1
0
mirror of https://github.com/moparisthebest/curl synced 2024-11-10 19:45:04 -05:00
Commit Graph

26177 Commits

Author SHA1 Message Date
Marcel Raad
5c2728eb42
runtests.pl: treat LibreSSL and BoringSSL as OpenSSL
This makes the tests that require the OpenSSL feature also run for
those two compatible libraries.

Closes https://github.com/curl/curl/pull/5762
2020-08-02 10:32:00 +02:00
Daniel Stenberg
ca567dc5a4
multi: Condition 'extrawait' is always true
Reported by Codacy.

Reviewed-by: Marcel Raad
Closes #5759
2020-08-01 23:21:29 +02:00
Marcel Raad
c71d8bb56d
openssl: fix build with LibreSSL < 2.9.1
`SSL_CTX_add0_chain_cert` and `SSL_CTX_clear_chain_certs` were
introduced in LibreSSL 2.9.1 [0].

[0] 0db809ee17

Closes https://github.com/curl/curl/pull/5757
2020-08-01 17:47:32 +02:00
Marc Aldorasi
d5bb459ccf
multi_remove_handle: close unused connect-only connections
Previously any connect-only connections in a multi handle would be kept
alive until the multi handle was closed.  Since these connections cannot
be re-used, they can be marked for closure when the associated easy
handle is removed from the multi handle.

Closes #5749
2020-08-01 15:26:08 +02:00
Daniel Stenberg
faeec840f3
checksrc: invoke script with -D to find .checksrc proper
Without the -D command line option, checksrc.pl won't know which
directory to load the ".checksrc" file from when building out of the
source tree.

Reported-by: Marcel Raad
Fixes #5715
Closes #5755
2020-08-01 10:47:55 +02:00
Carlo Marcelo Arenas Belón
a39ecb3fac
buildconf: retire ares buildconf invocation
no longer needed after 4259d2df7d
2020-08-01 00:00:37 +02:00
Carlo Marcelo Arenas Belón
afa0a12018
buildconf: excempt defunct reference to ACLOCAL_FLAGS
retired with 09f278121e but kept around as
the name is generic enough that it might be in use and relied upon from
the environment.
2020-08-01 00:00:37 +02:00
Carlo Marcelo Arenas Belón
7270795839
buildconf: avoid array concatenation in die()
reported as error SC2145[1] by shellcheck, but not expected to cause
any behavioural differences otherwise.

[1] https://github.com/koalaman/shellcheck/wiki/SC2145

Closes #5701
2020-08-01 00:00:31 +02:00
Daniel Stenberg
daab7b2be7
travis: add ppc64le and s390x builds
Closes #5752
2020-07-31 23:33:57 +02:00
Marc Hoersken
633c9478c9
connect: remove redundant message about connect failure
Reviewed-by: Daniel Stenberg

Closes #5708
2020-07-31 18:58:03 +02:00
Marc Hoersken
3ee7c676ec
tests/sshserver.pl: fix compatibility with OpenSSH for Windows
Follow up to #5721
2020-07-31 18:56:50 +02:00
Marc Hoersken
0fc1b8bfdd
CI/azure: install libssh2 for use with msys2-based builds
This enables building and running the SFTP tests.
Unfortunately OpenSSH for Windows does not support SCP (yet).

Reviewed-by: Daniel Stenberg

Closes #5721
2020-07-31 18:55:52 +02:00
Marc Hoersken
e574f4fda1
CI/azure: increase Windows job timeout once again
Avoid aborted jobs due to performance issues on Azure DevOps.

Reviewed-by: Daniel Stenberg
Reviewed-by: Jay Satiro

Closes #5738
2020-07-31 18:55:15 +02:00
Jay Satiro
40909c405b TODO: Schannel: 'Add option to allow abrupt server closure'
We should offer an option to allow abrupt server closures (server closes
SSL transfer without sending a known termination point such as length of
transfer or close_notify alert). Abrupt server closures are usually
because of misconfigured or very old servers.

Closes https://github.com/curl/curl/issues/4427
2020-07-30 12:25:05 -04:00
Jay Satiro
a12a16151a url: fix CURLU and location following
Prior to this change if the user set a URL handle (CURLOPT_CURLU) it was
incorrectly used for the location follow, resulting in infinite requests
to the original location.

Reported-by: sspiri@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/5709
Closes https://github.com/curl/curl/pull/5713
2020-07-30 11:57:35 -04:00
Daniel Stenberg
d8b8afe320
RELEASE-NOTES: synced 2020-07-30 00:06:27 +02:00
divinity76
be6d2f3418
docs: add date of 7.20 to CURLM_CALL_MULTI_PERFORM mentions
it helps make it obvious that most developers don't have to care about
the CURLM_CALL_MULTI_PERFORM value (last release using it is nearly 11
years old, November 4 2009)

Closes #5744
2020-07-30 00:02:24 +02:00
Jay Satiro
5f79891658 tool_cb_wrt: fix outfile mode flags for Windows
- Use S_IREAD and S_IWRITE mode permission flags to create the file
  on Windows instead of S_IRUSR, S_IWUSR, etc.

Windows only accepts a combination of S_IREAD and S_IWRITE. It does not
acknowledge other combinations, for which it may generate an assertion.

This is a follow-up to 81b4e99 from yesterday, which improved the
existing file check with -J.

Ref: https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/open-wopen#remarks
Ref: https://github.com/curl/curl/pull/5731

Closes https://github.com/curl/curl/pull/5742
2020-07-29 11:36:14 -04:00
Daniel Stenberg
2f72ad44fc
checksrc: ban gmtime/localtime
They're not thread-safe so they should not be used in libcurl code.

Explictly enabled when deemed necessary and in examples and tests

Reviewed-by: Nicolas Sterchele
Closes #5732
2020-07-28 23:51:17 +02:00
Daniel Stenberg
5ae339971a
transfer: fix data_pending for builds with both h2 and h3 enabled
Closes #5734
2020-07-28 23:48:49 +02:00
Daniel Stenberg
abe59221fc
curl_multi_setopt: fix compiler warning "result is always false"
On systems with 32 bit long the expression is always false. Avoid
the warning.

Reported-by: Gisle Vanem
Bug: 61a08508f6 (commitcomment-40941232)
Closes #5736
2020-07-28 23:37:01 +02:00
Daniel Stenberg
81b4e99b1e
curl: improve the existing file check with -J
Previously a file that isn't user-readable but is user-writable would
not be properly avoided and would get overwritten.

Reported-by: BrumBrum on hackerone
Assisted-by: Jay Satiro
Bug: https://hackerone.com/reports/926638
Closes #5731
2020-07-28 23:28:40 +02:00
Jonathan Nieder
2b6b843bb1
multi: update comment to say easyp list is linear
Since 09b9fc900 (multi: remove 'Curl_one_easy' struct, phase 1,
2013-08-02), the easy handle list is not circular but ends with
->next pointing to NULL.

Reported-by: Masaya Suzuki <masayasuzuki@google.com>
Closes #5737
2020-07-28 15:48:30 +02:00
Daniel Stenberg
34e5ad21d2
CURLOPT_NOBODY.3: fix the syntax for referring to options
As test 1140 fails otherwise!

Follow-up to e1bac81cc8
2020-07-27 23:59:00 +02:00
Daniel Stenberg
d259cf1a9b
ngtcp2: store address in sockaddr_storage
Reported-by: Tatsuhiro Tsujikawa
Closes #5733
2020-07-27 19:46:58 +02:00
Daniel Stenberg
e1bac81cc8
CURLOPT_NOBODY.3: clarify what setting to 0 means
... and mention that HTTP with other methods than HEAD might get a body and
there's no option available to stop that.

Closes #5729
2020-07-27 19:34:53 +02:00
Daniel Stenberg
91cb16b21f
setopt: unset NOBODY switches to GET if still HEAD
Unsetting CURLOPT_NOBODY with 0L when doing HTTP has no documented
action but before 7.71.0 that used to switch back to GET and with this
change (assuming the method is still set to HEAD) this behavior is
brought back.

Reported-by: causal-agent on github
Fixes #5725
Closes #5728
2020-07-27 19:33:16 +02:00
Ehren Bendler
14e63c19a0
configure: cleanup wolfssl + pkg-config conflicts when cross compiling.
Also choose a different wolfSSL function to test for NTLM support.

Fixes #5605
Closes #5682
2020-07-27 15:18:13 +02:00
Daniel Stenberg
ba390221ef
configure: show zstd "no" in summary when built without it
Reported-by: Marc Hörsken
Fixes #5720
Closes #5730
2020-07-27 14:33:17 +02:00
Daniel Stenberg
425fa864ce
quiche: handle calling disconnect twice
Reported-by: lilongyan-huawei on github
Fixes #5726
Closes #5727
2020-07-27 12:53:46 +02:00
Nicolas Sterchele
0b85969226
getinfo: reset retry-after value in initinfo
- Avoid re-using retry_after value from preceding request
- Add libtest 3010 to verify

Reported-by: joey-l-us on github
Fixes #5661
Closes #5672
2020-07-27 12:15:44 +02:00
Marcel Raad
0c6112a139
WIN32: stop forcing narrow-character API
Except where the results are only used for character output.
getenv is not touched because it's part of the public API, and having
it return UTF-8 instead of ANSI would be a breaking change.

Fixes https://github.com/curl/curl/issues/5658
Fixes https://github.com/curl/curl/issues/5712
Closes https://github.com/curl/curl/pull/5718
2020-07-27 10:42:38 +02:00
Tobias Stoeckmann
8829703b5a mprintf: Fix stack overflows
Stack overflows can occur with precisions for integers and floats.

Proof of concepts:
- curl_mprintf("%d, %.*1$d", 500, 1);
- curl_mprintf("%d, %+0500.*1$f", 500, 1);

Ideally, compile with -fsanitize=address which makes this undefined
behavior a bit more defined for debug purposes.

The format strings are valid. The overflows occur due to invalid
arguments. If these arguments are variables with contents controlled
by an attacker, the function's stack can be corrupted.

Also see CVE-2016-9586 which partially fixed the float aspect.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

Closes https://github.com/curl/curl/pull/5722
2020-07-27 03:43:00 -04:00
Tobias Stoeckmann
94b03664de mprintf: Fix dollar string handling
Verify that specified parameters are in range. If parameters are too
large, fail early on and avoid out of boundary accesses.

Also do not read behind boundaries of illegal format strings.

These are defensive measures since it is expected that format strings
are well-formed. Format strings should not be modifiable by user
input due to possible generic format string attacks.

Closes https://github.com/curl/curl/pull/5722
2020-07-27 03:42:59 -04:00
Daniel Stenberg
376d5bb323
ntlm: free target_info before (re-)malloc
OSS-Fuzz found a way this could get called again with the pointer still
pointing to a malloc'ed memory, leading to a leak.

Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24379

Closes #5724
2020-07-26 23:48:36 +02:00
Marcel Raad
730dc48253
CI/macos: set minimum macOS version
This enables some deprecation warnings.
Previously, autotools defaulted to 10.8.

Closes https://github.com/curl/curl/pull/5723
2020-07-26 16:31:33 +02:00
Daniel Stenberg
67ca8e2260
RELEASE-NOTES: synced 2020-07-26 12:24:08 +02:00
Marcel Raad
05904db861
CI/macos: enable warnings as errors for CMake builds
Closes https://github.com/curl/curl/pull/5716
2020-07-25 08:51:11 +02:00
Marcel Raad
13030d08ad
CMake: fix test for warning suppressions
GCC doesn't warn for unknown `-Wno-` options, except if there are other
warnings or errors [0]. This was problematic with `CURL_WERROR` as that
warning-as-error cannot be suppressed. Notably, this always happened
with `-Wno-pedantic-ms-format` when not targeting Windows. So test for
the positive form of the warning instead, which should always result in
a diagnostic if unknown.

[0] https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html

Closes https://github.com/curl/curl/pull/5714
2020-07-23 16:13:35 +02:00
Jay Satiro
d979cb9ed2 curl.h: update CURLINFO_LASTONE
CURLINFO_LASTONE should have been updated when
CURLINFO_EFFECTIVE_METHOD was added.

Reported-by: xwxbug@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/5711
2020-07-23 02:44:53 -04:00
Marc Hoersken
3cd9bc9689
CI/azure: unconditionally enable warnings-as-errors with autotools
Reviewed-by: Marcel Raad

Follow up to #5694
Closes #5706
2020-07-22 20:08:23 +02:00
Marcel Raad
d746ff1107
doh: remove redundant cast
Closes https://github.com/curl/curl/pull/5704
2020-07-21 20:00:29 +02:00
Marcel Raad
ff8b6ce05f
CI/macos: unconditionally enable warnings-as-errors with autotools
Previously, warnings were only visible in the output for most jobs.

Closes https://github.com/curl/curl/pull/5694
2020-07-19 10:35:19 +02:00
Marcel Raad
c90e48c005
util: silence conversion warnings
timeval::tv_usec might be a 32-bit integer and timespec::tv_nsec might
be a 64-bit integer. This is the case when building for recent macOS
versions, for example. Just treat tv_usec as an int, which should
hopefully always be sufficient on systems with
`HAVE_CLOCK_GETTIME_MONOTONIC`.

Closes https://github.com/curl/curl/pull/5695
2020-07-19 10:34:58 +02:00
Marcel Raad
2998749850
md(4|5): don't use deprecated macOS functions
They are marked as deprecated for -mmacosx-version-min >= 10.15,
which might result in warnings-as-errors.

Closes https://github.com/curl/curl/pull/5695
2020-07-19 10:34:52 +02:00
Daniel Stenberg
3c4c4ec2ee
strdup: remove the odd strlen check
It confuses code analyzers with its use of -1 for unsigned value. Also,
a check that's not normally used in strdup() code - and not necessary.

Closes #5697
2020-07-18 12:37:25 +02:00
Alessandro Ghedini
d10cd52406
travis: update quiche builds for new boringssl layout
This is required after https://github.com/cloudflare/quiche/pull/593
moved BoringSSL around slightly.

This also means that Go is not needed to build BoringSSL anymore (the
one provided by quiche anyway).

Closes #5691
2020-07-18 12:35:21 +02:00
Marcel Raad
ae5b6deb15
configure: allow disabling warnings
When using `--enable-warnings`, it was not possible to disable warnings
via CFLAGS that got explicitly enabled. Now warnings are not enabled
anymore if they are explicitly disabled (or enabled) in CFLAGS. This
works for at least GCC, clang, and TCC as they have corresponding
`-Wno-` options for every warning.

Closes https://github.com/curl/curl/pull/5689
2020-07-17 09:35:16 +02:00
Daniel Stenberg
da3e0f406a
ngtcp2: adjust to recent sockaddr updates
Closes #5690
2020-07-16 23:56:42 +02:00
Daniel Stenberg
d5814c0af0
page-header: provide protocol details in the curl.1 man page
Add protocol and version specific information about all protocols curl
supports.

Fixes #5679
Reported-by: tbugfinder on github
Closes #5686
2020-07-16 23:54:26 +02:00