- May 01, 2019
-
-
Daniel Gustafsson authored
In case the name pointer isn't set (due to memory pressure most likely) we need to skip the prefix matching and reject with a badcookie to avoid a possible NULL pointer dereference. Closes #3820 #3821 Reported-by: Jonathan Moerman Reviewed-by: Daniel Stenberg <daniel@haxx.se>
-
- Apr 30, 2019
-
-
Patrick Monnerat authored
-
- Apr 29, 2019
-
-
Kamil Dudka authored
Closes #3808
-
Reed Loden authored
Closes #3811
-
Daniel Stenberg authored
This limits all accepted input strings passed to libcurl to be less than CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls: curl_easy_setopt() and curl_url_set(). The 8000000 number is arbitrary picked and is meant to detect mistakes or abuse, not to limit actual practical use cases. By limiting the acceptable string lengths we also reduce the risk of integer overflows all over. NOTE: This does not apply to `CURLOPT_POSTFIELDS`. Test 1559 verifies. Closes #3805
-
- Apr 28, 2019
-
-
Tseng Jun authored
Closes #3809
-
- Apr 27, 2019
-
-
Simon Warta authored
Closes https://github.com/curl/curl/pull/3769
-
- Apr 23, 2019
-
-
Steve Holme authored
-
Steve Holme authored
Just like we do for mbed TLS, use our local implementation of MD4 when OpenSSL doesn't support it. This allows a type-3 message to include the NT response.
-
Daniel Gustafsson authored
Kerberos was incorrectly indented as a subsection under FTP, which is incorrect as they are both top level sections. A fix for this was first attempted in commit fef38a08 but that was a few paddles short of being complete.
-
Aron Bergman authored
Add the subsections under "Structs in libcurl" to the table of contents. Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
-
Aron Bergman authored
Make all struct members under the Curl_handler section print in monospace font. Closes #3801 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
-
- Apr 22, 2019
-
-
Daniel Stenberg authored
Introducing the curl bug bounty program on hackerone. We now recommend filing security issues directly in the hackerone ticket system which only is readable to curl security team members. Assisted-by: Daniel Gustafsson Closes #3488
-
Steve Holme authored
RFC 4616 specifies the authzid is optional in the client authentication message and that the server will derive the authorisation identity (authzid) from the authentication identity (authcid) when not specified by the client.
-
Gisle Vanem authored
Follow-up to 76b63489 which renamed logfile as curl_dbg_logfile. Ref: https://github.com/curl/curl/commit/76b6348#r33259088
-
- Apr 21, 2019
-
-
Steve Holme authored
Follow up to 762a292f.
-
Daniel Stenberg authored
-
Daniel Stenberg authored
-
Daniel Stenberg authored
... and disconnect too old ones instead of trying to reuse. Default max age is set to 118 seconds. Ref: #3722 Closes #3782
-
- Apr 20, 2019
-
-
Po-Chuan Hsieh authored
ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is disabled. Fix by splitting out the function into a separate file which can be included where needed. Closes #3717 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
-
Daniel Stenberg authored
-
Daniel Stenberg authored
which basically just makes sure LOGOUT is *not* issued on disconnect
-
Daniel Stenberg authored
Since the connection has been used by the "outside" we don't know the state of it anymore and curl should not use it anymore. Bug: https://curl.haxx.se/mail/lib-2019-04/0052.html Closes #3795
-
- Apr 19, 2019
-
-
Daniel Stenberg authored
The list of names must be in sync with the defined states in the header file!
-
- Apr 16, 2019
-
-
Steve Holme authored
-
Steve Holme authored
Fixes #3768 Closes #3785
-
Jay Satiro authored
-
Daniel Stenberg authored
-
Jay Satiro authored
.. because functionality may be affected if the versions differ. This commit implements TODO 18.7 "warning if curl version is not in sync with libcurl version". Ref: https://github.com/curl/curl/blob/curl-7_64_1/docs/TODO#L1028-L1033 Closes https://github.com/curl/curl/pull/3774
-
- Apr 15, 2019
-
-
Steve Holme authored
-
Steve Holme authored
-
Steve Holme authored
Following 28f826b3 to return CURLE_OK instead of numeric 0.
-
Daniel Gustafsson authored
Make sure to run curl_global_cleanup() when shutting down the test suite to release any resources allocated in the SSL setup. This is clearly visible when running tests with PolarSSL where the thread lock calloc() memory which isn't released when not running cleanup. Below is an excerpt from the autobuild logs: ==12368== 96 bytes in 1 blocks are possibly lost in loss record 1 of 2 ==12368== at 0x4837B65: calloc (vg_replace_malloc.c:752) ==12368== by 0x11A76E: curl_dbg_calloc (memdebug.c:205) ==12368== by 0x145CDF: Curl_polarsslthreadlock_thread_setup (polarssl_threadlock.c:54) ==12368== by 0x145B37: Curl_polarssl_init (polarssl.c:865) ==12368== by 0x14129D: Curl_ssl_init (vtls.c:171) ==12368== by 0x118B4C: global_init (easy.c:158) ==12368== by 0x118BF5: curl_global_init (easy.c:221) ==12368== by 0x118D0B: curl_easy_init (easy.c:299) ==12368== by 0x114E96: test (lib1906.c:32) ==12368== by 0x115495: main (first.c:174) Closes #3783 Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
-
Marcel Raad authored
No need to build it from source anymore. Closes https://github.com/curl/curl/pull/3779
-
Marcel Raad authored
This makes building libpsl and libidn2 from source unnecessary and removes the need for the autopoint and libunistring-dev packages. Closes https://github.com/curl/curl/pull/3779
-
Daniel Stenberg authored
... without a $srcdir prefix. Triggered by the failures in several autobuilds. Closes #3781
-
- Apr 14, 2019
-
-
Daniel Gustafsson authored
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
-
Daniel Gustafsson authored
Mark global variables static to avoid compiler warning in Clang when using -Wmissing-variable-declarations. Closes #3778 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
-
Steve Holme authored
The indentation from 211d5329 and 57d6d253 was a little strange as parts didn't align correctly, uses 4 spaces rather than 2. Checked the indentation of the original source so it aligns, albeit, using curl style.
-
Steve Holme authored
-