1
0
mirror of https://github.com/moparisthebest/curl synced 2024-11-11 03:55:03 -05:00
Commit Graph

22990 Commits

Author SHA1 Message Date
Daniel Stenberg
d52dc4760f
readwrite: make sure excess reads don't go beyond buffer end
CVE-2018-1000122
Bug: https://curl.haxx.se/docs/adv_2018-b047.html

Detected by OSS-fuzz
2018-03-12 07:47:07 +01:00
Daniel Stenberg
ddb879c6ae
BUGS: updated link to security process 2018-03-12 00:34:33 +01:00
Daniel Stenberg
72a0f6251a
limit-rate: kick in even before "limit" data has been received
... and make sure to avoid integer overflows with really large values.

Reported-by: 刘佩东
Fixes #2371
Closes #2373
2018-03-11 23:54:25 +01:00
Daniel Stenberg
029ae11034
docs/SECURITY.md -> docs/SECURITY-PROCESS.md 2018-03-11 23:41:50 +01:00
Daniel Stenberg
9c05701bed
SECURITY.md: call it the security process 2018-03-11 23:40:24 +01:00
Michael Kaufmann
7294e70480 Curl_range: fix FTP-only and FILE-only builds
follow-up to e04417d
2018-03-11 20:33:04 +01:00
Michael Kaufmann
a577059f92 hostip: fix compiler warning: 'variable set but not used' 2018-03-11 20:27:38 +01:00
Daniel Stenberg
8123560d44
HTTP: allow "header;" to replace an internal header with a blank one
Reported-by: Michael Kaufmann
Fixes #2357
Closes #2362
2018-03-11 11:46:10 +01:00
Daniel Stenberg
019aa722aa
http2: verbose output new MAX_CONCURRENT_STREAMS values
... as it is interesting for many users.
2018-03-10 23:56:21 +01:00
Daniel Stenberg
8b754c430b SECURITY: distros' max embargo time is 14 days now 2018-03-09 21:42:36 +01:00
Patrick Monnerat
82f0508099 curl tool: accept --compressed also if Brotli is enabled and zlib is not. 2018-03-08 01:39:29 +01:00
Daniel Stenberg
b2afc36da1
THANKS + mailmap: remove duplicates, fixup full names 2018-03-05 11:57:44 +01:00
sergii.kavunenko
613ccbf26c
WolfSSL: adding TLSv1.3
Closes #2349
2018-03-05 00:02:34 +01:00
Daniel Stenberg
cb281f9df0
RELEASE-NOTES/THANKS: synced with cc1d4c505 2018-03-04 23:20:12 +01:00
richardthe3rd
cc1d4c505e
winbuild: prefer documented zlib library names
Check for existence of import and static libraries with documented names
and use them if they do. Fallback to previous names.

According to
https://github.com/madler/zlib/blob/master/win32/README-WIN32.txt on
Windows, the names of the import library is "zdll.lib" and static
library is "zlib.lib".

closes #2354
2018-03-04 23:02:51 +01:00
Marcel Raad
612bc926f7
krb5: use nondeprecated functions
gss_seal/gss_unseal have been deprecated in favor of
gss_wrap/gss_unwrap with GSS-API v2 from January 1997 [1]. The first
version of "The Kerberos Version 5 GSS-API Mechanism" [2] from June
1996 already says "GSS_Wrap() (formerly GSS_Seal())" and
"GSS_Unwrap() (formerly GSS_Unseal())".

Use the nondeprecated functions to avoid deprecation warnings.

[1] https://tools.ietf.org/html/rfc2078
[2] https://tools.ietf.org/html/rfc1964

Closes https://github.com/curl/curl/pull/2356
2018-03-04 22:21:46 +01:00
Daniel Stenberg
c74521628b
curl.1: mention how to add numerical IP addresses in NO_PROXY 2018-03-04 19:57:43 +01:00
Daniel Stenberg
4d0b1e6887
CURLOPT_NOPROXY.3: mention how to list numerical IPv6 addresses 2018-03-04 19:51:37 +01:00
Daniel Stenberg
b7f90470be
NO_PROXY: fix for IPv6 numericals in the URL
Added test 1265 that verifies.

Reported-by: steelman on github
Fixes #2353
Closes #2355
2018-03-04 19:50:48 +01:00
Daniel Stenberg
8b0b1a3088
build: get CFLAGS (including -werror) used for examples and tests
... so that the CI and more detects compiler warnings/errors properly!

Closes #2337
2018-03-04 19:46:26 +01:00
Marcel Raad
68d84cfe98
curl_ctype: fix macro redefinition warnings
On MinGW and Cygwin, GCC and clang have been complaining about macro
redefinitions since 4272a0b0fc. Fix this
by undefining the macros before redefining them as suggested in
https://github.com/curl/curl/pull/2269.

Suggested-by: Daniel Stenberg
2018-03-03 19:52:43 +01:00
Dan Fandrich
c87c71b3fe unit1307: proper cleanup on OOM to fix torture tests 2018-03-02 20:51:59 +01:00
Marcel Raad
24753bcd48
unit1309: fix warning on Windows x64
When targeting x64, MinGW-w64 complains about conversions between
32-bit long and 64-bit pointers. Fix this by reusing the
GNUTLS_POINTER_TO_SOCKET_CAST / GNUTLS_SOCKET_TO_POINTER_CAST logic
from gtls.c, moving it to warnless.h as CURLX_POINTER_TO_INTEGER_CAST /
CURLX_INTEGER_TO_POINTER_CAST.

Closes https://github.com/curl/curl/pull/2341
2018-02-28 20:04:48 +01:00
Marcel Raad
828187d86b
travis: update compiler versions
Update clang to version 3.9 and GCC to version 6.

Closes https://github.com/curl/curl/pull/2345
2018-02-28 07:36:31 +01:00
Daniel Stenberg
ee84085924 docs/MANUAL: formfind.pl is not accessible on the site anymore
Fixes #2342
2018-02-26 20:12:23 +01:00
Jay Satiro
1b27fcfcf7 curl-openssl.m4: Fix version check for OpenSSL 1.1.1
- Add OpenSSL 1.1.1 to the header/library version lists.

- Detect OpenSSL 1.1.1 library using its function ERR_clear_last_mark,
  which was added in that version.

Prior to this change an erroneous header/library mismatch was caused by
lack of OpenSSL 1.1.1 detection. I tested using openssl-1.1.1-pre1.
2018-02-24 03:18:15 -05:00
Viktor Szakats
a1d78ffc8d lib655: silence compiler warning
Closes https://github.com/curl/curl/pull/2335
2018-02-23 23:57:27 +00:00
Viktor Szakats
7e35eb7729 spelling fixes
Detected using the `codespell` tool.

Also contains one URL protocol upgrade.

Closes https://github.com/curl/curl/pull/2334
2018-02-23 23:29:01 +00:00
Daniel Stenberg
06df42410e
projects/README: remove reference to dead IDN link/package
Reported-by: Stefan Kanthak and Rod Widdowson

Fixes #2325
2018-02-24 00:01:03 +01:00
Rod Widdowson
5fb70ea170 winbuild: Use macros for the names of some build utilities
- Add macros to the top of the makefile for rc and mt utilities so that
  it is easier to change their locations.

Bug: https://curl.haxx.se/mail/lib-2018-02/0075.html
Reported-by: Stefan Kanthak

Closes https://github.com/curl/curl/issues/2329
2018-02-23 15:20:58 -05:00
Daniel Stenberg
1be96a2952
TODO: remove "sha-256 digest", added in 2b5b37cb91 2018-02-23 14:40:10 +01:00
Daniel Stenberg
1a99ecdf50
curl_share_setopt.3: connection cache is shared within multi handles 2018-02-23 12:52:22 +01:00
Rod Widdowson
4fff37b91f winbuild: Use CALL to run batch scripts
Co-authored-by: Stefan Kanthak

Closes https://github.com/curl/curl/issues/2330
Closes https://github.com/curl/curl/pull/2331
2018-02-22 14:56:00 -05:00
Patrick Monnerat
a91a235d4c os400: add curl_resolver_start_callback type to ILE/RPG binding 2018-02-22 12:59:02 +01:00
Daniel Stenberg
93e7a6ffd1
form.d: rephrased somewhat, added two example command lines 2018-02-22 08:28:05 +01:00
Francisco Sedano
23713645d4 url: Add option CURLOPT_RESOLVER_START_FUNCTION
- Add new option CURLOPT_RESOLVER_START_FUNCTION to set a callback that
  will be called every time before a new resolve request is started
  (ie before a host is resolved) with a pointer to backend-specific
  resolver data. Currently this is only useful for ares.

- Add new option CURLOPT_RESOLVER_START_DATA to set a user pointer to
  pass to the resolver start callback.

Closes https://github.com/curl/curl/pull/2311
2018-02-21 21:29:10 -05:00
Jay Satiro
dd027c80fe lib: CURLOPT_HAPPY_EYEBALLS_TIMEOUT => CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS
- In keeping with the naming of our other connect timeout options rename
  CURLOPT_HAPPY_EYEBALLS_TIMEOUT to CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.

This change adds the _MS suffix since the option expects milliseconds.
This is more intuitive for our users since other connect timeout options
that expect milliseconds use _MS such as CURLOPT_TIMEOUT_MS,
CURLOPT_CONNECTTIMEOUT_MS, CURLOPT_ACCEPTTIMEOUT_MS.

The tool option already uses an -ms suffix, --happy-eyeballs-timeout-ms.

Follow-up to 2427d94 which added the lib and tool option yesterday.

Ref: https://github.com/curl/curl/pull/2260
2018-02-21 15:16:50 -05:00
Patrick Monnerat
de97b5fcef sasl: prefer PLAIN mechanism over LOGIN
SASL PLAIN is a standard, LOGIN only a draft. The LOGIN draft says
PLAIN should be used instead if available.
2018-02-21 17:42:25 +01:00
Daniel Stenberg
7b71b5150b
RELEASE-NOTES: synced with 2427d94c6 2018-02-21 00:18:54 +01:00
Anders Bakken
2427d94c6d url: Add option CURLOPT_HAPPY_EYEBALLS_TIMEOUT
- Add new option CURLOPT_HAPPY_EYEBALLS_TIMEOUT to set libcurl's happy
  eyeball timeout value.

- Add new optval macro CURL_HET_DEFAULT to represent the default happy
  eyeballs timeout value (currently 200 ms).

- Add new tool option --happy-eyeballs-timeout-ms to expose
  CURLOPT_HAPPY_EYEBALLS_TIMEOUT. The -ms suffix is used because the
  other -timeout options in the tool expect seconds not milliseconds.

Closes https://github.com/curl/curl/pull/2260
2018-02-20 17:51:43 -05:00
Jay Satiro
73050fb6ae hostip: fix 'potentially uninitialized variable' warning
Follow-up to 50d1b33.

Caught by AppVeyor.
2018-02-20 14:30:47 -05:00
Daniel Stenberg
9b4c2165f1
TODO: warning if curl version is not in sync with libcurl version 2018-02-20 11:17:52 +01:00
Anders Bakken
50d1b3379a CURLOPT_RESOLVE: Add support for multiple IP addresses per entry
This enables users to preresolve but still take advantage of happy
eyeballs and trying multiple addresses if some are not connecting.

Ref: https://github.com/curl/curl/pull/2260
2018-02-20 04:24:28 -05:00
Sergio Borghese
e77f0e5a5a
examples/sftpuploadresume: resume upload via CURLOPT_APPEND
URL: https://curl.haxx.se/mail/lib-2018-02/0072.html
2018-02-20 09:31:06 +01:00
Daniel Stenberg
f8e8028b0f
curl --version: show PSL if the run-time lib has it enabled
... not of the #define was set at build-time!
2018-02-18 23:09:24 +01:00
Daniel Stenberg
a3e52a7b2d
TODO: "Support in-memory certs/ca certs/keys"
removed SSLKEYLOGFILE support (fixed)

removed "consider SSL patches" (outdated)

Closes #2310
2018-02-18 22:45:17 +01:00
Daniel Stenberg
174212972c
CURLOPT_HEADER.3: clarify problems with different data sizes 2018-02-16 22:54:51 +01:00
Daniel Stenberg
70cbb92134
test1556: verify >16KB headers to the header callback 2018-02-16 22:54:50 +01:00
Daniel Stenberg
367689d8c9
header callback: don't chop headers into smaller pieces
Reported-by: Guido Berhoerster
Fixes #2314
Closes #2316
2018-02-16 22:54:08 +01:00
Daniel Stenberg
5e17a5f6cf
test1154: verify that long HTTP headers get rejected 2018-02-16 22:51:59 +01:00