From 2a7aa481eaf81a71e5c5682974fffe1aa1fc6202 Mon Sep 17 00:00:00 2001 From: dartraiden Date: Fri, 1 Jun 2018 22:53:12 +0300 Subject: libs/libcurl: update to 7.60 --- libs/libcurl/docs/CHANGES | 9418 ++++++++++++++++++++++---------------- libs/libcurl/docs/COPYING | 3 +- libs/libcurl/docs/LICENSE-MIXING | 130 - libs/libcurl/docs/THANKS | 728 ++- 4 files changed, 6215 insertions(+), 4064 deletions(-) delete mode 100644 libs/libcurl/docs/LICENSE-MIXING (limited to 'libs/libcurl/docs') diff --git a/libs/libcurl/docs/CHANGES b/libs/libcurl/docs/CHANGES index a384fadba8..cbb1072dc5 100644 --- a/libs/libcurl/docs/CHANGES +++ b/libs/libcurl/docs/CHANGES @@ -6,5570 +6,7166 @@ Changelog -Version 7.33.0 (13 Oct 2013) +Version 7.60.0 (15 May 2018) -Daniel Stenberg (13 Oct 2013) -- RELEASE-NOTES: synced with 92cf6141ed0de +Daniel Stenberg (15 May 2018) +- RELEASE-NOTES: 7.60.0 release -- curl: fix --oauth2-bearer in the --help output - - After the option rename in 5df04bfafd1 - -- OpenSSL: improve the grammar of the language in 39beaa5ffbcc - - Reported-by: Petr Pisar - -- [Andrej E Baranov brought this change] +- THANKS: added people from the curl 7.60.0 release - OpenSSL: use failf() when subjectAltName mismatches +- docs/libcurl/index.html: removed - Write to CURLOPT_ERRORBUFFER information about mismatch alternative - certificate subject names. + The HTML files are long gone from the dist, now remove the last HTML + file pointing to those missing files. - Signed-off-by: Andrej E Baranov + d -- curl: rename --bearer to --oauth2-bearer - - The option '--bearer' might be slightly ambiguous in name. It doesn't - create any conflict that I am aware of at the moment, however, OAUTH v2 - is not the only authentication mechanism which uses "bearer" tokens. - - Reported-by: Kyle L. Huff - URL: http://curl.haxx.se/mail/lib-2013-10/0064.html +- [steini2000 brought this change] -- [Kamil Dudka brought this change] - - ssh: improve the logic for detecting blocking direction + http2: remove unused variable - This fixes a regression introduced by commit 0feeab78 limiting the speed - of SCP upload to 16384 B/s on a fast connection (such as localhost). - -Dan Fandrich (12 Oct 2013) -- Fixed typo in Makefile.inc that left http2.h out of the tar ball + Closes #2570 -Daniel Stenberg (11 Oct 2013) -- [Heinrich Schaefer brought this change] +- [steini2000 brought this change] - minor fix in doc + http2: use easy handle of stream for logging -- [Gisle Vanem brought this change] - - curl_setup_once: fix errno access for lwip on Windows +- gcc: disable picky gcc-8 function pointer warnings in two places - lib/curl_setup_once.h assumed lwIP on Windows uses 'SetLastError()' to - set network errors. It doesn't; it uses 'errno'. - -- test1239: verify 4cd444e01ad and the simulated 304 response - -- [Derek Higgins brought this change] + Reported-by: Rikard Falkeborn + Bug: #2560 + Closes #2569 - HTTP: Output http response 304 when modified time is too old +- http2: use the correct function pointer typedef - When using the -w '%{http_code}' flag and simulating a Not Modified then - 304 should be output. + Fixes gcc-8 picky compiler warnings + Reported-by: Rikard Falkeborn + Bug: #2560 + Closes #2568 -- contributors: helper script to dig out contributors from git - -- RELEASE-NOTES: add twos refs to bug reports - -- RELEASE-NOTES: synced with 173160c0d068 - -Nick Zitzmann (2 Oct 2013) -- darwinssl: block TLS_RSA_WITH_NULL_SHA256 cipher +- CODE_STYLE: mention return w/o parens, but sizeof with - Credit (for catching a cipher I forgot to add to the blocked ciphers list): - https://www.ssllabs.com/ssltest/viewMyClient.html + ... and remove the github markdown syntax so that it renders better on + the web site. Also, don't use back-ticks inlined to allow the CSS to + highlight source code better. -Daniel Stenberg (2 Oct 2013) -- OpenSSL: acknowledge CURLOPT_SSL_VERIFYHOST without VERIFYPEER - - Setting only CURLOPT_SSL_VERIFYHOST without CURLOPT_SSL_VERIFYPEER set - should still verify that the host name fields in the server certificate - is fine or return failure. - - Bug: http://curl.haxx.se/mail/lib-2013-10/0002.html - Reported-by: Ishan SinghLevett +- [Rikard Falkeborn brought this change] -- KNOWN_BUGS: #84: CURLINFO_SSL_VERIFYRESULT + examples: Fix format specifiers - CURLINFO_SSL_VERIFYRESULT is only implemented for the OpenSSL and NSS - backends and not for any other! - -- [François Charlier brought this change] + Closes #2561 - xattr: add support for FreeBSD xattr API +- [Rikard Falkeborn brought this change] -- curl_easy_setopt.3: slight clarification of SEEKFUNCTION + tool: Fix format specifiers -Steve Holme (29 Sep 2013) -- tests: Fixed typos from commit 25a0c96a494297 +- [Rikard Falkeborn brought this change] -- tests: Updated email addresses in SMTP tests following recent changes + ntlm: Fix format specifiers -- test909: Removed custom EHLO response after recent changes - - ...as it is no longer required following capability and authentication - changes and is now causing problems following commit 49341628b50007 as - the test number is obtained from the client address in the EHLO. +- [Rikard Falkeborn brought this change] -- ftpserver.pl: Fixed compilation error from commit 49341628b50007 + tests: Fix format specifiers -- ftpserver.pl: Moved specifying the test number from the RCPT address - - ...to the client address as this frees the RCPT strings to contain - just an email address and by passing the test number into curl as the - client address remains consistent with POP3 and IMAP tests as they are - specified in the URL. +- [Rikard Falkeborn brought this change] -- ftpserver.pl: Added unwanted argument check to SMTP DATA command handler + lib: Fix format specifiers -Daniel Stenberg (29 Sep 2013) -- getinmemory: remove a comment - - The comment mentioned the need to free the data, but the example already - does that free +- contributors.sh: use "on github", not at -- postinmemory: new example +- http2: getsock fix for uploads - This is similar to getinmemory.c but with an initial POST. + When there's an upload in progress, make sure to wait for the socket to + become writable. - Combined-by: Ulf Samuelsson + Detected-by: steini2000 on github + Bug: #2520 + Closes #2567 -- win32: fix Visual Studio 2010 build with WINVER >= 0x600 +- pingpong: fix response cache memcpy overflow - If no WINVER and/or _WIN32_IWNNT define was set, the Windows platform - SDK often defaults to high value, e.g. 0x601 (whoch may probably depend - on the Windows version being used, in my case Windows 7). + Response data for a handle with a large buffer might be cached and then + used with the "closure" handle when it has a smaller buffer and then the + larger cache will be copied and overflow the new smaller heap based + buffer. - If WINVER >= 0x600 then winsock2.h includes some defines for WSAPoll(), - e.g. POLLIN, POLLPRI, POLLOUT etc. These defines clash with cURL's - lib/select.h. + Reported-by: Dario Weisser + CVE: CVE-2018-1000300 + Bug: https://curl.haxx.se/docs/adv_2018-82c2.html + +- http: restore buffer pointer when bad response-line is parsed - Make sure HAVE_STRUCT_POLLFD is defined then. + ... leaving the k->str could lead to buffer over-reads later on. - Bug: http://curl.haxx.se/bug/view.cgi?id=1282 - Reported-by: "kdekker" - Patch-by: Marcel Raad - -Steve Holme (28 Sep 2013) -- ssluse.c: Fixed compilation warnings when ENGINE not supported + CVE: CVE-2018-1000301 + Assisted-by: Max Dymond - The function "ssl_ui_reader" was declared but never referenced - The function "ssl_ui_writer" was declared but never referenced + Detected by OSS-Fuzz. + Bug: https://curl.haxx.se/docs/adv_2018-b138.html + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105 -Daniel Stenberg (27 Sep 2013) -- configure: use icc options without space +Patrick Monnerat (13 May 2018) +- cookies: do not take cookie name as a parameter - The latest version(s) of the icc compiler no longer accept the extra - space in the -we (warning enable), -wd (warning disable), etc. + RFC 6265 section 4.2.1 does not set restrictions on cookie names. + This is a follow-up to commit 7f7fcd0. + Also explicitly check proper syntax of cookie name/value pair. - Reported-by: Elmira A Semenova - Bug: http://curl.haxx.se/mail/lib-2013-09/0182.html - -Steve Holme (25 Sep 2013) -- imap: Added clarification to the code about odd continuation responses - -- ftp.c: Fixed compilation warning + New test 1155 checks that cookie names are not reserved words. - There is an implicit conversion from "unsigned long" to "long" + Reported-By: anshnd at github + Fixes #2564 + Closes #2566 -- sasl: Centralised the authentication mechanism strings - - Moved the standard SASL mechanism strings into curl_sasl.h rather than - hard coding the same values over and over again in the protocols that - use SASL authentication. +Daniel Stenberg (12 May 2018) +- smb: reject negative file sizes - For more information about the mechanism strings see: + Assisted-by: Max Dymond - http://www.iana.org/assignments/sasl-mechanisms - -Daniel Stenberg (23 Sep 2013) -- RELEASE-NOTES: added recent contributors missing - -Steve Holme (23 Sep 2013) -- test906: Fixed type-2 response + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8245 -- test915: Corrected test number from commit 22bccb0edaf041 +- setup_transfer: deal with both sockets being -1 + + Detected by Coverity; CID 1435559. Follow-up to f8d608f38d00. It would + index the array with -1 if neither index was a socket. -- test906: Fixed type-1 message not handled error +- travis: add build using NSS - ...from commit f81d1e16664976 due to copy paste error. + Closes #2558 -- tests: Added SMTP AUTH NTLM test +- [Sunny Purushe brought this change] -- tests: Added SMTP multiple and invalid --mail-rcpt test + openssl: change FILE ops to BIO ops + + To make builds with VS2015 work. Recent changes in VS2015 _IOB_ENTRIES + handling is causing problems. This fix changes the OpenSSL backend code + to use BIO functions instead of FILE I/O functions to circumvent those + problems. + + Closes #2512 -- tests: Added SMTP multiple --mail-rcpt test +- travis: add a build using WolfSSL + + Assisted-by: Dan Fandrich + + Closes #2528 -- tests: Added SMTP invalid --mail-rcpt test +- RELEASE-NOTES: typo -- tests: Regrouping of SMTP tests +- RELEASE-NOTES: synced -Daniel Stenberg (22 Sep 2013) -- [Benoit Sigoure brought this change] +- [Daniel Gustafsson brought this change] - test1112: Increase the timeout from 7s to 16s + URLs: fix one more http url - As someone reported on the mailing list a while back, the hard-coded - arbitrary timeout of 7s in test 1112 is not sufficient in some build - environments. At Arista Networks we build and test curl as part of our - automated build system, and we've run into this timeout 170 times so - far. Our build servers are typically quite busy building and testing a - lot of code in parallel, so despite being beefy machines with 32 cores - and 128GB of RAM we still hit this 7s timeout regularly. + This file wasn't included in commit 4af40b3646d3b09 which updated all + haxx.se http urls to https. The file was committed prior to that update, + but may have been merged after it and hence didn't get updated. - URL: http://curl.haxx.se/mail/lib-2010-02/0200.html + Closes #2550 -Steve Holme (22 Sep 2013) -- tests: Fixed smtp rcpt to addresses +- github/lock: auto-lock closed issues after 90 days of inactivity -- ftpserver.pl: Expanded the SMTP RCPT handler to validate TO addresses +- vtls: fix missing commas - RCPT_smtp() will now check for a correctly formatted TO address which - allows for invalid recipient addresses to be added. + follow-up to e66cca046cef -- ftpserver.pl: Added cURL SMTP server detection to HELO command handler +- vtls: use unified "supports" bitfield member in backends - As curl will send a HELO command after an negative EHLO response, added - the same detection from commit b07709f7417c3e to the HELO handler to - ensure the test server is identified correctly and an upload isn't - performed. - -- ftpserver.pl: Corrected response code for successful RCPT command - -- ftpserver.pl: Moved invalid RCPT TO: address detection to RCPT handler + ... instead of previous separate struct fields, to make it easier to + extend and change individual backends without having to modify them all. - Rather than detecting the TO address as missing in the DATA handler, - moved the detection to the RCPT command handler where an error response - can be generated. + closes #2547 -- RELEASE-NOTES: Corrected missed addition +- transfer: don't unset writesockfd on setup of multiplexed conns + + Curl_setup_transfer() can be called to setup a new individual transfer + over a multiplexed connection so it shouldn't unset writesockfd. - Somehow commit 60a20461629fda missed the last item in the sync list - even though I'm sure I added it during editing. + Bug: #2520 + Closes #2549 -- RELEASE-NOTES: Synced with 6dd8bd8d2f9729 +- [Frank Gevaerts brought this change] -- curl.1: Added information about optional login options to --user in manpage + configure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.h - Added missing information, from curl 7.31.0, regarding the use of the - optional login options that may be specified as part of --user. + They are removed from the compiler flags. - For example: + This ensures that make dependency tracking will force a rebuild whenever + configure --enable-debug or --enable-curldebug changes. - --user 'user:password;auth=NTLM' in IMAP, POP3 and SMTP protocols. + Closes #2548 -- ftpserver.pl: Moved cURL SMTP server detection into EHLO command handler +- http: don't set the "rewind" flag when not uploading anything - Moved the special SMTP server detection code from the DATA command - handler, which happens further down the operation chain after EHLO, - MAIL and RCPT commands, to the EHLO command as it is the first command - to be generated by a SMTP operation as well as containing the special - "verifiedserver" string from the URL. + It triggers an assert. - This not only makes it easier and quicker to detect but also means that - cURL doesn't need to specify "verifiedserver" as --mail-from and - --mail-rcpt arguments. + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8144 + Closes #2546 + +- travis: add an mbedtls build - More importantly, this also makes the upcoming verification changes to - the RCPT handler easier to implement. + Closes #2531 -Daniel Stenberg (21 Sep 2013) -- openssl: use correct port number in error message +- configure: only check for CA bundle for file-using SSL backends - In ossl_connect_step2() when the "Unknown SSL protocol error" occurs, it - would output the local port number instead of the remote one which - showed when doing SSL over a proxy (but with the correct remote host - name). As libcurl only speaks SSL to the remote we know it is the remote - port. + When only building with SSL backends that don't use the CA bundle file + (by default), skip the check. - Bug: http://curl.haxx.se/bug/view.cgi?id=1281 - Reported-by: Gordon Marler + Fixes #2543 + Fixes #2180 + Closes #2545 -- test1415: adjusted to work for 32bit time_t +- ssh-libssh.c: fix left shift compiler warning - The libcurl date parser returns INT_MAX for all dates > 2037 so this - test is now made to use 2037 instead of 2038 to work the same for both - 32bit and 64bit time_t systems. - -Steve Holme (21 Sep 2013) -- tests: Reworked existing SMTP tests to be single recipient based + ssh-libssh.c:2429:21: warning: result of '1 << 31' requires 33 bits to + represent, but 'int' only has 32 bits [-Wshift-overflow=] - ...in preparation of upcoming multiple recipient tests. - -- ftpserver.pl: Corrected SMTP QUIT response to be more realistic - -Daniel Stenberg (20 Sep 2013) -- curl_easy_setopt.3: clarify that TIMEOUT and TIMEOUT_MS set the same value + 'len' will never be that big anyway so I converted the run-time check to + a regular assert. -- [Kim Vandry brought this change] +- [Stephan Mühlstrasser brought this change] - Documented --dns-* options in curl manpage - -Steve Holme (20 Sep 2013) -- pop3: Added basic SASL XOAUTH2 support + URL: fix ASCII dependency in strcpy_url and strlen_url - Added the ability to use an XOAUTH2 bearer token [RFC6750] with POP3 for - authentication using RFC6749 "OAuth 2.0 Authorization Framework". + Commit 3c630f9b0af097663a64e5c875c580aa9808a92b partially reverted the + changes from commit dd7521bcc1b7a6fcb53c31f9bd1192fcc884bd56 because of + the problem that strcpy_url() was modified unilaterally without also + modifying strlen_url(). As a consequence strcpy_url() was again + depending on ASCII encoding. - The bearer token is expected to be valid for the user specified in - conn->user. If CURLOPT_XOAUTH2_BEARER is defined and the connection has - an advertised auth mechanism of "XOAUTH2", the user and access token are - formatted as a base64 encoded string and sent to the server as - "AUTH XOAUTH2 ". - -- curl: Added clarification to the --mail options in the --help output + This change fixes strlen_url() and strcpy_url() in parallel to use a + common host-encoding independent criterion for deciding whether an URL + character must be %-escaped. - ... that these options apply to SMTP only. + Closes #2535 -- ftpserver.pl: Moved SMTP RCPT response text into command handler +- [Denis Ollier brought this change] + + docs: remove extraneous commas in man pages + + Closes #2544 -- tests: Added SMTP invalid --mail-from test +- RELEASE-NOTES: synced -Nick Zitzmann (19 Sep 2013) -- darwinssl: enable BEAST workaround on iOS 7 & later +- Revert "TODO: remove configure --disable-pthreads" - iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 - and a CBC cipher, so we now always turn that on unless the user - manually turns it off using CURLSSLOPT_ALLOW_BEAST. + This reverts commit d5d683a97f9765bddfd964fe32e137aa6e703ed3. - It appears Apple also added some new PSK ciphers, but no interface to - use them yet, so we at least support printing them if we find them. + --disable-pthreads can be used to disable pthreads and get the threaded + resolver to use the windows threading when building with mingw. -Steve Holme (19 Sep 2013) -- tests: Updated SMTP AUTH tests to use the new AUTH directive +- vtls: don't define MD5_DIGEST_LENGTH for wolfssl - ...rather than specify a customised EHLO response. + ... as it defines it (too) -- tests: Corrected test913 as the QUIT response is received +- TODO: remove configure --disable-pthreads -- tests: Added SMTP large message SIZE test +Jay Satiro (2 May 2018) +- [David Garske brought this change] -- ftpserver.pl: Updated email regex from commit 98f7ca7e971006 + wolfssl: Fix non-blocking connect - ...to not be as strict as it was rejecting valid numeric email - addresses. + Closes https://github.com/curl/curl/pull/2542 -- tests: Fixed smtp mail from addresses +Daniel Stenberg (30 Apr 2018) +- CURLOPT_URL.3: add ENCODING section [ci skip] + + Feedback-by: Michael Kilburn -- ftpserver.pl: Standardised CAPA and AUTH responses +- KNOWN_BUGS: Client cert with Issuer DN differs between backends + + Closes #1411 -- ftpserver.pl: Corrected POP3 QUIT reply to be more realistic +- KNOWN_BUGS: Passive transfer tries only one IP address + + Closes #1508 -- runtests.pl: Fixed syntax error in commit c873375123343e +- KNOWN_BUGS: --upload-file . hang if delay in STDIN - Possible unintended interpolation in string at line 796 + Closes #2051 -- runtests.pl: Fixed smtp mail from address +- KNOWN_BUGS: Connection information when using TCP Fast Open - Following changes to ftpserver.pl fixed the mail from address to be a - correctly formatted address otherwise the server response will be 501 - Invalid address. + Closes #1332 -- ftpserver.pl: Fixed syntax error in commit 98f7ca7e971006 +- travis: enable libssh2 on both macos and Linux + + It seems to not be detected by default anymore (which is a bug I + believe) - Can't modify constant item in scalar assignment line 779, near "0;" + Closes #2541 -- ftpserver.pl: Expanded the SMTP MAIL handler to validate messages +- TODO: Support the clienthello extension - MAIl_smtp() will now check for a correctly formatted FROM address as - well as the optional SIZE parameter comparing it against the server - capability when specified. + Closes #2299 -Daniel Stenberg (17 Sep 2013) -- [YAMADA Yasuharu brought this change] +- TODO: CLOEXEC + + Closes #2252 - cookies: add expiration +- tests: provide 'manual' as a feature to optionally require + + ... and make test 1026 rely on that feature so that --disable-manual + builds don't cause test failures. - Implement: Expired Cookies These following situation, curl removes - cookie(s) from struct CookieInfo if the cookie expired. - - Curl_cookie_add() - - Curl_cookie_getlist() - - cookie_output() + Reported-by: Max Dymond and Anders Roxell + Fixes #2533 + Closes #2540 -Steve Holme (17 Sep 2013) -- ftpserver.pl: Corrected response code for successful MAIL command +- CURLINFO_PROTOCOL.3: mention the existing defined names -- ftpserver.pl: Moved SMTP MAIL handler into own function +Jay Satiro (27 Apr 2018) +- [Daniel Gustafsson brought this change] -- dns: fix compilation with MinGW from commit df69440d05f113 + cookies: remove unused macro - Avoid 'interface' literal that some MinGW versions define as a macro + Commit 2bc230de63 made the macro MAX_COOKIE_LINE_TXT become unused, + so remove as it's not part of the published API. - Additionally, corrected some very, very minor coding style errors. + Closes https://github.com/curl/curl/pull/2537 -- tests: Fixed test 1406 following recent changes in ftpserver.pl +Daniel Stenberg (27 Apr 2018) +- [Daniel Gustafsson brought this change] + + checksrc: force indentation of lines after an else + + This extends the INDENTATION case to also handle 'else' statements + and require proper indentation on the following line. Also fixes the + offending cases found in the codebase. - By default the mail server doesn't send the SIZE capability but instead - it has to be specified as a supported capability. + Closes #2532 -- tests: Added test for SMTP SIZE capability +- http2: fix null pointer dereference in http2_connisdead + + This function can get called on a connection that isn't setup enough to + have the 'recv_underlying' function pointer initialized so it would try + to call the NULL pointer. + + Reported-by: Dario Weisser + + Follow-up to db1b2c7fe9b093f8 (never shipped in a release) + Closes #2536 -- ftpserver.pl: Added the ability to include spaces in capabilities +- http2: get rid of another strstr() - For example: + Follow-up to 1514c44655e12e: replace another strstr() call done on a + buffer that might not be zero terminated - with a memchr() call, even if + we know the substring will be found. - CAPA "SIZE 1048576" 8BITMIME BINARYMIME + Assisted-by: Max Dymond - will populate the capabilities list with the following in: + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8021 - SIZE 1048576 - 8BITMIME - BINARYMIME - -- ftpserver.pl: Corrected response code for successful SMTP QUIT command + Closes #2534 -- ftpserver.pl: Fixed syntax error in commit 33c1f2876b9029 +- cyassl: adapt to libraries without TLS 1.0 support built-in - Can't modify constant item in postincrement line 727, near "i++" + WolfSSL doesn't enable it by default anymore -- ftpserver.pl: Added CAPA & AUTH directive support to the SMTP EHLO handler +- configure: provide --with-wolfssl as an alias for --with-cyassl -- ftpserver.pl: Fixed SMTP QUIT handler from dadc495540946e +- RELEASE-NOTES: synced -- ftpserver.pl: Moved SMTP EHLO and QUIT handlers in own functions +- [Daniel Gustafsson brought this change] -- ftpserver.pl: Added support for SMTP HELO command + os400.c: fix ASSIGNWITHINCONDITION checksrc warnings - ...and updated test902 as explicit HELO response is no longer required. - -- ftpserver.pl: Added mailbox check to IMAP SELECT handler - -- ftpserver.pl: Corrected invalid user details check + All occurrences of assignment within conditional expression in + os400sys.c rewritten into two steps: first assignment and then the check + on the success of the assignment. Also adjust related incorrect brace + positions to match project indentation style. - ...in both the IMAP LOGIN and POP3 PASS handlers introduced in commit - 187ac693744949 and 84ad1569e5fc93 respectively. - -- ftpserver.pl: Moved IMAP LOGIN handler into own function - -- ftpserver.pl: Moved POP3 USER and PASS handlers into own functions - -- ftpserver.pl: Corrected invalid argument check in POP3 TOP handler + This was spurred by seeing "if((inp = input_token))", but while in there + all warnings were fixed. - ...which was accidentally introduced in commit 4d6ef6297ae9b6. - -- ftpserver.pl: Added capability prerequisite for extended POP3 commands - -- tests: Updated descriptions to be more meaningful - -- ftpserver.pl: Added support for IMAP NOOP command - -- imap: Fixed response check for NOOP command + There should be no functional change from these changes. + + Closes #2525 -- tests: Updated descriptions to be more meaningful +- [Daniel Gustafsson brought this change] -Daniel Stenberg (13 Sep 2013) -- curl.1: detail how short/long options work + cookies: ensure that we have cookies before writing jar - URL: http://curl.haxx.se/bug/view.cgi?id=1279 - Suggested-by: Jerry Krinock + The jar should be written iff there are cookies, so ensure that we still + have cookies after expiration to avoid creating an empty file. + + Closes #2529 -Steve Holme (13 Sep 2013) -- curl: Fixed usage of DNS options when not using c-ares resolver +- strcpy_url: only %-encode values >= 0x80 + + OSS-Fuzz detected - Commit 32352ed6adddcb introduced various DNS options, however, these - would cause curl to exit with CURLE_NOT_BUILT_IN when c-ares wasn't - being used as the backend resolver even if the options weren't set - by the user. + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8000 - Additionally corrected some minor coding style errors from the same - commit. + Broke in dd7521bcc1b7 -Daniel Stenberg (13 Sep 2013) -- curl_easy_setopt.3: mention RTMP URL quirks +- mime: avoid NULL pointer dereference risk - URL: http://curl.haxx.se/bug/view.cgi?id=1278 - Reported-by: Gorilla Maguila + Coverity detected, CID 1435120 + + Closes #2527 -- [Ben Greear brought this change] +- [Stephan Mühlstrasser brought this change] - curl: Add support for various DNS binding options. + ctype: restore character classification for non-ASCII platforms - (Passed on to c-ares.) + With commit 4272a0b0fc49a1ac0ceab5c4a365c9f6ab8bf8e2 curl-speficic + character classification macros and functions were introduced in + curl_ctype.[ch] to avoid dependencies on the locale. This broke curl on + non-ASCII, e.g. EBCDIC platforms. This change restores the previous set + of character classification macros when CURL_DOES_CONVERSIONS is + defined. - Allows something like this: + Closes #2494 + +- ftplistparser: keep state between invokes - curl --dns-interface sta8 --dns-ipv4-addr 8.8.1.111 --interface sta8 \ - --localaddr 8.8.1.111 --dns-servers 8.8.8.1 www.google.com + Fixes FTP wildcard parsing when done over a number of read buffers. - Signed-off-by: Ben Greear - -- [Kim Vandry brought this change] - - libcurl: New options to bind DNS to local interfaces or IP addresses - -- libcurl.3: for multi interface connections are held in the multi handle + Regression from f786d1f14 - ... and a few more cleanups/clarifications - -Steve Holme (12 Sep 2013) -- ftpserver.pl: Fixed missing comma from 7fd84b14d219b1 + Reported-by: wncboy on github + Fixes #2445 + Closes #2526 -- ftpserver.pl: Fixed variable error introduced in 7fd84b14d219b1 +- examples/http2-upload: expand buffer to avoid silly warning - Global symbol "$mailbox" requires explicit package name - -- ftpserver.pl: Added support for UID command - -- ftpserver.pl: Added support for LSUB command - -- imap: Fixed response check for LSUB and UID commands - -- ftpserver.pl: Added support for IMAP COPY command + http2-upload.c:135:44: error: ‘%02d’ directive output may be truncated + writing between 2 and 11 bytes into a region of size between 8 and 17 -- ftpserver.pl: Added support for IMAP CLOSE and EXPUNGE commands - -- ftpserver.pl: Added support for POP3 RSET command - -- ftpserver.pl: Added the ability to remember what messages are deleted +- examples/sftpuploadresume: typecast fseek argument to long - ...as this will be required for IMAP CLOSE and EXPUNGE commands as well - as the POP3 RSET command. + /docs/examples/sftpuploadresume.c:102:12: warning: conversion to 'long + int' from 'curl_off_t {aka long long int}' may alter its value -Daniel Stenberg (10 Sep 2013) -- NI_MAXSERV: remove all use of it +- Revert "ftplistparser: keep state between invokes" - Solaris with the SunStudio Compiler is reportedly missing this define, - but as we're using it without any good reason on all the places it was - used I've now instead switched to just use sensible buffer sizes that - fit a 32 bit decimal number. Which also happens to be smaller than the - common NI_MAXSERV value which is 32 on most machines. + This reverts commit abbc8457d85aca74b7cfda1d394b0844932b2934. - Bug: http://curl.haxx.se/bug/view.cgi?id=1277 - Reported-by: D.Flinkmann + Caused fuzzer problems on travis not seen when this was a PR! -- http2: use the support HTTP2 draft version in the upgrade header +- Curl_memchr: zero length input can't match - ... instead of HTTP/2.0 to work fine with the nghttpx proxy/server. - -Steve Holme (10 Sep 2013) -- ldap.c: Fix compilation warning + Avoids undefined behavior. - warning: comparison between signed and unsigned integer expressions - -- [Jiri Hruska brought this change] + Reported-by: Geeknik Labs - imap/pop3/smtp: Speed up SSL connection initialization +- ftplistparser: keep state between invokes - Don't wait for the next callback call (usually 1 second) before - continuing with protocol specific connection initialization. + Fixes FTP wildcard parsing when doing over a number of read buffers. + + Regression from f786d1f14 + + Reported-by: wncboy on github + Fixes #2445 + Closes #2519 -- ldap.c: Corrected build error from commit 857f999353f333 +- ftplistparser: renamed some members and variables + + ... to make them better spell out what they're for. -- RELEASE-NOTES: Corrected duplicate in bfefe2400a16b8 +- RELEASE-NOTES: synced -- RELEASE-NOTES: Corrected typo from bfefe2400a16b8 +- [Christian Schmitz brought this change] -- RELEASE-NOTES: synced with 25c68903756d6b + curl_global_sslset: always provide available backends + + Closes #2499 -Daniel Stenberg (10 Sep 2013) -- README.http2: explain nghttp2 a little +- http2: convert an assert to run-time check + + Fuzzing has proven we can reach code in on_frame_recv with status_code + not having been set, so let's detect that in run-time (instead of with + assert) and error error accordingly. + + (This should no longer happen with the latest nghttp2) + + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7903 + Closes #2514 -Steve Holme (9 Sep 2013) -- tests: Added test for POP3 TOP command +- curl.1: clarify that options and URLs can be mixed + + Fixes #2515 + Closes #2517 -- ftpserver.pl: Added support for POP3 TOP command +Jay Satiro (23 Apr 2018) +- [Archangel_SDY brought this change] -- tests: Added test for POP3 UIDL command + CURLOPT_SSLCERT.3: improve WinSSL-specific usage info + + Ref: https://github.com/curl/curl/pull/2376#issuecomment-381858780 + + Closes https://github.com/curl/curl/pull/2504 -- ftpserver.pl: Added support for POP3 UIDL command +- [Archangel_SDY brought this change] -Daniel Stenberg (9 Sep 2013) -- http2: adjust to new nghttp2_pack_settings_payload proto + schannel: fix build error on targets <= XP - This function was modified in nghttp2 git commit a1c3f89c72e51 - -Kamil Dudka (9 Sep 2013) -- url: handle abortion by read/write callbacks, too + - Use CRYPT_STRING_HEX instead of CRYPT_STRING_HEXRAW since XP doesn't + support the latter. - Otherwise, the FTP protocol would unnecessarily hang 60 seconds if - aborted in the CURLOPT_HEADERFUNCTION callback. + Ref: https://github.com/curl/curl/pull/2376#issuecomment-382153668 - Reported by: Tomas Mlcoch - Bug: https://bugzilla.redhat.com/1005686 + Closes https://github.com/curl/curl/pull/2504 -Daniel Stenberg (9 Sep 2013) -- ldap: fix the build for systems with ldap_url_parse() +Daniel Stenberg (23 Apr 2018) +- Revert "ftplistparser: keep state between invokes" - Make sure that the custom struct fields are only used by code that - doesn't use a struct defintion from the outside. + This reverts commit 8fb78f9ddc6d858d630600059b8ad84a80892fd9. - Attempts to fix the problem introduced in 3dc6fc42bfc61b + Unfortunately this fix introduces memory leaks I've not been able to fix + in several days. Reverting this for now to get the leaks fixed. -Steve Holme (9 Sep 2013) -- [Jiri Hruska brought this change] +Jay Satiro (21 Apr 2018) +- tool_help: clarify --max-time unit of time is seconds + + Before: + -m, --max-time