Jay Satiro [Tue, 29 Jun 2021 15:43:35 +0000 (11:43 -0400)]
http: fix crash in rate-limited upload
- Don't set the size of the piece of data to send to the rate limit if
that limit is larger than the buffer size that will hold the piece.
Prior to this change if CURLOPT_MAX_SEND_SPEED_LARGE
(curl tool: --limit-rate) was set then it was possible that a temporary
buffer used for uploading could be written to out of bounds. A likely
scenario for this would be a non-trivial amount of post data combined
with a rate limit larger than CURLOPT_UPLOAD_BUFFERSIZE (default 64k).
The bug was introduced in 24e469f which is in releases since 7.76.0.
Daniel Stenberg [Mon, 28 Jun 2021 14:41:17 +0000 (16:41 +0200)]
openssl: avoid static variable for seed flag
Avoid the race condition risk by instead storing the "seeded" flag in
the multi handle. Modern OpenSSL versions handle the seeding itself so
doing the seeding once per multi-handle instead of once per process is
less of an issue.
Andrei Rybak [Mon, 28 Jun 2021 10:15:34 +0000 (12:15 +0200)]
misc: fix typos in comments which repeat a word
Fix typos in code comments which repeat various words. In trivial
cases, just delete the repeated word. Reword the affected sentence in
"lib/url.c" for it to make sense.
Closes #7303 Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
- Check whether a connection has succeded before checking whether it's
timed out.
This means if we've connected quickly, but subsequently been
descheduled, we allow the connection to succeed. Note, if we timeout,
but between checking the timeout, and connecting to the server the
connection succeeds, we will allow it to go ahead. This is viewed as
an acceptable trade off.
- Add additional failf logging around failed connection attempts to
propogate the cause up to the caller.
Gregory Muchka [Wed, 16 Jun 2021 00:12:49 +0000 (18:12 -0600)]
hostip: (macOS) free returned memory of SCDynamicStoreCopyProxies
From Apples documentation on SCDynamicStoreCopyProxies, "Return Value: A
dictionary of key-value pairs that represent the current internet proxy
settings, or NULL if no proxy settings have been defined or if an error
occurred. You must release the returned value."
Failure to release the returned value of SCDynamicStoreCopyProxies can
result in a memory leak.
Jay Satiro [Tue, 15 Jun 2021 04:13:36 +0000 (00:13 -0400)]
curl_multibyte: Remove local encoding fallbacks
- If the UTF-8 to UTF-16 conversion fails in Windows Unicode builds then
no longer fall back to assuming the string is in a local encoding.
Background:
Some functions in Windows Unicode builds must convert UTF-8 to UTF-16 to
pass to the Windows CRT API wide-character functions since in Windows
UTF-8 is not a valid locale (or at least 99% of the time right now).
Prior to this change if the Unicode encoding conversion failed then
libcurl would assume, for backwards compatibility with applications that
may have written their code for non-Unicode builds, attempt to convert
the string from local encoding to UTF-16.
That type of "best effort" could theoretically cause some type of
security or other problem if a string that was locally encoded was also
valid UTF-8, and therefore an unexpected UTF-8 to UTF-16 conversion
could occur.
it needs to be processed by autoconf or autoreconf, and doesn't have a
suitable shebang to be directly executed. other projects normally set
configure.ac -x.
Viktor Szakats [Tue, 15 Jun 2021 12:10:48 +0000 (12:10 +0000)]
idn: fix libidn2 with windows unicode builds
Unicode Windows builds use UTF-8 strings internally in libcurl,
so make sure to call the UTF-8 flavour of the libidn2 API. Also
document that Windows builds with libidn2 and UNICODE do expect
CURLOPT_URL as an UTF-8 string.
Reported-by: dEajL3kA on github Assisted-by: Jay Satiro Reviewed-by: Marcel Raad
Closes #7246
Fixes #7228
Daniel Stenberg [Mon, 31 May 2021 06:59:24 +0000 (08:59 +0200)]
curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
They were never officially allowed and slipped in only due to sloppy
parsing. Spaces (ascii 32) should be correctly encoded (to %20) before
being part of a URL.
The new flag bit CURLU_ALLOW_SPACE when a full URL is set, makes libcurl
allow spaces.
For the commandline tool, we expect to be passed
SSL_CONN_CONFIG(CAfile); for library use, the use should pass a set of
trusted roots (like in other TLS backends).
This also removes a dependency on Security.framework when building on
macOS.
Mohammed Naser [Wed, 9 Jun 2021 19:41:44 +0000 (15:41 -0400)]
CI: add jobs using Zuul
It also includes a few changes to get the builds going:
- Added autoconf to common dependencies
- Added automake to common dependencies
- Added libtool to common dependencies
- Added libssl-dev to common dependencies
Mark Swaanenburg [Fri, 11 Jun 2021 06:27:00 +0000 (06:27 +0000)]
lib: don't compare fd to FD_SETSIZE when using poll
FD_SETSIZE is irrelevant when using poll. So ensuring that the file
descriptor is smaller than FD_SETSIZE in VALID_SOCK, can cause
multi_wait to ignore perfectly valid file descriptors and simply wait
for 1s to avoid hammering the CPU in a busy loop.
Daniel Stenberg [Tue, 8 Jun 2021 15:28:59 +0000 (17:28 +0200)]
runtests: skip disabled tests unless -f is used
To make it easier to write ranges like '115 to 229' without that
explicitly enabling tests that are listed in DISABLED, this makes
runtests always skip disabled tests unless the -f command line option is
used.
Previously the code attempted to not run such tests, but didn't do it
correctly.
Jun-ya Kato [Mon, 7 Jun 2021 00:52:14 +0000 (00:52 +0000)]
ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
The latest GnuTLS-3.7.2 implements disable switch for TLSv1.3 compatible
mode for middle box but it is enabled by default, which is unnecessary
for QUIC.
projects / thirdparty / curl.git / log
