When negotiating SASL DIGEST-MD5 authentication, the function
Curl_sasl_create_digest_md5_message() uses the data provided from the
server without doing the proper length checks and that data is then
appended to a local fixed-size buffer on the stack.

This vulnerability can be exploited by someone who is in control of a
server that a libcurl based program is accessing with POP3, SMTP or
IMAP. For applications that accept user provided URLs, it is also
thinkable that a malicious user would feed an application with a URL to
a server hosting code targetting this flaw.

Bug: http://curl.haxx.se/docs/adv_20130206.html

Removed whitespace introduced in commit 5f8f20f5 that caused
formatting issues when generating the website docs.

- rename post-config-vms.h to setup-vms.h
- move its inclusion into proper location in curl_setup.h

- remove multiple declarations of vms_show and add comments

- remove header inclusion already done in curl_setup_once.h

Added SMTP, SMTPS, POP3, POP3S, IMAP and IMAPS features.

Corrected comment clarification made in commit 167717b8.

8 more bug fixes mentioned

config_h.com is a new file that generates a config.h file based on the
curl_config.h.in file and a quick scan of the configure script.  This is
actually a generic procedure that is shared with other VMS packages.

The existing pre-built config-vms.h had over 100 entries that were not
correct and in some cases conflicted with the build options available in
the build_vms.com.

generate_config_vms_h_curl.com is a helper procedure to the
config_h.com.  It covers the cases that the generic config_h.com is not
able to figure out, and accepts input from the build_vms.com procedure.

build_curlbuild_h.com is a new file to generate the curlbuild.h file
that Curl is now using when it is using a curl_config.h file.

post-config-vms.h is a new file that is needed to provide VMS specific
definitions, and most of them need to be set before the system header
files are included.

The VMS build procedure is fixed:

   1. Fixed to link in the correct HP ssl library.
   2. Fixed to detect if HP Kerberos is installed.
   3. Fixed to detect if HP LDAP is installed.
   4. Fixed to detect if gnv$libzshr is installed.
   5. Simplified the input parameter parsing to not use a loop.
   6. Warn that 64 bit pointer option support is not complete
      in comments.
   7. Default to IEEE floating if platform supports it so
      resulting libcurl will be compatible with other
      open source projects on VMS.
   8. Default to LARGEFILE if platform supports it.
   9. Default to enable SSL, LDAP, Kerberos, libz
      if the libraries are present.
   10. Build with exact case global symbols for libcurl.
   11. Generate linker option file needed.
   12. Compiler list option only commonly needed items.
   13. fulllist option for those who really want it.
   14. Create debug symbol file on Alpha, IA64.

By doing this unconditionally, we infer a simpler and more defined
behavior. This also has the upside that test 1021 no longer fails for me
even if I run with valgrind.

Also fixed some wrong comments.

Tidied up the comments in the endofresp() functions to be more
meaningful prior to release.

According KB975858 this flag may cause problems on Windows 7 and
Windows Server 2008 R2 systems. Extended error information is not
currently used by libcurl and therefore not a requirement.

The flag may improve the SSL-connection shutdown in case of an
error. This means it might be a good improvement in the future.

Fixes bug/issue #1187 - thanks for the report

The 56b7c87c change left a case where a good sockfd was not copied to
*sockp before returning with CURLE_OK

pointed out by clang-analyzer

pointed out by clang-analyzer

When a connection is no longer used, it is kept in the cache. If the
cache is full, the oldest idle connection is closed. If no connection is
idle, the current one is closed instead.

Added recent additions and fixes following the changes to imap, pop3
and smtp. Additionally added another contributor that helped to test
the imap sasl changes.

Provided additional clarification about the logic of the authenticate()
functions following commit 6b6bdc83 and b4270a9a.

Bug: http://curl.haxx.se/bug/view.cgi?id=1186

Rich Gray provided good feedback and we now clarify that you can in fact
stop a multi transfer at any point you like by removing the easy handle.

Tidied up code from commit 6b6bdc83Updated where a few instances of
the pop3c struct variable used the longer conndata struct rather than
matching what other code in pop3_authenticate() used.

Fixed an issue where (lib)curl is compiled without support for a
supported challenge-response based SASL authentication mechanism, such
as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN
mechanisms and (lib)curl doesn't fallback to Clear Text authentication.

Note: In order to fallback to Clear Text authentication properly this
fix adds support for the LOGINDISABLED server capability.
imap: Fixed no known authentication mechanism when fallback is required

Fixed an issue where (lib)curl is compiled without support for a
supported challenge-response based SASL authentication mechanism, such
as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN
mechanisms and (lib)curl doesn't fallback to Clear Text authentication.

Note: In order to fallback to Clear Text authentication properly this
fix adds support for the LOGINDISABLED server capability.

Related bug: http://curl.haxx.se/mail/lib-2013-02/0004.html
Reported by: Stanislav Ivochkin

Fixed an issue where (lib)curl is compiled without support for a
supported challenge-response based SASL authentication mechanism, such
as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN
mechanisms and (lib)curl doesn't fallback to APOP or Clear Text
authentication.

Bug: http://curl.haxx.se/mail/lib-2013-02/0004.html
Reported by: Stanislav Ivochkin

Remove timeout argument that's never used.

Make the actual connection get detected on a single spot to reduce code
duplication.

Store the IPv6 state already when the connection is attempted.

Curl_perfom is no longer used anywhere since the always-multi commit
c4312741, and some related functions were used only from within
Curl_perfom.

- Fix a pair of single quotes to double quotes.

URL: http://curl.haxx.se/mail/lib-2013-01/0355.html
Reported by: Tor Arntsen

- Take into account that 'wc' may return leading spaces and/or tabs.

- Set initial IFS to space, tab and newline.

- Take into account that 'wc' may return leading spaces.

- Set internationalization behavior variables.

Tor Arntsen analyzed and reported the issue.

URL: http://curl.haxx.se/mail/lib-2013-01/0351.html

Added CURLOPT_FOLLOWLOCATION since example.com is now redirected.