- 26 Sep, 2018 1 commit
-
-
Daniel Stenberg authored
-
- 25 Sep, 2018 2 commits
-
-
Daniel Stenberg authored
Free 'header_recvbuf' unconditionally even if 'h2' isn't (yet) set, for early failures. Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10669 Closes #3046
-
Daniel Stenberg authored
If the rewind would fail, a strdup() would not get freed. Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10665 Closes #3044
-
- 24 Sep, 2018 5 commits
-
-
Viktor Szakats authored
The value in question is coming directly from `gnutls-serv`, so it cannot be modified freely. Reported-by: Marcel Raad Ref: https://github.com/curl/curl/commit/6ae6b2a533e8630afbb21f570305bd4ceece6348#commitcomment-30621004
-
Daniel Stenberg authored
Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10648 Closes #3042
-
Daniel Stenberg authored
Regression since 38203f15 Reported-by: Jean Fabrice Fixes #3023 Closes #3040
-
Christian Heimes authored
OpenSSL 1.1.1 requires clients to opt-in for post-handshake authentication. Fixes: https://github.com/curl/curl/issues/3026 Signed-off-by:
Christian Heimes <christian@python.org> Closes https://github.com/curl/curl/pull/3027
-
Even Rouault authored
This fixes potential out-of-buffer access on "file:./" URL $ valgrind curl "file:./" ==24516== Memcheck, a memory error detector ==24516== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==24516== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info ==24516== Command: /home/even/install-curl-git/bin/curl file:./ ==24516== ==24516== Conditional jump or move depends on uninitialised value(s) ==24516== at 0x4C31F9C: strcmp (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==24516== by 0x4EBB315: seturl (urlapi.c:801) ==24516== by 0x4EBB568: parseurl (urlapi.c:861) ==24516== by 0x4EBC509: curl_url_set (urlapi.c:1199) ==24516== by 0x4E644C6: parseurlandfillconn (url.c:2044) ==24516== by 0x4E67AEF: create_conn (url.c:3613) ==24516== by 0x4E68A4F: Curl_connect (url.c:4119) ==24516== by 0x4E7F0A4: multi_runsingle (multi.c:1440) ==24516== by 0x4E808E5: curl_multi_perform (multi.c:2173) ==24516== by 0x4E7558C: easy_transfer (easy.c:686) ==24516== by 0x4E75801: easy_perform (easy.c:779) ==24516== by 0x4E75868: curl_easy_perform (easy.c:798) Was originally spotted by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10637 Credit to OSS-Fuzz Closes #3039
-
- 23 Sep, 2018 6 commits
-
-
Viktor Szakats authored
- and one in docs/MANUAL as well Closes https://github.com/curl/curl/pull/3038
-
Viktor Szakats authored
- replace tabs with spaces where possible - remove line ending spaces - remove double/triple newlines at EOF - fix a non-UTF-8 character - cleanup a few indentations/line continuations in manual examples Closes https://github.com/curl/curl/pull/3037
-
Daniel Stenberg authored
Detected by Coverity. CID 1439610. Follow-up from 46e16406 Closes #3034
-
Daniel Stenberg authored
Detected by Coverity. CID 1439611. Follow-up from 46e16406
-
Daniel Stenberg authored
Fixes #2987 Closes #3035
-
Viktor Szakats authored
- also update two URLs outside of docs/examples - fix spelling of filename persistant.c - fix three long lines that started failing checksrc.pl Closes https://github.com/curl/curl/pull/3036
-
- 22 Sep, 2018 5 commits
-
-
Viktor Szakats authored
also: - fix two warnings in synctime.c (one of them Windows-specific) - upgrade URLs in synctime.c and remove a broken one Closes https://github.com/curl/curl/pull/3033
-
Daniel Stenberg authored
Closes #3030
-
Daniel Stenberg authored
Closes #3032
-
Daniel Stenberg authored
... to make it a truly unified URL parser. Closes #3017
-
Viktor Szakats authored
Closes https://github.com/curl/curl/pull/3031
-
- 21 Sep, 2018 5 commits
-
-
Daniel Stenberg authored
-
Daniel Stenberg authored
When trying to detect pthreads use on HPUX the checks will succeed without the correct -l option but then end up failing at run-time. Reported-by: Eason-Yu on github Fixes #2697 Closes #3025
-
Erik Minekus authored
Closes #3029
-
Daniel Stenberg authored
Closes #3024
-
Loganaden Velvindron authored
Closes #2971
-
- 20 Sep, 2018 3 commits
-
-
Daniel Stenberg authored
Removed DoH. Closes #2734
-
Jay Satiro authored
- Treat CURL_SSLVERSION_MAX_NONE the same as CURL_SSLVERSION_MAX_DEFAULT. Prior to this change NONE would mean use the minimum version also as the maximum. This is a follow-up to 6015cefb which changed the behavior of setting the SSL version so that the requested version would only be the minimum and not the maximum. It appears it was (mostly) implemented in OpenSSL but not other backends. In other words CURL_SSLVERSION_TLSv1_0 used to mean use just TLS v1.0 and now it means use TLS v1.0 *or later*. - Fix CURL_SSLVERSION_MAX_DEFAULT for OpenSSL. Prior to this change CURL_SSLVERSION_MAX_DEFAULT with OpenSSL was erroneously treated as always TLS 1.3, and would cause an error if OpenSSL was built without TLS 1.3 support. Co-authored-by: Daniel Gustafsson Fixes https://github.com/curl/curl/issues/2969 Closes https://github.com/curl/curl/pull/3012
-
Daniel Stenberg authored
As OpenSSL 1.1.1 starts to complain and fail on sha1 CAs: "SSL certificate problem: CA signature digest algorithm too weak" Closes #3014
-
- 19 Sep, 2018 5 commits
-
-
Daniel Stenberg authored
Assisted-by: Daniel Gustafsson Closes #3019
-
Daniel Stenberg authored
In order for this API to fully work for libcurl itself, it now offers a CURLU_GUESS_SCHEME flag that makes it "guess" scheme based on the host name prefix just like libcurl always did. If there's no known prefix, it will guess "http://". Separately, it relaxes the check of the host name so that IDN host names can be passed in as well. Both these changes are necessary for libcurl itself to use this API. Assisted-by: Daniel Gustafsson Closes #3018
-
Kamil Dudka authored
One can still use CA certificates stored in NSS database. Reported-by: Maxime Legros Bug: https://curl.haxx.se/mail/lib-2018-09/0077.html Closes #3016
-
Daniel Gustafsson authored
In the CURLUPART_URL case, there is no codepath which invokes url decoding so remove the assignment of the urldecode variable. This fixes the deadstore bug-report from clang static analysis. Closes #3015 Reviewed-by:
Daniel Stenberg <daniel@haxx.se>
-
Daniel Gustafsson authored
TODO item 1.1 was implemented in commit 946ce5b6 , update reference to it with instead referencing the implemented option. Closes #3013 Reviewed-by:
Daniel Stenberg <daniel@haxx.se>
-
- 18 Sep, 2018 5 commits
-
-
Daniel Stenberg authored
-
Daniel Stenberg authored
.... since getsock may update the expiry timer. Fixes #2996 Closes #3000
-
Daniel Stenberg authored
Closes #3004
-
Daniel Gustafsson authored
The reallocation was using the input pointer for the return value, which leads to a memory leak on reallication failure. Fix by instead use the safe internal API call Curl_saferealloc(). Closes #3005 Reviewed-by:
Daniel Stenberg <daniel@haxx.se> Reviewed-by:
Nick Zitzmann <nickzman@gmail.com>
-
- 17 Sep, 2018 2 commits
-
-
Kruzya authored
Make sure to not overwrite the reallocated pointer in realloc() calls to avoid a memleak on memory errors.
-
Daniel Gustafsson authored
ftp_send_command() was using vsnprintf() without including the libcurl *rintf() replacement header. Fix by including curl_printf.h and also add curl_memory.h while at it since memdebug.h depends on it. Closes #2999 Reviewed-by:
Daniel Stenberg <daniel@haxx.se>
-
- 16 Sep, 2018 1 commit
-
-
Si authored
Closes #2994
-