diff --git a/project/jni/curl/Android.mk b/project/jni/curl/Android.mk index ec70b3744..8346a08ac 100644 --- a/project/jni/curl/Android.mk +++ b/project/jni/curl/Android.mk @@ -1,8 +1,13 @@ # Google Android makefile for curl and libcurl # +# This file can be used when building curl using the full Android source +# release or the NDK. Most users do not want or need to do this; please +# instead read the Android section in docs/INSTALL for alternate +# methods. +# # Place the curl source (including this makefile) into external/curl/ in the # Android source tree. Then build them with 'make curl' or just 'make libcurl' -# from the Android root. Tested with Android 1.5 and 2.1 +# from the Android root. Tested with Android versions 1.5, 2.1-2.3 # # Note: you must first create a curl_config.h file by running configure in the # Android environment. The only way I've found to do this is tricky. Perform a @@ -42,15 +47,11 @@ # into the right place (but see the note about this below). # # Dan Fandrich -# August 2010 +# November 2011 LOCAL_PATH:= $(call my-dir) -common_CFLAGS := \ - -Wpointer-arith -Wwrite-strings -Wunused -Winline -Wnested-externs -Wmissing-declarations -Wmissing-prototypes \ - -Wno-long-long -Wfloat-equal -Wno-multichar -Wsign-compare -Wno-format-nonliteral -Wendif-labels \ - -Wstrict-prototypes -Wdeclaration-after-statement -Wno-system-headers -DHAVE_CONFIG_H -std=gnu99 - +common_CFLAGS := -Wpointer-arith -Wwrite-strings -Wunused -Winline -Wnested-externs -Wmissing-declarations -Wmissing-prototypes -Wno-long-long -Wfloat-equal -Wno-multichar -Wsign-compare -Wno-format-nonliteral -Wendif-labels -Wstrict-prototypes -Wdeclaration-after-statement -Wno-system-headers -DHAVE_CONFIG_H ######################### # Build the libcurl library @@ -58,9 +59,8 @@ common_CFLAGS := \ include $(CLEAR_VARS) include $(LOCAL_PATH)/lib/Makefile.inc CURL_HEADERS := \ - curlbuild.h \ curl.h \ - curlrules.h \ + system.h \ curlver.h \ easy.h \ mprintf.h \ @@ -69,10 +69,15 @@ CURL_HEADERS := \ typecheck-gcc.h LOCAL_SRC_FILES := $(addprefix lib/,$(CSOURCES)) -LOCAL_C_INCLUDES := $(LOCAL_PATH)/include $(LOCAL_PATH)/include/curl $(LOCAL_PATH)/lib $(LOCAL_PATH)/../openssl/include -LOCAL_CFLAGS += $(common_CFLAGS) +LOCAL_C_INCLUDES := $(LOCAL_PATH)/include/ $(LOCAL_PATH)/lib $(LOCAL_PATH)/../openssl/include +LOCAL_CFLAGS += $(common_CFLAGS) -DBUILDING_LIBCURL + +LOCAL_COPY_HEADERS_TO := libcurl/curl +LOCAL_COPY_HEADERS := $(addprefix include/curl/,$(CURL_HEADERS)) + +LOCAL_MODULE:= libcurl +LOCAL_MODULE_TAGS := optional -LOCAL_MODULE := curl LOCAL_MODULE_FILENAME := libcurl-sdl # It clashes with system libcurl in Android 4.3 and older LOCAL_SHARED_LIBRARIES := ssl crypto @@ -80,4 +85,3 @@ LOCAL_SHARED_LIBRARIES := ssl crypto LOCAL_LDLIBS := -lz include $(BUILD_SHARED_LIBRARY) - diff --git a/project/jni/curl/CHANGES b/project/jni/curl/CHANGES index da5ded9d4..cbb1072dc 100644 --- a/project/jni/curl/CHANGES +++ b/project/jni/curl/CHANGES @@ -6,5470 +6,7166 @@ Changelog -Version 7.48.0 (23 Mar 2016) +Version 7.60.0 (15 May 2018) -Daniel Stenberg (23 Mar 2016) -- RELEASE-NOTES: curl 7.48.0 +Daniel Stenberg (15 May 2018) +- RELEASE-NOTES: 7.60.0 release -- THANKS: 15 new contributors from 7.48.0 release +- THANKS: added people from the curl 7.60.0 release -Jay Satiro (23 Mar 2016) -- CURLINFO_TLS_SSL_PTR.3: Warn about limitations +- docs/libcurl/index.html: removed - Bug: https://github.com/curl/curl/issues/685 - -Daniel Stenberg (22 Mar 2016) -- Revert "sshserver: remove use of AuthorizedKeysFile2" - - It seems we may have some autobuild problems after this commit went - in. Trying to see if a revert helps to get them back. + The HTML files are long gone from the dist, now remove the last HTML + file pointing to those missing files. - This reverts commit 2716350d1f3edc8e929f6ceeee05051090f6d642. + d + +- [steini2000 brought this change] -- maketgz: add -j to make dist + http2: remove unused variable - ... makes it a lot faster + Closes #2570 -- libcurl-thread.3: minor nroff format fix +- [steini2000 brought this change] -- CURLINFO_TLS_SSL_PTR.3: minor nroff format fix + http2: use easy handle of stream for logging -- CODE_STYLE: indend example code +- gcc: disable picky gcc-8 function pointer warnings in two places - ... to make it look nicer in markdown outputa + Reported-by: Rikard Falkeborn + Bug: #2560 + Closes #2569 -Jay Satiro (22 Mar 2016) -- build-wolfssl: Update VS properties for wolfSSL v3.9.0 - - - Do not use wolfSSL's sample user-setting files. - - wolfSSL starting in v3.9.0 has added their own sample user settings that - are applied by default, but we don't use them because we have our own - settings. +- http2: use the correct function pointer typedef - - Do not use wolfSSL's Visual Studio Unicode character setting. - - wolfSSL Visual Studio projects use the Unicode character set however our - settings and options imitate mingw build which does not use the Unicode - character set. This does not appear to have any effect at the moment but - better safe than sorry. - - - These changes are backwards compatible with earlier versions. + Fixes gcc-8 picky compiler warnings + Reported-by: Rikard Falkeborn + Bug: #2560 + Closes #2568 -Steve Holme (22 Mar 2016) -- hostip6: Fixed compilation warnings when verbose strings disabled - - warning C4189: 'data': local variable is initialized but not referenced +- CODE_STYLE: mention return w/o parens, but sizeof with - ...and some minor formatting/spacing changes. + ... and remove the github markdown syntax so that it renders better on + the web site. Also, don't use back-ticks inlined to allow the CSS to + highlight source code better. -Daniel Stenberg (21 Mar 2016) -- sshserver: remove use of AuthorizedKeysFile2 - - Support for the (undocumented) AuthorizedKeysFile2 was removed in - OpenSSH 5.9, released in September 2011 - - Closes #715 +- [Rikard Falkeborn brought this change] -Steve Holme (20 Mar 2016) -- connect/ntlm/http: Fixed compilation warnings when verbose strings disabled + examples: Fix format specifiers - warning C4189: 'data': local variable is initialized but not referenced + Closes #2561 -- openssl: Fixed compilation warning when /Wall enabled - - warning C4706: assignment within conditional expression +- [Rikard Falkeborn brought this change] -- CODE_STYLE: Use boolean conditions - - Rather than use TRUE, FALSE, NULL, 0 or != 0 in if/while conditions. - - Additionally, corrected some example code to adhere to the recommended - coding style. + tool: Fix format specifiers -- inet_pton.c: Fixed compilation warnings - - warning: conversion to 'unsigned char' from 'int' may alter its value +- [Rikard Falkeborn brought this change] -Daniel Stenberg (19 Mar 2016) -- RELEASE-NOTES: synced with 80851028efc2fa9 + ntlm: Fix format specifiers -- mbedtls: fix compiler warning - - vtls/mbedtls.h:67:36: warning: implicit declaration of function - ‘mbedtls_sha256’ [-Wimplicit-function-declaration] +- [Rikard Falkeborn brought this change] -Steve Holme (19 Mar 2016) -- easy: Minor coding standard and style updates - - Following commit c5744340db. Additionally removes the need for a second - 'result code' variable as well. + tests: Fix format specifiers -Jay Satiro (19 Mar 2016) -- easy: Remove poll failure check in easy_transfer - - .. because curl_multi_wait can no longer signal poll failure. - - follow-up to 77e1726 - - Bug: https://github.com/curl/curl/issues/707 - -Steve Holme (19 Mar 2016) -- build: Added missing Visual Studio filter files for VC10 onwards - - As these files don't need to contain references to the source files, - although typically do, added basic files which only include three - filters and don't require the project file generator to be modified. - - These files allow the source code to be viewed in the Solution Explorer - in versions of Visual Studio from 2010 onwards in the same manner as - previous versions did rather than one large view of files. +- [Rikard Falkeborn brought this change] -- ftp/imap/pop3/smtp: Fixed compilation warning when /Wall enabled - - warning C4706: assignment within conditional expression + lib: Fix format specifiers -- config-w32.h: Fixed compilation warning when /Wall enabled - - warning C4668: 'USE_IPV6' is not defined as a preprocessor macro, - replacing with '0' for '#if/#elif' +- contributors.sh: use "on github", not at -- imap.c: Fixed compilation warning with /Wall enabled +- http2: getsock fix for uploads - warning C4701: potentially uninitialized local variable 'size' used + When there's an upload in progress, make sure to wait for the socket to + become writable. - Technically this can't happen, as the usage of 'size' is protected by - 'if(parsed)' and 'parsed' is only set after 'size' has been parsed. - - Anyway, lets keep the compiler happy. - -- KNOWN_BUGS: #93 Issue with CURLFORM_CONTENTLEN in arrays on 32-bit platforms + Detected-by: steini2000 on github + Bug: #2520 + Closes #2567 -Daniel Stenberg (18 Mar 2016) -- bump: the coming release is 7.48.0 - -- configure: use cpp -P when needed +- pingpong: fix response cache memcpy overflow - Since gcc 5, the processor output can get split up on multiple lines - that made the configure script fail to figure out values from - definitions. The fix is to use cpp -P, and this fix now first checks if - cpp -P is necessary and then if cpp -P works before it uses that to - extract defined values. + Response data for a handle with a large buffer might be cached and then + used with the "closure" handle when it has a smaller buffer and then the + larger cache will be copied and overflow the new smaller heap based + buffer. - Fixes #719 + Reported-by: Dario Weisser + CVE: CVE-2018-1000300 + Bug: https://curl.haxx.se/docs/adv_2018-82c2.html -Steve Holme (18 Mar 2016) -- formdata.c: Fixed compilation warning - - formdata.c:390: warning: cast from pointer to integer of different size +- http: restore buffer pointer when bad response-line is parsed - Introduced in commit ca5f9341ef this happens because a char*, which is - 32-bits wide in 32-bit land, is being cast to a curl_off_t which is - 64-bits wide where 64-bit integers are supported by the compiler. + ... leaving the k->str could lead to buffer over-reads later on. - This doesn't happen in 64-bit land as a pointer is the same size as a - curl_off_t. + CVE: CVE-2018-1000301 + Assisted-by: Max Dymond - This fix doesn't address the fact that a 64-bit value cannot be used - for CURLFORM_CONTENTLEN when set in a form array and compiled on a - 32-bit platforms, it does at least suppress the compilation warning. + Detected by OSS-Fuzz. + Bug: https://curl.haxx.se/docs/adv_2018-b138.html + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105 -Daniel Stenberg (18 Mar 2016) -- FAQ: 2.5 Install libcurl for both 32bit and 64bit? - -- [Gisle Vanem brought this change] - - openssl: adapt to API breakage in ERR_remove_thread_state() +Patrick Monnerat (13 May 2018) +- cookies: do not take cookie name as a parameter - The OpenSSL API change that broke this is "Convert ERR_STATE to new - multi-threading API": openssl commit 8509dcc. + RFC 6265 section 4.2.1 does not set restrictions on cookie names. + This is a follow-up to commit 7f7fcd0. + Also explicitly check proper syntax of cookie name/value pair. - Closes #713 - -- version: init moved to private name space, added protos + New test 1155 checks that cookie names are not reserved words. - follow-up to 80015cdd52145 + Reported-By: anshnd at github + Fixes #2564 + Closes #2566 -- openssl: verbose: show matching SAN pattern +Daniel Stenberg (12 May 2018) +- smb: reject negative file sizes - ... to allow users to see which specfic wildcard that matched when such - is used. + Assisted-by: Max Dymond - Also minor logic cleanup to simplify the code, and I removed all tabs - from verbose strings. - -Jay Satiro (16 Mar 2016) -- version: thread safety + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8245 -Steve Holme (16 Mar 2016) -- transfer: Removed redundant HTTP authentication include files +- setup_transfer: deal with both sockets being -1 - It would also seem that share.h is not required here either as there - are no references to the Curl_share structure or functions. + Detected by Coverity; CID 1435559. Follow-up to f8d608f38d00. It would + index the array with -1 if neither index was a socket. -- easy: Removed redundant HTTP authentication include files - -Jay Satiro (15 Mar 2016) -- CURLOPT_SSLENGINE.3: Only for OpenSSL built with engine support +- travis: add build using NSS - Bug: https://curl.haxx.se/mail/lib-2016-03/0150.html - Reported-by: Oliver Graute - -Steve Holme (15 Mar 2016) -- curl_sasl: Minor code indent fixes + Closes #2558 -Daniel Stenberg (14 Mar 2016) -- runtests: mention when run event-based +- [Sunny Purushe brought this change] -- easy: add check to malloc() when running event-based + openssl: change FILE ops to BIO ops - ... to allow torture tests then too. - -- memdebug: skip logging the limit countdown, fflush when reached - -- CODE_STYLE: Space around operators + To make builds with VS2015 work. Recent changes in VS2015 _IOB_ENTRIES + handling is causing problems. This fix changes the OpenSSL backend code + to use BIO functions instead of FILE I/O functions to circumvent those + problems. - As just discussed on the mailing list, also document how we prefer - spacing in expressions. + Closes #2512 -- curl: glob_range: no need to check unsigned variable for negative +- travis: add a build using WolfSSL - cppcheck warned: + Assisted-by: Dan Fandrich - [src/tool_urlglob.c:283]: (style) Checking if unsigned variable 'step_n' - is less than zero. - -- CODE_STYLE: add example for indent style as well + Closes #2528 -- CODE_STYLE: mention braces for functions too +- RELEASE-NOTES: typo -- docs/Makefile.am: include CODE_STYLE in tarball too +- RELEASE-NOTES: synced -- CONTRIBUTE: moved out code style to a separate document +- [Daniel Gustafsson brought this change] -- CODE_STYLE: initial version + URLs: fix one more http url - Ripped out from CONTRIBUTE into its own document, but also extended from - there. - -- curl_sasl.c: minor code indent fixes - -- multi: simplified singlesocket - - Since sh_getentry() now checks for invalid sockets itself and by - narrowing the scope of the remove_sock_from_hash variable. - -- multi: introduce sh_getentry() for looking up sockets in the sockhash + This file wasn't included in commit 4af40b3646d3b09 which updated all + haxx.se http urls to https. The file was committed prior to that update, + but may have been merged after it and hence didn't get updated. - Simplify the code by using a single entry that looks for a socket in the - socket hash. As indicated in #712, the code looked for CURL_SOCKET_BAD - at some point and that is ineffective/wrong and this makes it easier to - avoid that. + Closes #2550 -- [Jaime Fullaondo brought this change] +- github/lock: auto-lock closed issues after 90 days of inactivity - multi hash: ensure modulo performed on curl_socket_t +- vtls: fix missing commas - Closes #712 + follow-up to e66cca046cef -Steve Holme (13 Mar 2016) -- base64: Minor coding standard and style updates - -- base64: Use 'CURLcode result' for curl result codes - -- negotiate: Use 'CURLcode result' for curl result codes - -Daniel Stenberg (13 Mar 2016) -- [Maksim Kuzevanov brought this change] - - multi_runsingle: avoid loop in CURLM_STATE_WAITPROXYCONNECT +- vtls: use unified "supports" bitfield member in backends - Closes #703 - -- TODO: Use the RFC6265 test suite - -Steve Holme (13 Mar 2016) -- checksrc.bat: Added the ability to scan src and lib source independently - -- digest: Use boolean based success code for Curl_sasl_digest_get_pair() + ... instead of previous separate struct fields, to make it easier to + extend and change individual backends without having to modify them all. - Rather than use a 0 and 1 integer base result code use a TRUE / FALSE - based success code. - -- digest: Corrected some typos in comments + closes #2547 -- krb5: Corrected some typos in function descriptions - -- ntlm: Corrected some typos in function descriptions - -- url: Corrected indentation when calling idna_to_ascii_lz() - -- idn_win32: Use boolean based success codes +- transfer: don't unset writesockfd on setup of multiplexed conns - Rather than use 0 and 1 integer base result codes use a FALSE / TRUE - based success code. - -Daniel Stenberg (10 Mar 2016) -- idn_win32.c: warning: Trailing whitespace - -Steve Holme (10 Mar 2016) -- idn_win32.c: Fixed compilation warning from commit 9e7fcd4291 + Curl_setup_transfer() can be called to setup a new individual transfer + over a multiplexed connection so it shouldn't unset writesockfd. - warning C4267: 'function': conversion from 'size_t' to 'int', - possible loss of data - -Daniel Stenberg (10 Mar 2016) -- THANKS-filter: unify Michael König + Bug: #2520 + Closes #2549 -- RELEASE-NOTES: synced with 863c5766dd - -- ftp: remove a check for NULL(!) - - ... as it implies we need to check for that on all the other variable - references as well (as Coverity otherwise warns us for missing NULL - checks), and we're alredy making sure that the pointer is never NULL. +- [Frank Gevaerts brought this change] -- cookies: first n/v pair in Set-Cookie: is the cookie, then parameters + configure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.h - RFC 6265 section 4.1.1 spells out that the first name/value pair in the - header is the actual cookie name and content, while the following are - the parameters. + They are removed from the compiler flags. - libcurl previously had a more liberal approach which causes significant - problems when introducing new cookie parameters, like the suggested new - cookie priority draft. + This ensures that make dependency tracking will force a rebuild whenever + configure --enable-debug or --enable-curldebug changes. - The previous logic read all n/v pairs from left-to-right and the first - name used that wassn't a known parameter name would be used as the - cookie name, thus accepting "Set-Cookie: Max-Age=2; person=daniel" to be - a cookie named 'person' while an RFC 6265 compliant parser should - consider that to be a cookie named 'Max-Age' with an (unknown) parameter - 'person'. - - Fixes #709 - -- krb5: improved type handling to avoid clang compiler warnings + Closes #2548 -- url.c: fix clang warning: no newline at end of file - -- curl_multi_wait: never return -1 in 'numfds' +- http: don't set the "rewind" flag when not uploading anything - Such a return value isn't documented but could still happen, and the - curl tool code checks for it. It would happen when the underlying - Curl_poll() function returns an error. Starting now we mask that error - as a user of curl_multi_wait() would have no way to handle it anyway. + It triggers an assert. - Reported-by: Jay Satiro - Closes #707 - -- HTTP2.md: add CURL_HTTP_VERSION_2TLS and updated alt-svc link + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8144 + Closes #2546 -- curl_multi_wait.3: add example - -Steve Holme (8 Mar 2016) -- imap/pop3/smtp: Fixed connections upgraded with TLS are not reused - - Regression since commit 710f14edba. +- travis: add an mbedtls build - Bug: https://github.com/curl/curl/issues/422 - Reported-by: Justin Ehlert + Closes #2531 -Jay Satiro (8 Mar 2016) -- opt-docs: fix heading macros +- configure: only check for CA bundle for file-using SSL backends - ..SH should be .SH + When only building with SSL backends that don't use the CA bundle file + (by default), skip the check. - Bug: https://github.com/curl/curl/issues/705 - Reported-by: Eric S. Raymond + Fixes #2543 + Fixes #2180 + Closes #2545 -Kamil Dudka (8 Mar 2016) -- [Tim Rühsen brought this change] - - cookie: do not refuse cookies for localhost +- ssh-libssh.c: fix left shift compiler warning - Closes #658 - -Daniel Stenberg (8 Mar 2016) -- ftp_done: clear tunnel_state when secondary socket closes + ssh-libssh.c:2429:21: warning: result of '1 << 31' requires 33 bits to + represent, but 'int' only has 32 bits [-Wshift-overflow=] - Introducing a function for closing the secondary connection to make this - bug less likely to happen again. - - Reported-by: daboul - Closes #701 - -- [Gisle Vanem brought this change] - - openssl: use the correct OpenSSL/BoringSSL/LibreSSL in messages + 'len' will never be that big anyway so I converted the run-time check to + a regular assert. -- HTTP2.md: HTTP/2 by default for curl's HTTPS connections +- [Stephan Mühlstrasser brought this change] -- [Anders Bakken brought this change] - - pipeline: Sanity check pipeline pointer before accessing it. + URL: fix ASCII dependency in strcpy_url and strlen_url - I got a crash with this stack: + Commit 3c630f9b0af097663a64e5c875c580aa9808a92b partially reverted the + changes from commit dd7521bcc1b7a6fcb53c31f9bd1192fcc884bd56 because of + the problem that strcpy_url() was modified unilaterally without also + modifying strlen_url(). As a consequence strcpy_url() was again + depending on ASCII encoding. - curl/lib/url.c:2873 (Curl_removeHandleFromPipeline) - curl/lib/url.c:2919 (Curl_getoff_all_pipelines) - curl/lib/multi.c:561 (curl_multi_remove_handle) - curl/lib/url.c:415 (Curl_close) - curl/lib/easy.c:859 (curl_easy_cleanup) + This change fixes strlen_url() and strcpy_url() in parallel to use a + common host-encoding independent criterion for deciding whether an URL + character must be %-escaped. - Closes #704 + Closes #2535 -- HTTP2.md: mention the disable ALPN and NPN options +- [Denis Ollier brought this change] -- TODO: 17.12 keep running, read instructions from pipe/socket - - And delete trailing whitespace - And rename section 17 to "command line tool" from "client" + docs: remove extraneous commas in man pages - Closes #702 + Closes #2544 -- README.md: linkified +- RELEASE-NOTES: synced + +- Revert "TODO: remove configure --disable-pthreads" - It also makes it less readable as plain text, so let's keep this - primarily for github use. + This reverts commit d5d683a97f9765bddfd964fe32e137aa6e703ed3. - Removed the top ascii art logo, as it looks weird when markdownified. + --disable-pthreads can be used to disable pthreads and get the threaded + resolver to use the windows threading when building with mingw. -- README.md: markdown version of README +- vtls: don't define MD5_DIGEST_LENGTH for wolfssl - Attempt to make it look more appealing on github - -Jay Satiro (6 Mar 2016) -- mprintf: update trio project link - -Daniel Stenberg (6 Mar 2016) -- CURLOPT_ACCEPTTIMEOUT_MS.3: added example - -- CURLOPT_ACCEPT_ENCODING.3: added example + ... as it defines it (too) -- CURLOPT_APPEND.3: added example +- TODO: remove configure --disable-pthreads -- CURLOPT_NOPROGRESS.3: added example, conform to stardard style +Jay Satiro (2 May 2018) +- [David Garske brought this change] -Steve Holme (6 Mar 2016) -- build-openssl/checksrc.bat: Fixed prepend vs append of Perl path + wolfssl: Fix non-blocking connect - Fixed inconsistency from commit 1eae114065 and 0ad6c72227 of the order - in which Perl was added to the PATH. + Closes https://github.com/curl/curl/pull/2542 -Daniel Stenberg (6 Mar 2016) -- opts: added two examples - -- CURLOPT_SSL_CTX_FUNCTION.3: use .NF for example - -- CURLOPT_SSL_CTX_FUNCTION.3: added example +Daniel Stenberg (30 Apr 2018) +- CURLOPT_URL.3: add ENCODING section [ci skip] - and removed erroneous reference to test case lib509 + Feedback-by: Michael Kilburn -- curlx.c: use more curl style code - -- test46: change cookie expiry date - - Since two of the cookies would now otherwise expire and cause the test - to fail after commit 20de9b4f09 +- KNOWN_BUGS: Client cert with Issuer DN differs between backends - Discussed in #697 + Closes #1411 -Jay Satiro (5 Mar 2016) -- [Viktor Szakats brought this change] - - makefile.m32: add missing libs for static -winssl-ssh2 builds +- KNOWN_BUGS: Passive transfer tries only one IP address - Bug: https://github.com/curl/curl/pull/693 + Closes #1508 -- mbedtls: fix user-specified SSL protocol version +- KNOWN_BUGS: --upload-file . hang if delay in STDIN - Prior to this change when a single protocol CURL_SSLVERSION_ was - specified by the user that version was set only as the minimum version - but not as the maximum version as well. - -Steve Holme (5 Mar 2016) -- .gitignore: Added *.VC.opendb and *.vcxproj.user files for VC14 - -- build-openssl.bat: Fixed cannot find perl if installed but not in path - -- checksrc.bat: Fixed cannot find perl if installed but not in path + Closes #2051 -Jay Satiro (5 Mar 2016) -- [Viktor Szakats brought this change] - - makefile.m32: fix to allow -ssh2-winssl combination +- KNOWN_BUGS: Connection information when using TCP Fast Open - In makefile.m32, option -ssh2 (libssh2) automatically implied -ssl - (OpenSSL) option, with no way to override it with -winssl. Since both - libssh2 and curl support using Windows's built-in SSL backend, modify - the logic to allow that combination. + Closes #1332 -- cookie: Don't expire session cookies in remove_expired +- travis: enable libssh2 on both macos and Linux - Prior to this change cookies with an expiry date that failed parsing - and were converted to session cookies could be purged in remove_expired. + It seems to not be detected by default anymore (which is a bug I + believe) - Bug: https://github.com/curl/curl/issues/697 - Reported-by: Seth Mos + Closes #2541 -Daniel Stenberg (3 Mar 2016) -- cookie: remove redundant check - - ... as it was already checked previously within the function. +- TODO: Support the clienthello extension - Reported-by: Dmitry-Me - Closes #695 + Closes #2299 -Jay Satiro (1 Mar 2016) -- [Anders Bakken brought this change] +- TODO: CLOEXEC + + Closes #2252 - url: if Curl_done is premature then pipeline not in use +- tests: provide 'manual' as a feature to optionally require - Prevent a crash if 2 (or more) requests are made to the same host and - pipelining is enabled and the connection does not complete. + ... and make test 1026 rely on that feature so that --disable-manual + builds don't cause test failures. - Bug: https://github.com/curl/curl/pull/690 + Reported-by: Max Dymond and Anders Roxell + Fixes #2533 + Closes #2540 -- [Viktor Szakats brought this change] +- CURLINFO_PROTOCOL.3: mention the existing defined names - makefile.m32: allow to pass .dll/.exe-specific LDFLAGS - - using envvars `CURL_LDFLAG_EXTRAS_DLL` and - `CURL_LDFLAG_EXTRAS_EXE` respectively. This - is useful f.e. to pass ASLR-related extra - options, that are required to make this - feature work when using the mingw toolchain. +Jay Satiro (27 Apr 2018) +- [Daniel Gustafsson brought this change] + + cookies: remove unused macro - Ref: https://github.com/curl/curl/pull/670#issuecomment-190863985 + Commit 2bc230de63 made the macro MAX_COOKIE_LINE_TXT become unused, + so remove as it's not part of the published API. - Closes https://github.com/curl/curl/pull/689 + Closes https://github.com/curl/curl/pull/2537 -Daniel Stenberg (29 Feb 2016) -- formpost: fix memory leaks in AddFormData error branches - - Reported-by: Dmitry-Me - Fixes #688 +Daniel Stenberg (27 Apr 2018) +- [Daniel Gustafsson brought this change] -Jay Satiro (28 Feb 2016) -- getinfo: Fix syntax error when mbedTLS + checksrc: force indentation of lines after an else - The assignment of the mbedTLS TLS session info in the parent commit was - incorrect. Change the assignment to a pointer to the session structure. - -- getinfo: Add support for mbedTLS TLS session info + This extends the INDENTATION case to also handle 'else' statements + and require proper indentation on the following line. Also fixes the + offending cases found in the codebase. - .. and preprocessor check TLS session info is defined for all backends. - -Daniel Stenberg (26 Feb 2016) -- ROADMAP: clarify on the TLS proxy, mention HTTP cookies to work on + Closes #2532 -- file: try reading from files with no size +- http2: fix null pointer dereference in http2_connisdead - Some systems have special files that report as 0 bytes big, but still - contain data that can be read (for example /proc/cpuinfo on - Linux). Starting now, a zero byte size is considered "unknown" size and - will be read as far as possible anyway. + This function can get called on a connection that isn't setup enough to + have the 'recv_underlying' function pointer initialized so it would try + to call the NULL pointer. - Reported-by: Jesse Tan + Reported-by: Dario Weisser - Closes #681 + Follow-up to db1b2c7fe9b093f8 (never shipped in a release) + Closes #2536 -Jay Satiro (25 Feb 2016) -- configure: warn on invalid ca bundle or path +- http2: get rid of another strstr() - - Warn if --with-ca-bundle file does not exist. + Follow-up to 1514c44655e12e: replace another strstr() call done on a + buffer that might not be zero terminated - with a memchr() call, even if + we know the substring will be found. - - Warn if --with-ca-path directory does not contain certificates. + Assisted-by: Max Dymond - - Improve help messages for both. + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8021 - Example configure output: - - ca cert bundle: /some/file (warning: certs not found) - ca cert path: /some/dir (warning: certs not found) - - Bug: https://github.com/curl/curl/issues/404 - Reported-by: Jeffrey Walton + Closes #2534 -Daniel Stenberg (24 Feb 2016) -- Curl_read: check for activated HTTP/1 pipelining, not only requested +- cyassl: adapt to libraries without TLS 1.0 support built-in - ... as when pipelining is used, we read things into a unified buffer and - we don't do that with HTTP/2. This could then easily make programs that - set CURLMOPT_PIPELINING = CURLPIPE_HTTP1|CURLPIPE_MULTIPLEX to get data - intermixed or plain broken between HTTP/2 streams. - - Reported-by: Anders Bakken + WolfSSL doesn't enable it by default anymore -Patrick Monnerat (24 Feb 2016) -- os400: Fix ILE/RPG definition of CURLOPT_TFTP_NO_OPTIONS +- configure: provide --with-wolfssl as an alias for --with-cyassl -Jay Satiro (23 Feb 2016) -- getinfo: CURLINFO_TLS_SSL_PTR supersedes CURLINFO_TLS_SESSION - - The two options are almost the same, except in the case of OpenSSL: - - CURLINFO_TLS_SESSION OpenSSL session internals is SSL_CTX *. - - CURLINFO_TLS_SSL_PTR OpenSSL session internals is SSL *. +- RELEASE-NOTES: synced + +- [Daniel Gustafsson brought this change] + + os400.c: fix ASSIGNWITHINCONDITION checksrc warnings - For backwards compatibility we couldn't modify CURLINFO_TLS_SESSION to - return an SSL pointer for OpenSSL. + All occurrences of assignment within conditional expression in + os400sys.c rewritten into two steps: first assignment and then the check + on the success of the assignment. Also adjust related incorrect brace + positions to match project indentation style. - Also, add support for the 'internals' member to point to SSL object for - the other backends axTLS, PolarSSL, Secure Channel, Secure Transport and - wolfSSL. + This was spurred by seeing "if((inp = input_token))", but while in there + all warnings were fixed. - Bug: https://github.com/curl/curl/issues/234 - Reported-by: dkjjr89@users.noreply.github.com + There should be no functional change from these changes. - Bug: https://curl.haxx.se/mail/lib-2015-09/0127.html - Reported-by: Michael König + Closes #2525 -Daniel Stenberg (23 Feb 2016) -- multi_remove_handle: keep the timeout list until after disconnect - - The internal Curl_done() function uses Curl_expire() at times and that - uses the timeout list. Better clean up the list once we're done using - it. This caused a segfault. - - Reported-by: 蔡文凱 - Bug: https://curl.haxx.se/mail/lib-2016-02/0097.html +- [Daniel Gustafsson brought this change] -Kamil Dudka (23 Feb 2016) -- tests/sshserver.pl: use RSA instead of DSA for host auth + cookies: ensure that we have cookies before writing jar - DSA is no longer supported by OpenSSH 7.0, which causes all SCP/SFTP - test cases to be skipped. Using RSA for host authentication works with - both old and new versions of OpenSSH. + The jar should be written iff there are cookies, so ensure that we still + have cookies after expiration to avoid creating an empty file. - Reported-by: Karlson2k - - Closes #676 + Closes #2529 -Jay Satiro (23 Feb 2016) -- TFTP: add option to suppress TFTP option requests (Part 2) - - - Add tests. +- strcpy_url: only %-encode values >= 0x80 - - Add an example to CURLOPT_TFTP_NO_OPTIONS.3. + OSS-Fuzz detected - - Add --tftp-no-options to expose CURLOPT_TFTP_NO_OPTIONS. + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8000 - Bug: https://github.com/curl/curl/issues/481 + Broke in dd7521bcc1b7 -- [Michael Koenig brought this change] - - TFTP: add option to suppress TFTP option requests (Part 1) - - Some TFTP server implementations ignore the "TFTP Option extension" - (RFC 1782-1784, 2347-2349), or implement it in a flawed way, causing - problems with libcurl. Another switch for curl_easy_setopt - "CURLOPT_TFTP_NO_OPTIONS" is introduced which prevents libcurl from - sending TFTP option requests to a server, avoiding many problems caused - by faulty implementations. +- mime: avoid NULL pointer dereference risk - Bug: https://github.com/curl/curl/issues/481 - -Daniel Stenberg (22 Feb 2016) -- [Karlson2k brought this change] - - runtests: Fixed usage of %PWD on MinGW64 + Coverity detected, CID 1435120 - Closes #672 + Closes #2527 -Jay Satiro (20 Feb 2016) -- CURLOPT_DEBUGFUNCTION.3: Fix example +- [Stephan Mühlstrasser brought this change] -- [Viktor Szakats brought this change] - - src/Makefile.m32: add CURL_{LD,C}FLAGS_EXTRAS support + ctype: restore character classification for non-ASCII platforms - Sync with lib/Makefile.m32 which already uses those variables. + With commit 4272a0b0fc49a1ac0ceab5c4a365c9f6ab8bf8e2 curl-speficic + character classification macros and functions were introduced in + curl_ctype.[ch] to avoid dependencies on the locale. This broke curl on + non-ASCII, e.g. EBCDIC platforms. This change restores the previous set + of character classification macros when CURL_DOES_CONVERSIONS is + defined. - Bug: https://github.com/curl/curl/pull/670 - -Dan Fandrich (20 Feb 2016) -- Enabled test 1437 after the bug fix in commit 3fa220a6 + Closes #2494 -Jay Satiro (19 Feb 2016) -- [Emil Lerner brought this change] - - curl_sasl: Fix memory leak in digest parser +- ftplistparser: keep state between invokes - If any parameter in a HTTP DIGEST challenge message is present multiple - times, memory allocated for all but the last entry should be freed. + Fixes FTP wildcard parsing when done over a number of read buffers. - Bug: https://github.com/curl/curl/pull/667 - -Dan Fandrich (19 Feb 2016) -- Added test 1437 to verify a memory leak + Regression from f786d1f14 - Reported-by: neex@users.noreply.github.com + Reported-by: wncboy on github + Fixes #2445 + Closes #2526 -Jay Satiro (18 Feb 2016) -- CURLOPT_COOKIEFILE.3: HTTP headers must be Set-Cookie style +- examples/http2-upload: expand buffer to avoid silly warning - Bug: https://github.com/curl/curl/issues/666 - Reported-by: baumanj@users.noreply.github.com + http2-upload.c:135:44: error: ‘%02d’ directive output may be truncated + writing between 2 and 11 bytes into a region of size between 8 and 17 -- curl.1: HTTP headers for --cookie must be Set-Cookie style +- examples/sftpuploadresume: typecast fseek argument to long - Bug: https://github.com/curl/curl/issues/666 - Reported-by: baumanj@users.noreply.github.com + /docs/examples/sftpuploadresume.c:102:12: warning: conversion to 'long + int' from 'curl_off_t {aka long long int}' may alter its value -Daniel Stenberg (18 Feb 2016) -- curl.1: add a missing dash - -- CONTRIBUTING.md: fix links - -- ISSUE_TEMPLATE: github issue template +- Revert "ftplistparser: keep state between invokes" - First version, try this out! - -- CONTRIBUTING.md: move into .github + This reverts commit abbc8457d85aca74b7cfda1d394b0844932b2934. - To hide github specific files somewhat from the rest. - -- opts: add references + Caused fuzzer problems on travis not seen when this was a PR! -- examples/make: add 'checksrc' target - -- 10-at-a-time: typecast the argument passed to sleep() - -- externalsocket.c: fix compiler warning for fwrite return type - -- anyauthput.c: fix compiler warnings - -- simplessl.c: warning: while with space - -- curlx.c: i2s_ASN1_IA5STRING() clashes with an openssl function +- Curl_memchr: zero length input can't match + + Avoids undefined behavior. - Reported-By: Gisle Vanem + Reported-by: Geeknik Labs -- http2: don't decompress gzip decoding automatically +- ftplistparser: keep state between invokes - At one point during the development of HTTP/2, the commit 133cdd29ea0 - introduced automatic decompression of Content-Encoding as that was what - the spec said then. Now however, HTTP/2 should work the same way as - HTTP/1 in this regard. + Fixes FTP wildcard parsing when doing over a number of read buffers. - Reported-by: Kazuho Oku + Regression from f786d1f14 - Closes #661 + Reported-by: wncboy on github + Fixes #2445 + Closes #2519 -Jay Satiro (16 Feb 2016) -- [Tatsuhiro Tsujikawa brought this change] - - http: Don't break the header into chunks if HTTP/2 - - nghttp2 callback deals with TLS layer and therefore the header does not - need to be broken into chunks. +- ftplistparser: renamed some members and variables - Bug: https://github.com/curl/curl/issues/659 - Reported-by: Kazuho Oku + ... to make them better spell out what they're for. -Daniel Stenberg (16 Feb 2016) -- [Viktor Szakats brought this change] +- RELEASE-NOTES: synced - openssl: use macro to guard the opaque EVP_PKEY branch +- [Christian Schmitz brought this change] -- [Viktor Szakats brought this change] + curl_global_sslset: always provide available backends + + Closes #2499 - openssl: avoid direct PKEY access with OpenSSL 1.1.0 +- http2: convert an assert to run-time check + + Fuzzing has proven we can reach code in on_frame_recv with status_code + not having been set, so let's detect that in run-time (instead of with + assert) and error error accordingly. - by using API instead of accessing an internal structure. - This is required starting OpenSSL 1.1.0-pre3. + (This should no longer happen with the latest nghttp2) - Closes #650 + Detected by OSS-Fuzz + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7903 + Closes #2514 -- RELEASE-NOTES: synced with ede0bfc079da +- curl.1: clarify that options and URLs can be mixed + + Fixes #2515 + Closes #2517 -- [Clint Clayton brought this change] +Jay Satiro (23 Apr 2018) +- [Archangel_SDY brought this change] - CURLOPT_CONNECTTIMEOUT_MS.3: Fix example to use milliseconds option + CURLOPT_SSLCERT.3: improve WinSSL-specific usage info - Change the example in the docs for CURLOPT_CONNECTTIMEOUT_MS to use - CURLOPT_CONNECTTIMEOUT_MS instead of CURLOPT_CONNECTTIMEOUT. + Ref: https://github.com/curl/curl/pull/2376#issuecomment-381858780 - Closes #653 - -- opt-docs: add more references + Closes https://github.com/curl/curl/pull/2504 -- [David Byron brought this change] +- [Archangel_SDY brought this change] - SCP: use libssh2_scp_recv2 to support > 2GB files on windows + schannel: fix build error on targets <= XP - libssh2_scp_recv2 is introduced in libssh2 1.7.0 - to be released "any - day now. + - Use CRYPT_STRING_HEX instead of CRYPT_STRING_HEXRAW since XP doesn't + support the latter. - Closes #451 - -Jay Satiro (13 Feb 2016) -- [Shine Fan brought this change] - - gtls: fix for builds lacking encrypted key file support + Ref: https://github.com/curl/curl/pull/2376#issuecomment-382153668 - Bug: https://github.com/curl/curl/pull/651 + Closes https://github.com/curl/curl/pull/2504 -Dan Fandrich (13 Feb 2016) -- test1604: Add to Makefile.inc so it gets run - -Jay Satiro (12 Feb 2016) -- generate.bat: Fix comment bug by removing old comments +Daniel Stenberg (23 Apr 2018) +- Revert "ftplistparser: keep state between invokes" - Remove NOTES section, it's no longer needed since we aren't setting the - errorlevel and more importantly the recently updated URL in the comments - is causing some unusual behavior that breaks the script. + This reverts commit 8fb78f9ddc6d858d630600059b8ad84a80892fd9. - Closes https://github.com/curl/curl/issues/649 + Unfortunately this fix introduces memory leaks I've not been able to fix + in several days. Reverting this for now to get the leaks fixed. -Kamil Dudka (12 Feb 2016) -- curl.1: --disable-{eprt,epsv} are ignored for IPv6 hosts +Jay Satiro (21 Apr 2018) +- tool_help: clarify --max-time unit of time is seconds - The behavior has been clarified in CURLOPT_FTP_USE_{EPRT,EPSV}.3 man - pages since curl-7_12_3~131. This patch makes it clear in the curl.1 - man page, too. + Before: + -m, --max-time