Loading CHANGES +13 −4 Original line number Diff line number Diff line Loading @@ -6,12 +6,20 @@ History of Changes Version *upcoming* 7.4 Version 7.4.1 Daniel (16 October 2000) - I forgot to remove some of the malloc debug defines from the makefiles in the release archive (of course). Version 7.4 Daniel (16 October 2000) - The buffer overflow mentioned below was posted to bugtraq on Friday 13th. Daniel (12 October 2000) - Colin Robert Phipps elegantly corrected a buffer overflow. It could be used by an evil ftp to crash curl. I took the opportunity of replacing a few other sprintf()s into snprintf()s as well. by an evil ftp server to crash curl. I took the opportunity of replacing a few other sprintf()s into snprintf()s as well. Daniel (11 October 2000) - Found some more memory leaks. This new simple memory debugger has turned out Loading Loading @@ -48,7 +56,8 @@ Daniel (9 October 2000) all memory fiddling functions. An additional perl script is used to analyze the output logfile and to match malloc()s with free()s etc. The memory leak Georg found turned out to be the main cookie struct that cookie_cleanup() didn't free! didn't free! The perl script is named memanalyze.pl and it is available in the CVS respository, not in the release archive. Daniel (8 October 2000) - Georg Horn found a GetHost() problem. It turned out it never assigned the Loading configure.in +2 −3 Original line number Diff line number Diff line dnl $Id$ dnl Process this file with autoconf to produce a configure script. AC_INIT(lib/urldata.h) AM_CONFIG_HEADER(config.h) AM_INIT_AUTOMAKE(curl,"7.4-pre3") AM_CONFIG_HEADER(config.h src/config.h) AM_INIT_AUTOMAKE(curl,"7.4.1") AM_PROG_LIBTOOL dnl Loading Loading @@ -554,7 +554,6 @@ AC_OUTPUT( Makefile \ docs/Makefile \ include/Makefile \ include/curl/Makefile \ src/config.h \ src/Makefile \ lib/Makefile ) dnl perl/checklinks.pl \ Loading include/curl/curl.h +2 −2 Original line number Diff line number Diff line Loading @@ -438,8 +438,8 @@ char *curl_getenv(char *variable); char *curl_version(void); /* This is the version number */ #define LIBCURL_VERSION "7.4-pre5" #define LIBCURL_VERSION_NUM 0x070400 #define LIBCURL_VERSION "7.4.1" #define LIBCURL_VERSION_NUM 0x070401 /* linked-list structure for the CURLOPT_QUOTE option (and other) */ struct curl_slist { Loading lib/Makefile.in +4 −4 Original line number Diff line number Diff line Loading @@ -82,11 +82,11 @@ AUTOMAKE_OPTIONS = foreign lib_LTLIBRARIES = libcurl.la # Some flags needed when trying to cause warnings ;-) # CFLAGS = -g -Wall #-pedantic # CFLAGS = -DMALLOCDEBUG -g # -Wall #-pedantic INCLUDES = -I$(top_srcdir)/include libcurl_la_SOURCES = arpa_telnet.h file.c getpass.h netrc.h timeval.c base64.c file.h hostip.c progress.c timeval.h base64.h formdata.c hostip.h progress.h cookie.c formdata.h http.c sendf.c cookie.h ftp.c http.h sendf.h url.c dict.c ftp.h if2ip.c speedcheck.c url.h dict.h getdate.c if2ip.h speedcheck.h urldata.h download.c getdate.h ldap.c ssluse.c version.c download.h getenv.c ldap.h ssluse.h escape.c getenv.h mprintf.c telnet.c escape.h getpass.c netrc.c telnet.h writeout.c writeout.h highlevel.c strequal.c strequal.h easy.c security.h security.c krb4.c libcurl_la_SOURCES = arpa_telnet.h file.c getpass.h netrc.h timeval.c base64.c file.h hostip.c progress.c timeval.h base64.h formdata.c hostip.h progress.h cookie.c formdata.h http.c sendf.c cookie.h ftp.c http.h sendf.h url.c dict.c ftp.h if2ip.c speedcheck.c url.h dict.h getdate.c if2ip.h speedcheck.h urldata.h download.c getdate.h ldap.c ssluse.c version.c download.h getenv.c ldap.h ssluse.h escape.c getenv.h mprintf.c telnet.c escape.h getpass.c netrc.c telnet.h getinfo.c highlevel.c strequal.c strequal.h easy.c security.h security.c krb4.c memdebug.c memdebug.h mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs CONFIG_HEADER = ../config.h ../src/config.h Loading @@ -103,8 +103,8 @@ libcurl_la_LIBADD = libcurl_la_OBJECTS = file.lo timeval.lo base64.lo hostip.lo progress.lo \ formdata.lo cookie.lo http.lo sendf.lo ftp.lo url.lo dict.lo if2ip.lo \ speedcheck.lo getdate.lo download.lo ldap.lo ssluse.lo version.lo \ getenv.lo escape.lo mprintf.lo telnet.lo getpass.lo netrc.lo \ writeout.lo highlevel.lo strequal.lo easy.lo security.lo krb4.lo getenv.lo escape.lo mprintf.lo telnet.lo getpass.lo netrc.lo getinfo.lo \ highlevel.lo strequal.lo easy.lo security.lo krb4.lo memdebug.lo CFLAGS = @CFLAGS@ COMPILE = $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) --mode=compile $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) Loading src/hugehelp.c +16 −9 Original line number Diff line number Diff line Loading @@ -496,11 +496,17 @@ puts ( " size_upload The total amount of bytes that were\n" " uploaded.\n" "\n" " size_header The total amount of bytes of the down\n" " loaded headers.\n" "\n" " size_request The total amount of bytes that were sent\n" " in the HTTP request.\n" "\n" " speed_download The average download speed that curl\n" " measured for the complete download.\n" "\n" " speed_upload The average upload speed that curl mea\n" " sured for the complete download.\n" " sured for the complete upload.\n" "\n" " -x/--proxy <proxyhost[:port]>\n" " Use specified proxy. If the port number is not speci\n" Loading Loading @@ -575,7 +581,6 @@ puts ( "\n" " FTP_PROXY [protocol://]<host>[:port]\n" " Sets proxy server to use for FTP.\n" "\n" " GOPHER_PROXY [protocol://]<host>[:port]\n" " Sets proxy server to use for GOPHER.\n" "\n" Loading Loading @@ -627,12 +632,12 @@ puts ( "\n" " 12 FTP weird USER reply. Curl couldn't parse the reply\n" " sent to the USER request.\n" "\n" " 13 FTP weird PASV reply, Curl couldn't parse the reply\n" " sent to the PASV request.\n" "\n" " 14 FTP weird 227 formay. Curl couldn't parse the 227-line\n" " the server sent.\n" "\n" " 15 FTP can't get host. Couldn't resolve the host IP we got\n" " in the 227-line.\n" "\n" Loading Loading @@ -685,6 +690,7 @@ puts ( "\n" " 34 HTTP post error. Internal post-request generation\n" " error.\n" "\n" " 35 SSL connect error. The SSL handshaking failed.\n" "\n" " 36 FTP bad download resume. Couldn't continue an earlier\n" Loading Loading @@ -743,13 +749,13 @@ puts ( " - Felix von Leitner <felix@convergence.de>\n" " - Dan Zitter <dzitter@zitter.net>\n" " - Jongki Suwandi <Jongki.Suwandi@eng.sun.com>\n" ); puts( " - Chris Maltby <chris@aurema.com>\n" " - Ron Zapp <rzapper@yahoo.com>\n" " - Paul Marquis <pmarquis@iname.com>\n" " - Ellis Pritchard <ellis@citria.com>\n" " - Damien Adant <dams@usa.net>\n" ); puts( " - Chris <cbayliss@csc.come>\n" " - Marco G. Salvagno <mgs@whiz.cjb.net>\n" " - Paul Marquis <pmarquis@iname.com>\n" Loading @@ -764,6 +770,7 @@ puts ( " - Stephen Kick <skick@epicrealm.com>\n" " - Martin Hedenfalk <mhe@stacken.kth.se>\n" " - Richard Prescott\n" " - Jason S. Priebe <priebe@wral-tv.com>\n" "\n" "WWW\n" " http://curl.haxx.se\n" Loading Loading @@ -1057,14 +1064,14 @@ puts ( " being available or contain certain data.\n" "\n" " curl -e www.coolsite.com http://www.showme.com/\n" ); puts( "\n" "USER AGENT\n" "\n" " A HTTP request has the option to include information about the browser\n" " that generated the request. Curl allows it to be specified on the command\n" " line. It is especially useful to fool or trick stupid servers or CGI\n" ); puts( " scripts that only accept certain browsers.\n" "\n" " Example:\n" Loading Loading @@ -1318,14 +1325,14 @@ puts ( "\n" " Many older SSL-servers have problems with SSLv3 or TLS, that newer versions\n" " of OpenSSL etc is using, therefore it is sometimes useful to specify what\n" ); puts( " SSL-version curl should use. Use -3 or -2 to specify that exact SSL version\n" " to use:\n" "\n" " curl -2 https://secure.site.com/\n" "\n" " Otherwise, curl will first attempt to use v3 and then v2.\n" ); puts( "\n" " To use OpenSSL to convert your favourite browser's certificate into a PEM\n" " formatted one that curl can use, do something like this (assuming netscape,\n" Loading Loading
CHANGES +13 −4 Original line number Diff line number Diff line Loading @@ -6,12 +6,20 @@ History of Changes Version *upcoming* 7.4 Version 7.4.1 Daniel (16 October 2000) - I forgot to remove some of the malloc debug defines from the makefiles in the release archive (of course). Version 7.4 Daniel (16 October 2000) - The buffer overflow mentioned below was posted to bugtraq on Friday 13th. Daniel (12 October 2000) - Colin Robert Phipps elegantly corrected a buffer overflow. It could be used by an evil ftp to crash curl. I took the opportunity of replacing a few other sprintf()s into snprintf()s as well. by an evil ftp server to crash curl. I took the opportunity of replacing a few other sprintf()s into snprintf()s as well. Daniel (11 October 2000) - Found some more memory leaks. This new simple memory debugger has turned out Loading Loading @@ -48,7 +56,8 @@ Daniel (9 October 2000) all memory fiddling functions. An additional perl script is used to analyze the output logfile and to match malloc()s with free()s etc. The memory leak Georg found turned out to be the main cookie struct that cookie_cleanup() didn't free! didn't free! The perl script is named memanalyze.pl and it is available in the CVS respository, not in the release archive. Daniel (8 October 2000) - Georg Horn found a GetHost() problem. It turned out it never assigned the Loading
configure.in +2 −3 Original line number Diff line number Diff line dnl $Id$ dnl Process this file with autoconf to produce a configure script. AC_INIT(lib/urldata.h) AM_CONFIG_HEADER(config.h) AM_INIT_AUTOMAKE(curl,"7.4-pre3") AM_CONFIG_HEADER(config.h src/config.h) AM_INIT_AUTOMAKE(curl,"7.4.1") AM_PROG_LIBTOOL dnl Loading Loading @@ -554,7 +554,6 @@ AC_OUTPUT( Makefile \ docs/Makefile \ include/Makefile \ include/curl/Makefile \ src/config.h \ src/Makefile \ lib/Makefile ) dnl perl/checklinks.pl \ Loading
include/curl/curl.h +2 −2 Original line number Diff line number Diff line Loading @@ -438,8 +438,8 @@ char *curl_getenv(char *variable); char *curl_version(void); /* This is the version number */ #define LIBCURL_VERSION "7.4-pre5" #define LIBCURL_VERSION_NUM 0x070400 #define LIBCURL_VERSION "7.4.1" #define LIBCURL_VERSION_NUM 0x070401 /* linked-list structure for the CURLOPT_QUOTE option (and other) */ struct curl_slist { Loading
lib/Makefile.in +4 −4 Original line number Diff line number Diff line Loading @@ -82,11 +82,11 @@ AUTOMAKE_OPTIONS = foreign lib_LTLIBRARIES = libcurl.la # Some flags needed when trying to cause warnings ;-) # CFLAGS = -g -Wall #-pedantic # CFLAGS = -DMALLOCDEBUG -g # -Wall #-pedantic INCLUDES = -I$(top_srcdir)/include libcurl_la_SOURCES = arpa_telnet.h file.c getpass.h netrc.h timeval.c base64.c file.h hostip.c progress.c timeval.h base64.h formdata.c hostip.h progress.h cookie.c formdata.h http.c sendf.c cookie.h ftp.c http.h sendf.h url.c dict.c ftp.h if2ip.c speedcheck.c url.h dict.h getdate.c if2ip.h speedcheck.h urldata.h download.c getdate.h ldap.c ssluse.c version.c download.h getenv.c ldap.h ssluse.h escape.c getenv.h mprintf.c telnet.c escape.h getpass.c netrc.c telnet.h writeout.c writeout.h highlevel.c strequal.c strequal.h easy.c security.h security.c krb4.c libcurl_la_SOURCES = arpa_telnet.h file.c getpass.h netrc.h timeval.c base64.c file.h hostip.c progress.c timeval.h base64.h formdata.c hostip.h progress.h cookie.c formdata.h http.c sendf.c cookie.h ftp.c http.h sendf.h url.c dict.c ftp.h if2ip.c speedcheck.c url.h dict.h getdate.c if2ip.h speedcheck.h urldata.h download.c getdate.h ldap.c ssluse.c version.c download.h getenv.c ldap.h ssluse.h escape.c getenv.h mprintf.c telnet.c escape.h getpass.c netrc.c telnet.h getinfo.c highlevel.c strequal.c strequal.h easy.c security.h security.c krb4.c memdebug.c memdebug.h mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs CONFIG_HEADER = ../config.h ../src/config.h Loading @@ -103,8 +103,8 @@ libcurl_la_LIBADD = libcurl_la_OBJECTS = file.lo timeval.lo base64.lo hostip.lo progress.lo \ formdata.lo cookie.lo http.lo sendf.lo ftp.lo url.lo dict.lo if2ip.lo \ speedcheck.lo getdate.lo download.lo ldap.lo ssluse.lo version.lo \ getenv.lo escape.lo mprintf.lo telnet.lo getpass.lo netrc.lo \ writeout.lo highlevel.lo strequal.lo easy.lo security.lo krb4.lo getenv.lo escape.lo mprintf.lo telnet.lo getpass.lo netrc.lo getinfo.lo \ highlevel.lo strequal.lo easy.lo security.lo krb4.lo memdebug.lo CFLAGS = @CFLAGS@ COMPILE = $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) --mode=compile $(CC) $(DEFS) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) Loading
src/hugehelp.c +16 −9 Original line number Diff line number Diff line Loading @@ -496,11 +496,17 @@ puts ( " size_upload The total amount of bytes that were\n" " uploaded.\n" "\n" " size_header The total amount of bytes of the down\n" " loaded headers.\n" "\n" " size_request The total amount of bytes that were sent\n" " in the HTTP request.\n" "\n" " speed_download The average download speed that curl\n" " measured for the complete download.\n" "\n" " speed_upload The average upload speed that curl mea\n" " sured for the complete download.\n" " sured for the complete upload.\n" "\n" " -x/--proxy <proxyhost[:port]>\n" " Use specified proxy. If the port number is not speci\n" Loading Loading @@ -575,7 +581,6 @@ puts ( "\n" " FTP_PROXY [protocol://]<host>[:port]\n" " Sets proxy server to use for FTP.\n" "\n" " GOPHER_PROXY [protocol://]<host>[:port]\n" " Sets proxy server to use for GOPHER.\n" "\n" Loading Loading @@ -627,12 +632,12 @@ puts ( "\n" " 12 FTP weird USER reply. Curl couldn't parse the reply\n" " sent to the USER request.\n" "\n" " 13 FTP weird PASV reply, Curl couldn't parse the reply\n" " sent to the PASV request.\n" "\n" " 14 FTP weird 227 formay. Curl couldn't parse the 227-line\n" " the server sent.\n" "\n" " 15 FTP can't get host. Couldn't resolve the host IP we got\n" " in the 227-line.\n" "\n" Loading Loading @@ -685,6 +690,7 @@ puts ( "\n" " 34 HTTP post error. Internal post-request generation\n" " error.\n" "\n" " 35 SSL connect error. The SSL handshaking failed.\n" "\n" " 36 FTP bad download resume. Couldn't continue an earlier\n" Loading Loading @@ -743,13 +749,13 @@ puts ( " - Felix von Leitner <felix@convergence.de>\n" " - Dan Zitter <dzitter@zitter.net>\n" " - Jongki Suwandi <Jongki.Suwandi@eng.sun.com>\n" ); puts( " - Chris Maltby <chris@aurema.com>\n" " - Ron Zapp <rzapper@yahoo.com>\n" " - Paul Marquis <pmarquis@iname.com>\n" " - Ellis Pritchard <ellis@citria.com>\n" " - Damien Adant <dams@usa.net>\n" ); puts( " - Chris <cbayliss@csc.come>\n" " - Marco G. Salvagno <mgs@whiz.cjb.net>\n" " - Paul Marquis <pmarquis@iname.com>\n" Loading @@ -764,6 +770,7 @@ puts ( " - Stephen Kick <skick@epicrealm.com>\n" " - Martin Hedenfalk <mhe@stacken.kth.se>\n" " - Richard Prescott\n" " - Jason S. Priebe <priebe@wral-tv.com>\n" "\n" "WWW\n" " http://curl.haxx.se\n" Loading Loading @@ -1057,14 +1064,14 @@ puts ( " being available or contain certain data.\n" "\n" " curl -e www.coolsite.com http://www.showme.com/\n" ); puts( "\n" "USER AGENT\n" "\n" " A HTTP request has the option to include information about the browser\n" " that generated the request. Curl allows it to be specified on the command\n" " line. It is especially useful to fool or trick stupid servers or CGI\n" ); puts( " scripts that only accept certain browsers.\n" "\n" " Example:\n" Loading Loading @@ -1318,14 +1325,14 @@ puts ( "\n" " Many older SSL-servers have problems with SSLv3 or TLS, that newer versions\n" " of OpenSSL etc is using, therefore it is sometimes useful to specify what\n" ); puts( " SSL-version curl should use. Use -3 or -2 to specify that exact SSL version\n" " to use:\n" "\n" " curl -2 https://secure.site.com/\n" "\n" " Otherwise, curl will first attempt to use v3 and then v2.\n" ); puts( "\n" " To use OpenSSL to convert your favourite browser's certificate into a PEM\n" " formatted one that curl can use, do something like this (assuming netscape,\n" Loading
