libcurl: update to 8.6.0

5 files changed, 15 insertions, 9 deletions

diff --git a/libs/libcurl/src/vauth/digest_sspi.c b/libs/libcurl/src/vauth/digest_sspi.c
index 996b83d50e..d61c8386bc 100644
--- a/libs/libcurl/src/vauth/digest_sspi.c
+++ b/libs/libcurl/src/vauth/digest_sspi.c
@@ -211,8 +211,10 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
     if(status == SEC_E_INSUFFICIENT_MEMORY)

       return CURLE_OUT_OF_MEMORY;

 

+#if !defined(CURL_DISABLE_VERBOSE_STRINGS)

     infof(data, "schannel: InitializeSecurityContext failed: %s",

           Curl_sspi_strerror(status, buffer, sizeof(buffer)));

+#endif

 

     return CURLE_AUTH_ERROR;

   }

@@ -603,8 +605,10 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
       if(status == SEC_E_INSUFFICIENT_MEMORY)

         return CURLE_OUT_OF_MEMORY;

 

+#if !defined(CURL_DISABLE_VERBOSE_STRINGS)

       infof(data, "schannel: InitializeSecurityContext failed: %s",

             Curl_sspi_strerror(status, buffer, sizeof(buffer)));

+#endif

 

       return CURLE_AUTH_ERROR;

     }

diff --git a/libs/libcurl/src/vauth/krb5_gssapi.c b/libs/libcurl/src/vauth/krb5_gssapi.c
index 2b7b21534e..655f908300 100644
--- a/libs/libcurl/src/vauth/krb5_gssapi.c
+++ b/libs/libcurl/src/vauth/krb5_gssapi.c
@@ -226,7 +226,8 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   /* Extract the security layer and the maximum message size */

   indata = output_token.value;

   sec_layer = indata[0];

-  max_size = (indata[1] << 16) | (indata[2] << 8) | indata[3];

+  max_size = ((unsigned int)indata[1] << 16) |

+             ((unsigned int)indata[2] << 8) | indata[3];

 

   /* Free the challenge as it is not required anymore */

   gss_release_buffer(&unused_status, &output_token);

diff --git a/libs/libcurl/src/vauth/krb5_sspi.c b/libs/libcurl/src/vauth/krb5_sspi.c
index fe2fdb3732..78999232e3 100644
--- a/libs/libcurl/src/vauth/krb5_sspi.c
+++ b/libs/libcurl/src/vauth/krb5_sspi.c
@@ -319,7 +319,8 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   /* Extract the security layer and the maximum message size */

   indata = input_buf[1].pvBuffer;

   sec_layer = indata[0];

-  max_size = (indata[1] << 16) | (indata[2] << 8) | indata[3];

+  max_size = ((unsigned long)indata[1] << 16) |

+             ((unsigned long)indata[2] << 8) | indata[3];

 

   /* Free the challenge as it is not required anymore */

   s_pSecFn->FreeContextBuffer(input_buf[1].pvBuffer);

diff --git a/libs/libcurl/src/vauth/ntlm.c b/libs/libcurl/src/vauth/ntlm.c
index 0cdf1a159f..a434497d42 100644
--- a/libs/libcurl/src/vauth/ntlm.c
+++ b/libs/libcurl/src/vauth/ntlm.c
@@ -44,6 +44,7 @@
 #include "warnless.h"

 #include "rand.h"

 #include "vtls/vtls.h"

+#include "strdup.h"

 

 #define BUILDING_CURL_NTLM_MSGS_C

 #include "vauth/vauth.h"

@@ -184,11 +185,10 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
       }

 

       free(ntlm->target_info); /* replace any previous data */

-      ntlm->target_info = malloc(target_info_len);

+      ntlm->target_info = Curl_memdup(&type2[target_info_offset],

+                                      target_info_len);

       if(!ntlm->target_info)

         return CURLE_OUT_OF_MEMORY;

-

-      memcpy(ntlm->target_info, &type2[target_info_offset], target_info_len);

     }

   }

 

diff --git a/libs/libcurl/src/vauth/ntlm_sspi.c b/libs/libcurl/src/vauth/ntlm_sspi.c
index b2cf248181..f8c3558603 100644
--- a/libs/libcurl/src/vauth/ntlm_sspi.c
+++ b/libs/libcurl/src/vauth/ntlm_sspi.c
@@ -34,6 +34,7 @@
 #include "warnless.h"

 #include "curl_multibyte.h"

 #include "sendf.h"

+#include "strdup.h"

 

 /* The last #include files should be: */

 #include "curl_memory.h"

@@ -213,11 +214,10 @@ CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
   }

 

   /* Store the challenge for later use */

-  ntlm->input_token = malloc(Curl_bufref_len(type2) + 1);

+  ntlm->input_token = Curl_memdup0((const char *)Curl_bufref_ptr(type2),

+                                   Curl_bufref_len(type2));

   if(!ntlm->input_token)

     return CURLE_OUT_OF_MEMORY;

-  memcpy(ntlm->input_token, Curl_bufref_ptr(type2), Curl_bufref_len(type2));

-  ntlm->input_token[Curl_bufref_len(type2)] = '\0';

   ntlm->input_token_len = Curl_bufref_len(type2);

 

   return CURLE_OK;

@@ -314,7 +314,7 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
                                                &type_3_desc,

                                                &attrs, &expiry);

   if(status != SEC_E_OK) {

-    infof(data, "NTLM handshake failure (type-3 message): Status=%x",

+    infof(data, "NTLM handshake failure (type-3 message): Status=%lx",

           status);

 

     if(status == SEC_E_INSUFFICIENT_MEMORY)