- 22 Jun, 2013 13 commits
-
-
Daniel Stenberg authored
... and restore the ordinary handling again when it returns. This is done for curl_easy_perform() and curl_easy_cleanup() only for now - and only when built to use OpenSSL as backend as this is the known culprit for the spurious SIGPIPEs people have received. Bug: http://curl.haxx.se/bug/view.cgi?id=1180 Reported by: Lluís Batlle i Rossell
-
Daniel Stenberg authored
-
Daniel Stenberg authored
This erroneously run unit test 1310 instead of 1396!
-
Kamil Dudka authored
... to prevent failure when a non-default -b option is given
-
Kamil Dudka authored
-
Nick Zitzmann authored
This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
-
Alessandro Ghedini authored
-
Daniel Stenberg authored
RFC3986 details how a path part passed in as part of a URI should be "cleaned" from dot sequences before getting used. The described algorithm is now implemented in lib/dotdot.c with the accompanied test case in test 1395. Bug: http://curl.haxx.se/bug/view.cgi?id=1200 Reported-by: Alex Vinnik
-
Daniel Stenberg authored
-
Daniel Stenberg authored
-
Daniel Stenberg authored
-
Daniel Stenberg authored
-
Daniel Stenberg authored
Security problem: CVE-2013-2174 If a program would give a string like "%FF" to curl_easy_unescape() but ask for it to decode only the first byte, it would still parse and decode the full hex sequence. The function then not only read beyond the allowed buffer but it would also deduct the *unsigned* counter variable for how many more bytes there's left to read in the buffer by two, making the counter wrap. Continuing this, the function would go on reading beyond the buffer and soon writing beyond the allocated target buffer... Bug: http://curl.haxx.se/docs/adv_20130622.html Reported-by: Timo Sirainen
-
- 20 Jun, 2013 3 commits
-
-
Guenter Knauf authored
-
Daniel Stenberg authored
As a remedy to the problem when a socket gets closed and a new one is opened with the same file descriptor number and as a result multi.c:singlesocket() doesn't detect the difference, the new function Curl_multi_closed() gets told when a socket is closed so that it can be removed from the socket hash. When the old one has been removed, a new socket should be detected fine by the singlesocket() on next invoke. Bug: http://curl.haxx.se/bug/view.cgi?id=1248 Reported-by: Erik Johansson
-
Daniel Stenberg authored
-
- 18 Jun, 2013 1 commit
-
-
Daniel Stenberg authored
-
- 17 Jun, 2013 2 commits
-
-
Daniel Stenberg authored
When performing COOKIELIST operations the cookie lock needs to be taken for the cases where the cookies are shared among multiple handles! Verified by Benjamin Gilbert's updated test 506 Bug: http://curl.haxx.se/bug/view.cgi?id=1215 Reported-by: Benjamin Gilbert
-
Benjamin Gilbert authored
It doesn't right now: http://curl.haxx.se/bug/view.cgi?id=1215
-
- 15 Jun, 2013 1 commit
-
-
Daniel Stenberg authored
-
- 14 Jun, 2013 1 commit
-
-
Daniel Stenberg authored
Make it clearer that the CURLOPT_PROGRESSFUNCTION callback will be called more frequently than once per second when things are happening.
-
- 13 Jun, 2013 3 commits
-
-
Daniel Stenberg authored
Mention 7 recent bug fixes and their associated contributors
-
Daniel Stenberg authored
-
Daniel Stenberg authored
When curl_multi_wait() finds no file descriptor to wait for, it returns instantly and this must be handled gracefully within curl_easy_perform() or cause a busy-loop. Starting now, repeated fast returns without any file descriptors is detected and a gradually increasing sleep will be used (up to a max of 1000 milliseconds) before continuing the loop. Bug: http://curl.haxx.se/bug/view.cgi?id=1238 Reported-by: Miguel Angel
-
- 12 Jun, 2013 4 commits
-
-
YAMADA Yasuharu authored
The initial fix to only compare full path names were done in commit 04f52e9b but found out to be incomplete. This takes should make the change more complete and there's now two additional tests to verify (test 31 and 62).
-
Sergei Nikulov authored
Makes it build on windows
-
Eric Hu authored
-
Eric Hu authored
-
- 10 Jun, 2013 5 commits
-
-
Daniel Stenberg authored
-
Daniel Stenberg authored
By always returning the md5 for an empty body when auth-int is asked for, libcurl now at least sometimes does the right thing. Bug: http://curl.haxx.se/bug/view.cgi?id=1235 Patched-by: Nach M. S.
-
Daniel Stenberg authored
Allow less room for "triggered too early" mistakes by applications / timers on non-windows platforms. Starting now, we assume that a timeout call is never made earlier than 3 milliseconds before the actual timeout. This greatly improves timeout accuracy on Linux. Bug: http://curl.haxx.se/bug/view.cgi?id=1228 Reported-by: Hang Su
-
Daniel Stenberg authored
In the pkcs12 code, we get a list of x509 records returned from PKCS12_parse but when iterating over the list and passing each to SSL_CTX_add_extra_chain_cert() we didn't also properly remove them from the "stack", which made them get freed twice (both in sk_X509_pop_free() and then later in SSL_CTX_free). This isn't really documented anywhere... Bug: http://curl.haxx.se/bug/view.cgi?id=1236 Reported-by: Nikaiw
-
Daniel Stenberg authored
-
- 07 Jun, 2013 3 commits
-
-
Aleksey Tulinov authored
When VERIFYHOST == 0, libcurl should let invalid certificates to pass.
-
Peter Gal authored
Update the documentation on how to specify a HTTP header with no content.
-
Daniel Stenberg authored
Added 11 bugs and 7 contributors
-
- 06 Jun, 2013 1 commit
-
-
Daniel Stenberg authored
After curl_multi_wait() returns, this test checked that we got exactly one file descriptor told to read from, but we cannot be sure that is true. curl_multi_wait() will sometimes return earlier without any file descriptor to handle, just just because it is a suitable time to call *perform(). This problem showed up with commit 29bf0598. Bug: http://curl.haxx.se/mail/lib-2013-06/0029.html Reported-by: Fabian Keil
-
- 04 Jun, 2013 3 commits
-
-
Daniel Stenberg authored
Bug: http://curl.haxx.se/bug/view.cgi?id=1239 Reported-by: Christian Weisgerber
-
Daniel Stenberg authored
-
Daniel Stenberg authored
If an ipv6-address is provided to CONNECT, the last hexadecimal group in the address will be used as the test number! For example the address "[1234::ff]" would be treated as test case 255.
-