10632 Commits

Author	SHA1	Message	Date
Paul Dreik	b766602729	doh: fix (harmless) buffer overrun ... Added unit test case 1655 to verify. Close #4352 the code correctly finds the flaws in the old code, if one temporarily restores doh.c to the old version.	2019-09-15 23:25:24 +02:00
Daniel Stenberg	65f5b958c9	FTP: allow "rubbish" prepended to the SIZE response ... This is a protocol violation but apparently there are legacy proprietary servers doing this. Added test 336 and 337 to verify. Reported-by: Philippe Marguinaud Closes #4339	2019-09-13 14:21:00 +02:00
Zenju	acf1d2acd1	FTP: skip CWD to entry dir when target is absolute ... Closes #4332	2019-09-13 14:05:34 +02:00
Daniel Stenberg	83b4cfacba	parsedate: still provide the name arrays when disabled ... If FILE or FTP are enabled, since they also use them! Reported-by: Roland Hieber Fixes #4325 Closes #4343	2019-09-13 08:25:14 +02:00
Daniel Stenberg	a56a47ac33	openssl: close_notify on the FTP data connection doesn't mean closure ... For FTPS transfers, curl gets close_notify on the data connection without that being a signal to close the control connection! Regression since 3f5da4e59a (7.65.0) Reported-by: Zenju on github Reviewed-by: Jay Satiro Fixes #4329 Closes #4340	2019-09-13 00:10:47 +02:00
Zenju	0aef91411e	setopt: make it easier to add new enum values ... ... by using the *_LAST define names better. Closes #4321	2019-09-12 09:42:54 +02:00
Daniel Stenberg	e34ec7de59	asyn-thread: s/AF_LOCAL/AF_UNIX for Solaris ... Reported-by: Dagobert Michelsen Fixes #4328 Closes #4333	2019-09-12 09:37:11 +02:00
Jay Satiro	08f96982a9	ldap: Stop using wide char version of ldapp_err2string ... Despite ldapp_err2string being documented by MS as returning a PCHAR (char *), when UNICODE it is mapped to ldap_err2stringW and returns PWCHAR (wchar_t *). We have lots of code that expects ldap_err2string to return char *, most of it failf used like this: failf(data, "LDAP local: Some error: %s", ldap_err2string(rc)); Closes https://github.com/curl/curl/pull/4272	2019-09-11 02:44:47 -04:00
Daniel Stenberg	9637dbfffd	urlapi: one colon is enough for the strspn() input (typo)	2019-09-10 11:51:51 +02:00
Daniel Stenberg	eab3c580f9	urlapi: verify the IPv6 numerical address ... It needs to parse correctly. Otherwise it could be tricked into letting through a-f using host names that libcurl would then resolve. Like '[ab.be]'. Reported-by: Thomas Vegas Closes #4315	2019-09-10 11:32:12 +02:00
Clément Notin	ffe34b7b59	openssl: use SSL_CTX_set_<min|max>_proto_version() when available ... OpenSSL 1.1.0 adds SSL_CTX_set_<min|max>_proto_version() that we now use when available. Existing code is preserved for older versions of OpenSSL. Closes #4304	2019-09-10 08:11:42 +02:00
Clément Notin	9136542d33	openssl: indent, re-organize and add comments	2019-09-10 08:08:44 +02:00
migueljcrum	67b30b3418	sspi: fix memory leaks ... Closes #4299	2019-09-10 08:06:05 +02:00
Daniel Stenberg	c4c9e070f3	Curl_fillreadbuffer: avoid double-free trailer buf on error ... Reviewed-by: Jay Satiro Reported-by: Thomas Vegas Closes #4307	2019-09-09 09:36:27 +02:00
Daniel Stenberg	9069838b30	security:read_data fix bad realloc() ... ... that could end up a double-free CVE-2019-5481 Bug: https://curl.haxx.se/docs/CVE-2019-5481.html	2019-09-09 08:14:34 +02:00
Thomas Vegas	facb0e4662	tftp: Alloc maximum blksize, and use default unless OACK is received ... Fixes potential buffer overflow from 'recvfrom()', should the server return an OACK without blksize. Bug: https://curl.haxx.se/docs/CVE-2019-5482.html CVE-2019-5482	2019-09-09 08:14:34 +02:00
Thomas Vegas	82f3ba3806	tftp: return error when packet is too small for options	2019-09-09 08:14:34 +02:00
Daniel Stenberg	158dcb9f86	netrc: free 'home' on error ... Follow-up to f9c7ba9096 Coverity CID 1453474 Closes #4291	2019-09-03 23:00:51 +02:00
Daniel Stenberg	4ac2884003	urldata: avoid 'generic', use dedicated pointers ... For the 'proto' union within the connectdata struct. Closes #4290	2019-09-03 23:00:51 +02:00
Daniel Stenberg	5050edb124	cleanup: move functions out of url.c and make them static ... Closes #4289	2019-09-03 13:11:12 +02:00
Daniel Stenberg	4d0306c698	smtp: check for and bail out on too short EHLO response ... Otherwise, a three byte response would make the smtp_state_ehlo_resp() function misbehave. Credit to OSS-Fuzz Bug: https://crbug.com/oss-fuzz/16918 Assisted-by: Max Dymond Closes #4287	2019-09-03 08:25:23 +02:00
Daniel Stenberg	198b73d12c	smb: init *msg to NULL in smb_send_and_recv() ... ... it might otherwise return OK from this function leaving that pointer uninitialized. Bug: https://crbug.com/oss-fuzz/16907 Closes #4286	2019-09-02 23:06:48 +02:00
Daniel Stenberg	84ced9389e	Curl_addr2string: take an addrlen argument too ... This allows the function to figure out if a unix domain socket has a file name or not associated with it! When a socket is created with socketpair(), as done in the fuzzer testing, the path struct member is uninitialized and must not be accessed. Bug: https://crbug.com/oss-fuzz/16699 Closes #4283	2019-08-31 11:41:56 +02:00
Daniel Stenberg	c30aff4f88	quiche: expire when poll returned data ... ... to make sure we continue draining the queue until empty Closes #4281	2019-08-30 17:41:16 +02:00
Daniel Stenberg	4d9e324771	quiche: decrease available buffer size, don't assign it! ... Found-by: Jeremy Lainé	2019-08-30 17:41:11 +02:00
Daniel Stenberg	7bac3135df	ngtcp2: on h3 stream close, call expire ... ... to trigger a new read to detect the stream close! Closes #4275	2019-08-29 19:23:52 +02:00
Tatsuhiro Tsujikawa	484b6f345f	ngtcp2: build latest ngtcp2 and ngtcp2_crypto_openssl ... Closes #4278	2019-08-29 19:22:16 +02:00
Daniel Stenberg	0690b3330c	ngtcp2: set flow control window to stream buffer size ... Closes #4274	2019-08-28 14:37:19 +02:00
Tatsuhiro Tsujikawa	5b3be0729c	ngtcp2: Build with latest ngtcp2 and ngtcp2_crypto_openssl ... Closes #4270	2019-08-27 16:31:19 +02:00
Daniel Stenberg	c1b6a384f9	http2: when marked for closure and wanted to close == OK ... It could otherwise return an error even when closed correctly if GOAWAY had been received previously. Reported-by: Tom van der Woerdt Fixes #4267 Closes #4268	2019-08-26 22:44:59 +02:00
Kamil Dudka	7e513c1048	vauth: return CURLE_AUTH_ERROR on gss_init_sec_context() failure ... This is a follow-up to https://github.com/curl/curl/pull/3864 . Closes #4224	2019-08-26 13:43:21 +02:00
Daniel Stenberg	48f589893d	quiche: send the HTTP body correctly on callback uploads ... Closes #4265	2019-08-26 11:31:39 +02:00
Daniel Stenberg	aae22fdbd5	ngtcp2: add support for SSLKEYLOGFILE ... Closes #4260	2019-08-25 23:29:46 +02:00
Daniel Stenberg	30a606e066	ngtcp2: improve h3 response receiving ... Closes #4259	2019-08-25 23:29:43 +02:00
Daniel Stenberg	b959c2f775	ngtcp2: use nghttp3_version()	2019-08-25 23:18:17 +02:00
Daniel Stenberg	ff4ef390f6	ngtcp2: sync with upstream API changes ... Assisted-by: Tatsuhiro Tsujikawa	2019-08-25 23:18:14 +02:00
Kyle Abramowitz	25f9621935	scp: fix directory name length used in memcpy ... Fix read off end of array due to bad pointer math in getworkingpath for SCP home directory case. Closes #4258	2019-08-24 18:47:56 +02:00
Daniel Stenberg	65fda739ee	http: the 'closed' struct field is used by both ngh2 and ngh3 ... and remove 'header_recvbuf', not used for anything Reported-by: Jeremy Lainé Closes #4257	2019-08-24 17:21:41 +02:00
Daniel Stenberg	0a5d28fa2e	ngtcp2: accept upload via callback ... Closes #4256	2019-08-23 22:33:29 +02:00
Daniel Stenberg	e59540139a	cleanup: remove DOT_CHAR completely ... Follow-up to f9c7ba9096 The use of DOT_CHAR for ".ssh" was probably a mistake and is removed now. Pointed-out-by: Gisle Vanem Bug: https://github.com/curl/curl/pull/4230#issuecomment-522960638 Closes #4247	2019-08-20 23:07:59 +02:00
Daniel Stenberg	23803aae7b	spnego_sspi: add typecast to fix build warning ... Reported in build "Win32 target on Debian Stretch (64-bit) - i686-w64-mingw32 - gcc-20170516" Closes #4245	2019-08-20 23:06:19 +02:00
Daniel Stenberg	3e8a9bfd17	openssl: build warning free with boringssl ... Closes #4244	2019-08-20 19:55:06 +02:00
Daniel Stenberg	2056175dc2	ngtcp2: make postfields-set posts work ... Closes #4242	2019-08-20 16:53:40 +02:00
Daniel Stenberg	99775438d6	http: remove chunked-encoding and expect header use for HTTP/3	2019-08-20 16:53:40 +02:00
Daniel Stenberg	6a90c9e0c4	CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2 ... For a long time (since 7.28.1) we've returned error when setting the value to 1 to make applications notice that we stopped supported the old behavior for 1. Starting now, we treat 1 and 2 exactly the same. Closes #4241	2019-08-20 14:57:59 +02:00
Daniel Stenberg	f9c7ba9096	netrc: make the code try ".netrc" on Windows as well ... ... but fall back and try "_netrc" too if the dot version didn't work. Co-Authored-By: Steve Holme	2019-08-20 11:48:42 +02:00
Daniel Stenberg	1a0dc6f6a3	ngtcp2: use ngtcp2_version() to get the run-time version ... ... which of course doesn't have to be the same used at build-time. Function just recently merged in ngtcp2.	2019-08-20 08:52:22 +02:00
Daniel Stenberg	349c3f5a08	ngtcp2: move the h3 initing to immediately after the rx key ... To fix a segfault and to better deal with 0-RTT Assisted-by: Tatsuhiro Tsujikawa	2019-08-20 08:51:23 +02:00
Alessandro Ghedini	e54affa82c	quiche: register debug callback once and earlier ... The quiche debug callback is global and can only be initialized once, so make sure we don't do it multiple times (e.g. if multiple requests are executed). In addition this initializes the callback before the connection is created, so we get logs for the handshake as well. Closes #4236	2019-08-17 17:00:49 +02:00
Daniel Stenberg	ea28a6cb2f	ssh: add a generic Curl_ssh_version function for SSH backends ... Closes #4235	2019-08-17 16:57:58 +02:00