS along with the libs,
  which is really retarded. Simply setting 'LIBS="$LIBS -lgssapi_krb5
  -lresolv"' on Darwin is sufficient.

- Based on patch provided by Jacob Moshenko, the transfer logic now properly
  makes sure that when using sub-second timeouts, there's no final bad 1000ms
  wait. Previously, a sub-second timeout would often make the elapsed time end
  up the time rounded up to the nearest second (e.g. 1s for 200ms timeout)

- Andrei Benea filed bug report #2956698 and pointed out that the
  CURLOPT_CERTINFO feature leaked memory due to a missing OpenSSL function
  call. He provided the patch to fix it too.

  http://curl.haxx.se/bug/view.cgi?id=2956698

- Markus Duft pointed out in bug #2961796 that even though Interix has a
  poll() function it doesn't quite work the way we want it so we must disable
  it, and he also provided a patch for it.

  http://curl.haxx.se/bug/view.cgi?id=2961796

- Made the pingpong timeout code properly deal with the response timeout AND
  the global timeout if set. Also, as was reported in the bug report #2956437
  by Ryan Chan, the time stamp to use as basis for the per command timeout was
  not set properly in the DONE phase for FTP (and not for SMTP) so I fixed
  that just now. This was a regression compared to 7.19.7 due to the
  conversion of FTP code over to the generic pingpong concepts.

  http://curl.haxx.se/bug/view.cgi?id=2956437

Daniel Stenberg (1 Mar 2010)
- Ben Greear provided an update for TFTP that fixes upload.

- Wesley Miaw reported bug #2958179 which identified a case of looping during
  OpenSSL based SSL handshaking even though the multi interface was used and
  there was no good reason for it.

  http://curl.haxx.se/bug/view.cgi?id=2958179

Daniel Stenberg (26 Feb 2010)
- Pat Ray in bug #2958474 pointed out an off-by-one case when receiving a
  chunked-encoding trailer.

  http://curl.haxx.se/bug/view.cgi?id=2958474

Daniel Fandrich (25 Feb 2010)
- Fixed a couple of out of memory leaks and a segfault in the SMTP & IMAP code.

Yang Tse (25 Feb 2010)
- I fixed bug report #2958074 indicating
  (http://curl.haxx.se/bug/view.cgi?id=2958074) that curl on Windows with
  option --trace-time did not use local time when timestamping trace lines.
  This could also happen on other systems depending on time souurce.

Patrick Monnerat (22 Feb 2010)
- Proper handling of STARTTLS on SMTP, taking CURLUSESSL_TRY into account.
- SMTP falls back to RFC821 HELO when EHLO fails (and SSL is not required).
- Use of true local host name (i.e.: via gethostname()) when available, as
  default argument to SMTP HELO/EHLO.
- Test case 804 for HELO fallback.

Daniel Stenberg (20 Feb 2010)
- Fixed the SMTP compliance by making sure RCPT TO addresses are specified
  properly in angle brackets. Recipients provided with CURLOPT_MAIL_RCPT now
  get angle bracket wrapping automatically by libcurl unless the recipient
  starts with an angle bracket as then the app is assumed to deal with that
  properly on its own.

- I made the SMTP code expect a 250 response back from the server after the
  full DATA has been sent, and I modified the test SMTP server to also send
  that response. As usual, the DONE operation that is made after a completed
  transfer is still not doable in a non-blocking way so this waiting for 250
  is unfortunately made blockingly.

Yang Tse (14 Feb 2010)
- Overhauled test suite getpart() function. Fixing potential out of bounds
  stack and memory overwrites triggered with huge test case definitions.

Daniel Stenberg (13 Feb 2010)
- Martin Hager reported and fixed a problem with a missing quote in libcurl.m4

  (http://curl.haxx.se/bug/view.cgi?id=2951319)

- Tom Donovan fixed the CURL_FORMAT_* defines when building with cmake.

  (http://curl.haxx.se/bug/view.cgi?id=2951269)

Daniel Stenberg (12 Feb 2010)
- Jack Zhang reported a problem with SMTP: we wrongly used multiple addresses
  in the same RCPT TO line, when they should be sent in separate single
  commands. I updated test case 802 to verify this.

- I also fixed a bad use of my_setopt_str() of CURLOPT_MAIL_RCPT in the curl
  tool which made it try to output it as string for the --libcurl feature
  which could lead to crashes.

Yang Tse (11 Feb 2010)
- Steven M. Schweda fixed VMS builder bad behavior when used in a batch job,
  removed obsolete batch_compile.com and defines.com and updated VMS readme.

Version 7.20.0 (9 February 2010)

Daniel Stenberg (9 Feb 2010)
- When downloading compressed content over HTTP and the app asked libcurl to
  automatically uncompress it with the CURLOPT_ENCODING option, libcurl could
  wrongly provide the callback with more data than the maximum documented
  amount. An application could thus get tricked into badness if the maximum
  limit was trusted to be enforced by libcurl itself (as it is documented).

  This is further detailed and explained in the libcurl security advisory
  20100209 at

    http://curl.haxx.se/docs/adv_20100209.html

Daniel Fandrich (3 Feb 2010)
- Changed the Watcom makefiles to make them easier to keep in sync with
  Makefile.inc since that can't be included directly.