diff options
Diffstat (limited to 'CHANGES')
| -rw-r--r-- | CHANGES | 2194 |
1 files changed, 1147 insertions, 1047 deletions
@@ -6,6 +6,1153 @@ Changelog +Version 7.61.0 (11 Jul 2018) + +Daniel Stenberg (11 Jul 2018) +- release: 7.61.0 + +- TODO: Configurable loading of OpenSSL configuration file + + Closes #2724 + +- post303.d: clarify that this is an RFC violation + + ... and not the other way around, which this previously said. + + Reported-by: Vasiliy Faronov + Fixes #2723 + Closes #2726 + +- [Ruslan Baratov brought this change] + + CMake: remove redundant and old end-of-block syntax + + Reviewed-by: Jakub Zakrzewski + Closes #2715 + +Jay Satiro (9 Jul 2018) +- lib/curl_setup.h: remove unicode character + + Follow-up to 82ce416. + + Ref: https://github.com/curl/curl/commit/8272ec5#commitcomment-29646818 + +Daniel Stenberg (9 Jul 2018) +- lib/curl_setup.h: remove unicode bom from 8272ec50f02 + +Marcel Raad (9 Jul 2018) +- schannel: fix -Wsign-compare warning + + MinGW warns: + /lib/vtls/schannel.c:219:64: warning: signed and unsigned type in + conditional expression [-Wsign-compare] + + Fix this by casting the ptrdiff_t to size_t as we know it's positive. + + Closes https://github.com/curl/curl/pull/2721 + +- schannel: workaround for wrong function signature in w32api + + Original MinGW's w32api has CryptHashData's second parameter as BYTE * + instead of const BYTE *. + + Closes https://github.com/curl/curl/pull/2721 + +- schannel: make more cipher options conditional + + They are not defined in the original MinGW's <wincrypt.h>. + + Closes https://github.com/curl/curl/pull/2721 + +- curl_setup: include <winerror.h> before <windows.h> + + Otherwise, only part of it gets pulled in through <windows.h> on + original MinGW. + + Fixes https://github.com/curl/curl/issues/2361 + Closes https://github.com/curl/curl/pull/2721 + +- examples: fix -Wformat warnings + + When size_t is not a typedef for unsigned long (as usually the case on + Windows), GCC emits -Wformat warnings when using lu and lx format + specifiers with size_t. Silence them with explicit casts to + unsigned long. + + Closes https://github.com/curl/curl/pull/2721 + +Daniel Stenberg (9 Jul 2018) +- smtp: use the upload buffer size for scratch buffer malloc + + ... not the read buffer size, as that can be set smaller and thus cause + a buffer overflow! CVE-2018-0500 + + Reported-by: Peter Wu + Bug: https://curl.haxx.se/docs/adv_2018-70a2.html + +- [Dave Reisner brought this change] + + scripts: include _curl as part of CLEANFILES + + Closes #2718 + +- [Nick Zitzmann brought this change] + + darwinssl: allow High Sierra users to build the code using GCC + + ...but GCC users lose out on TLS 1.3 support, since we can't weak-link + enumeration constants. + + Fixes #2656 + Closes #2703 + +- [Ruslan Baratov brought this change] + + CMake: Remove unused 'output_var' from 'collect_true' + + Variable 'output_var' is not used and can be removed. + Function 'collect_true' renamed to 'count_true'. + +- [Ruslan Baratov brought this change] + + CMake: Remove unused functions + + Closes #2711 + +- KNOWN_BUGS: Stick to same family over SOCKS proxy + +- libssh: goto DISCONNECT state on error, not SSH_SESSION_FREE + + ... because otherwise not everything get closed down correctly. + + Fixes #2708 + Closes #2712 + +- libssh: include line number in state change debug messages + + Closes #2713 + +- KNOWN_BUGS: Borland support is dropped, AIX problem is too old + +- [Jeroen Ooms brought this change] + + example/crawler.c: simple crawler based on libxml2 + + Closes #2706 + +- RELEASE-NOTES: synced + +- DEPRECATE: include year when specifying date + +- DEPRECATE: linkified + +- DEPRECATE: mention the PR that disabled axTLS + +- docs/DEPRECATE.md: spelling and minor formatting + +- DEPRECATE: new doc describing planned item removals + + Closes #2704 + +- [Gisle Vanem brought this change] + + telnet: fix clang warnings + + telnet.c(1401,28): warning: cast from function call of type 'int' to + non-matching type 'HANDLE' (aka 'void *') [-Wbad-function-cast] + + Fixes #2696 + Closes #2700 + +- docs: fix missed option name markups + +- [Gaurav Malhotra brought this change] + + openssl: Remove some dead code + + Closes #2698 + +- openssl: make the requested TLS version the *minimum* wanted + + The code treated the set version as the *exact* version to require in + the TLS handshake, which is not what other TLS backends do and probably + not what most people expect either. + + Reported-by: Andreas Olsson + Assisted-by: Gaurav Malhotra + Fixes #2691 + Closes #2694 + +- RELEASE-NOTES: synced + +- openssl: allow TLS 1.3 by default + + Reported-by: Andreas Olsson + Fixes #2692 + Closes #2693 + +- [Adrian Peniak brought this change] + + CURLINFO_TLS_SSL_PTR.3: improve the example + + The previous example was a little bit confusing, because SSL* structure + (or other "in use" SSL connection pointer) is not accessible after the + transfer is completed, therefore working with the raw TLS library + specific pointer needs to be done during transfer. + + Closes #2690 + +- travis: add a build using the synchronous name resolver + + ... since default uses the threaded one and we test the c-ares build + already. + + Closes #2689 + +- configure: remove CURL_CHECK_NI_WITHSCOPEID too + + Since it isn't used either and requires the getnameinfo check + + Follow-up to 0aeca41702d2 + +- getnameinfo: not used + + Closes #2687 + +- easy_perform: use *multi_timeout() to get wait times + + ... and trim the threaded Curl_resolver_getsock() to return zero + millisecond wait times during the first three milliseconds so that + localhost or names in the OS resolver cache gets detected and used + faster. + + Closes #2685 + +Max Dymond (27 Jun 2018) +- configure: Add dependent libraries after crypto + + The linker is pretty dumb and processes things left to right, keeping a + tally of symbols it hasn't resolved yet. So, we need -ldl to appear + after -lcrypto otherwise the linker won't find the dl functions. + + Closes #2684 + +Daniel Stenberg (27 Jun 2018) +- GOVERNANCE: linkify, changed some titles + +- GOVERNANCE: add maintainer details/duties + +- url: check Curl_conncache_add_conn return code + + ... it was previously unchecked in two places and thus errors could + remain undetected and cause trouble. + + Closes #2681 + +- include/README: remove "hacking" advice, not the right place + +- RELEASE-NOTES: synced + +- CURLOPT_SSL_VERIFYPEER.3: fix syntax mistake + + Follow-up to b6a16afa0aa5 + +- netrc: use a larger buffer + + ... to work with longer passwords etc. Grow it from a 256 to a 4096 + bytes buffer. + + Reported-by: Dario Nieuwenhuis + Fixes #2676 + Closes #2680 + +- [Patrick Schlangen brought this change] + + CURLOPT_SSL_VERIFYPEER.3: Add performance note + + Closes #2673 + +- [Javier Blazquez brought this change] + + multi: fix crash due to dangling entry in connect-pending list + + Fixes #2677 + Closes #2679 + +- ConnectionExists: make sure conn->data is set when "taking" a connection + + Follow-up to 2c15693. + + Bug #2674 + Closes #2675 + +- [Kevin R. Bulgrien brought this change] + + system.h: fix for gcc on 32 bit OpenServer + + Bug: https://curl.haxx.se/mail/lib-2018-06/0100.html + +- [Raphael Gozzo brought this change] + + cmake: allow multiple SSL backends + + This will make possible to select the SSL backend (using + curl_global_sslset()) even when the libcurl is built using CMake + + Closes #2665 + +- url: fix dangling conn->data pointer + + By masking sure to use the *current* easy handle with extracted + connections from the cache, and make sure to NULLify the ->data pointer + when the connection is put into the cache to make this mistake easier to + detect in the future. + + Reported-by: Will Dietz + Fixes #2669 + Closes #2672 + +- CURLOPT_INTERFACE.3: interface names not supported on Windows + +- travis: run more tests for coverage check + + ... run a few more tortured based and run all tests event-based. + + Closes #2664 + +- multi: fix memory leak when stopped during name resolve + + When the application just started the transfer and then stops it while + the name resolve in the background thread hasn't completed, we need to + wait for the resolve to complete and then cleanup data accordingly. + + Enabled test 1553 again and added test 1590 to also check when the host + name resolves successfully. + + Detected by OSS-fuzz. + Closes #1968 + +Viktor Szakats (15 Jun 2018) +- maketgz: delete .bak files, fix indentation + + Ref: https://github.com/curl/curl/pull/2660 + + Closes https://github.com/curl/curl/pull/2662 + +Daniel Stenberg (15 Jun 2018) +- runtests.pl: remove debug leftover from bb9a340c73f3 + +- curl-confopts.m4: fix typo from ed224f23d5beb + + Fixes my local configure to detect a custom installed c-ares without + pkgconfig. + +- docs/RELEASE-PROCEDURE.md: renamed to use .md extension + + Closes #2663 + +- RELEASE-PROCEDURE: gpg sign the tags + +- RELEASE-NOTES: synced + +- CURLOPT_HTTPAUTH.3: CURLAUTH_BEARER was added in 7.61.0 + +- [Mamta Upadhyay brought this change] + + maketgz: fix sed issues on OSX + + maketgz creates release tarballs and removes the -DEV string in curl + version (e.g. 7.58.0-DEV), else -DEV shows up on command line when curl + is run. maketgz works fine on linux but fails on OSX. Problem is with + the sed commands that use option -i without an extension. Maketgz + expects GNU sed instead of BSD and this simply won't work on OSX. Adding + a backup extension .bak after -i fixes this issue + + Running the script as if on OSX gives this error: + + sed: -e: No such file or directory + + Adding a .bak extension resolves it + + Closes #2660 + +- configure: enhance ability to detect/build with static openssl + + Fix the -ldl and -ldl + -lpthread checks for OpenSSL, necessary for + building with static libs without pkg-config. + + Reported-by: Marcel Raad + Fixes #2199 + Closes #2659 + +- configure: use pkg-config for c-ares detection + + First check if there's c-ares information given as pkg-config info and use + that as first preference. + + Reported-by: pszemus on github + Fixes #2203 + Closes #2658 + +- GOVERNANCE.md: explains how this project is run + + Closes #2657 + +- KNOWN_BUGS: NTLM doen't support password with § character + + Closes #2120 + +- KNOWN_BUGS: slow connect to localhost on Windows + + Closes #2281 + +- [Matteo Bignotti brought this change] + + mk-ca-bundle.pl: make -u delete certdata.txt if found not changed + + certdata.txt should be deleted also when the process is interrupted by + "same certificate downloaded, exiting" + + The certdata.txt is currently kept on disk even if you give the -u + option + + Closes #2655 + +- progress: remove a set of unused defines + + Reported-by: Peter Wu + Closes #2654 + +- TODO: "Option to refuse usernames in URLs" done + + Implemented by Björn in 946ce5b61f + +- [Lyman Epp brought this change] + + Curl_init_do: handle NULL connection pointer passed in + + Closes #2653 + +- runtests: support variables in <strippart> + + ... and make use of that to make 1455 work better without using a fixed + local port number. + + Fixes #2649 + Closes #2650 + +- Curl_debug: remove dead printhost code + + The struct field is never set (since 5e0d9aea3) so remove the use of it + and remove the connectdata pointer from the prototype. + + Reported-by: Tejas + Bug: https://curl.haxx.se/mail/lib-2018-06/0054.html + Closes #2647 + +Viktor Szakats (12 Jun 2018) +- schannel: avoid incompatible pointer warning + + with clang-6.0: + ``` + vtls/schannel_verify.c: In function 'add_certs_to_store': + vtls/schannel_verify.c:212:30: warning: passing argument 11 of 'CryptQueryObject' from incompatible pointer type [-Wincompatible-pointer-types] + &cert_context)) { + ^ + In file included from /usr/share/mingw-w64/include/schannel.h:10:0, + from /usr/share/mingw-w64/include/schnlsp.h:9, + from vtls/schannel.h:29, + from vtls/schannel_verify.c:40: + /usr/share/mingw-w64/include/wincrypt.h:4437:26: note: expected 'const void **' but argument is of type 'CERT_CONTEXT ** {aka struct _CERT_CONTEXT **}' + WINIMPM WINBOOL WINAPI CryptQueryObject (DWORD dwObjectType, const void *pvObject, DWORD dwExpectedContentTypeFlags, DWORD dwExpectedFormatTypeFlags, DWORD dwFlags, + ^~~~~~~~~~~~~~~~ + ``` + Ref: https://msdn.microsoft.com/library/windows/desktop/aa380264 + + Closes https://github.com/curl/curl/pull/2648 + +Daniel Stenberg (12 Jun 2018) +- [Robert Prag brought this change] + + schannel: support selecting ciphers + + Given the contstraints of SChannel, I'm exposing these as the algorithms + themselves instead; while replicating the ciphersuite as specified by + OpenSSL would have been preferable, I found no way in the SChannel API + to do so. + + To use this from the commandline, you need to pass the names of contants + defining the desired algorithms. For example, curl --ciphers + "CALG_SHA1:CALG_RSA_SIGN:CALG_RSA_KEYX:CALG_AES_128:CALG_DH_EPHEM" + https://github.com The specific names come from wincrypt.h + + Closes #2630 + +- [Bernhard M. Wiedemann brought this change] + + test 46: make test pass after 2025 + + shifting the expiry date to 2037 for now + to be before the possibly problematic year 2038 + + similar in spirit to commit e6293cf8764e9eecb + + Closes #2646 + +- [Marian Klymov brought this change] + + cppcheck: fix warnings + + - Get rid of variable that was generating false positive warning + (unitialized) + + - Fix issues in tests + + - Reduce scope of several variables all over + + etc + + Closes #2631 + +- openssl: assume engine support in 1.0.1 or later + + Previously it was checked for in configure/cmake, but that would then + leave other build systems built without engine support. + + While engine support probably existed prior to 1.0.1, I decided to play + safe. If someone experience a problem with this, we can widen the + version check. + + Fixes #2641 + Closes #2644 + +- RELEASE-NOTES: synced + +- RELEASE-PROCEDURE: update the release calendar for 2019 + +- [Gisle Vanem brought this change] + + boringssl + schannel: undef X509_NAME in lib/schannel.h + + Fixes the build problem when both boringssl and schannel are enabled. + + Fixes #2634 + Closes #2643 + +- [Vladimir Kotal brought this change] + + mk-ca-bundle.pl: leave certificate name untouched in decode() + + Closes #2640 + +- [Rikard Falkeborn brought this change] + + tests/libtests/Makefile.am: Add lib1521.c to CLEANFILES + + This removes the generated lib1521.c when running make clean. + + Closes #2633 + +- [Rikard Falkeborn brought this change] + + tests/libtest: Add lib1521 to nodist_SOURCES + + Since 467da3af0, lib1521.c is generated instead of checked in. According + to the commit message, the intention was to remove it from the tarball + as well. However, it is still present when running make dist. To remove + it, add it to nodist_lib1521_SOURCES. This also means there is no need + for the manually added dist-rule in the Makefile. + + Also update CMakelists.txt to handle the fact that we now may have + nodist_SOURCES. + +- [Stephan Mühlstrasser brought this change] + + system.h: add support for IBM xlc C compiler + + Added a section to system.h guarded with __xlc__ for the IBM xml C + compiler. Before this change the section titled 'generic "safe guess" on + old 32 bit style' was used, which resulted in a wrong definition of + CURL_TYPEOF_CURL_SOCKLEN_T, and for 64-bit also CURL_TYPEOF_CURL_OFF_T + was wrong. + + Compilation warnings fixed with this change: + + CC libcurl_la-ftp.lo + "ftp.c", line 290.55: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + "ftp.c", line 293.48: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + "ftp.c", line 1070.49: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + "ftp.c", line 1154.53: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + "ftp.c", line 1187.51: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + CC libcurl_la-connect.lo + "connect.c", line 448.56: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + "connect.c", line 516.66: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + "connect.c", line 687.55: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + "connect.c", line 696.55: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + CC libcurl_la-tftp.lo + "tftp.c", line 1115.33: 1506-280 (W) Function argument assignment between types "unsigned long* restrict" and "int*" is not allowed. + + Closes #2637 + +- cmdline-opts/cert-type.d: mention "p12" as a recognized type as well + +Viktor Szakats (3 Jun 2018) +- spelling fixes + + Detected using the `codespell` tool (version 1.13.0). + + Also secure and fix an URL. + +Daniel Stenberg (2 Jun 2018) +- axtls: follow-up spell fix of comment + +- axTLS: not considered fit for use + + URL: https://curl.haxx.se/mail/lib-2018-06/0000.html + + This is step one. It adds #error statements that require source edits to + make curl build again if asked to use axTLS. At a later stage we might + remove the axTLS specific code completely. + + Closes #2628 + +- build: remove the Borland specific makefiles + + According to the user survey 2018, not even one out of 670 users use + them. Nobody on the mailing list spoke up for them either. + + Closes #2629 + +- curl_addrinfo: use same #ifdef conditions in source as header + + ... for curl_dofreeaddrinfo + +- multi: remove a DEBUGF() + + ... it might call infof() with a NULL first argument that isn't harmful + but makes it not do anything. The infof() line is not very useful + anymore, it has served it purpose. Good riddance! + + Fixes #2627 + +- [Alibek.Jorajev brought this change] + + CURLOPT_RESOLVE: always purge old entry first + + If there's an existing entry using the selected name. + + Closes #2622 + +- fnmatch: use the system one if available + + If configure detects fnmatch to be available, use that instead of our + custom one for FTP wildcard pattern matching. For standard compliance, + to reduce our footprint and to use already well tested and well + exercised code. + + A POSIX fnmatch behaves slightly different than the internal function + for a few test patterns currently and the macOS one yet slightly + different. Test case 1307 is adjusted for these differences. + + Closes #2626 + +Patrick Monnerat (31 May 2018) +- os400: add new option in ILE/RPG binding + + Follow-up to commit 946ce5b + +Daniel Stenberg (31 May 2018) +- tests/libtest/.gitignore: follow-up fix to ignore lib5* too + +- KNOWN_BUGS: CURL_GLOBAL_SSL + + Closes #2276 + +- [Bernhard Walle brought this change] + + configure: check for declaration of getpwuid_r + + On our x86 Android toolchain, getpwuid_r is implemented but the header + is missing: + + netrc.c:81:7: error: implicit declaration of function 'getpwuid_r' [-Werror=implicit-function-declaration] + + Unfortunately, the function is used in curl_ntlm_wb.c, too, so I moved + the prototype to curl_setup.h. + + Signed-off-by: Bernhard Walle <bernhard@bwalle.de> + Closes #2609 + +- [Rikard Falkeborn brought this change] + + tests: update .gitignore for libtests + + Closes #2624 + +- [Rikard Falkeborn brought this change] + + strictness: correct {infof, failf} format specifiers + + Closes #2623 + +- [Björn Stenberg brought this change] + + option: disallow username in URL + + Adds CURLOPT_DISALLOW_USERNAME_IN_URL and --disallow-username-in-url. Makes + libcurl reject URLs with a username in them. + + Closes #2340 + +- libcurl-security.3: improved layout for two rememdy lists + +- libcurl-security.3: refer to URL instead of in-source markdown file + +Viktor Szakats (30 May 2018) +- curl.rc: embed manifest for correct Windows version detection + + * enable it in `src/Makefile.m32` + * enable it in `winbuild/MakefileBuild.vc` if a custom manifest is + _not_ enabled via the existing `EMBED_MANIFEST` option + * enable it for all Windows CMake builds (also disable the built-in + minimal manifest, added by CMake by default.) + + For other build systems, add the `-DCURL_EMBED_MANIFEST` option to + the list of RC (Resource Compiler) flags to enable the manifest + included in `src/curl.rc`. This may require to disable whatever + automatic or other means in which way another manifest is added to + `curl.exe`. + + Notice that Borland C doesn't support this method due to a + long-pending resource compiler bug. Watcom C may also not handle + it correctly when the `-zm` `wrc` option is used (this option may + be unnecessary though) and regardless of options in certain earlier + revisions of the 2.0 beta version. + + Closes https://github.com/curl/curl/pull/1221 + Fixes https://github.com/curl/curl/issues/2591 + +Patrick Monnerat (30 May 2018) +- os400: sync EBCDIC wrappers and ILE/RPG binding with latest options + +- os400: implement mime api EBCDIC wrappers + + Also sync ILE/RPG binding to define the new functions. + +Daniel Stenberg (29 May 2018) +- setopt: add TLS 1.3 ciphersuites + + Adds CURLOPT_TLS13_CIPHERS and CURLOPT_PROXY_TLS13_CIPHERS. + + curl: added --tls13-ciphers and --proxy-tls13-ciphers + + Fixes #2435 + Reported-by: zzq1015 on github + Closes #2607 + +- configure: override AR_FLAGS to silence warning + + The automake default ar flags are 'cru', but the 'u' flag in there + causes warnings on many modern Linux distros. Removing 'u' may have a + minor performance impact on older distros but should not cause harm. + + Explained on the automake mailing list already back in April 2015: + + https://www.mail-archive.com/automake-patches@gnu.org/msg07705.html + + Reported-by: elephoenix on github + Fixes #2617 + Closes #2619 + +Sergei Nikulov (29 May 2018) +- cmake: fixed comments in compile checks code + +Daniel Stenberg (29 May 2018) +- INSTALL: LDFLAGS=-Wl,-R/usr/local/ssl/lib + + ... the older description doesn't work + + Reported-by: Peter Varga + Fixes #2615 + Closes #2616 + +- [Will Dietz brought this change] + + KNOWN_BUGS: restore text regarding #2101. + + This was added earlier but appears to have been removed accidentally. + + AFAICT this is very much still an issue. + + ----- + + I say "accidentally" because the text seems to have harmlessly snuck + into [1] (which makes no mention of it). [1] was later reverted for + unspecified reasons in [2], presumably because the mentioned issue was + fixed or invalid. + + [1] de9fac00c40db321d44fa6fbab6eb62ec4c83998 + [2] 16d1f369403cbb04bd7b085eabbeebf159473fc2 + + Closes #2618 + +- fnmatch: insist on escaped bracket to match + + A non-escaped bracket ([) is for a character group - as documented. It + will *not* match an individual bracket anymore. Test case 1307 updated + accordingly to match. + + Problem detected by OSS-Fuzz, although this fix is probably not a final + fix for the notorious timeout issues. + + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8525 + Closes #2614 + +Patrick Monnerat (28 May 2018) +- psl: use latest psl and refresh it periodically + + The latest psl is cached in the multi or share handle. It is refreshed + before use after 72 hours. + New share lock CURL_LOCK_DATA_PSL controls the psl cache sharing. + If the latest psl is not available, the builtin psl is used. + + Reported-by: Yaakov Selkowitz + Fixes #2553 + Closes #2601 + +Daniel Stenberg (28 May 2018) +- [Fabrice Fontaine brought this change] + + configure: fix ssh2 linking when built with a static mbedtls + + The ssh2 pkg-config file could contain the following lines when build + with a static version of mbedtls: + Libs: -L${libdir} -lssh2 /xxx/libmbedcrypto.a + Libs.private: /xxx/libmbedcrypto.a + + This static mbedtls library must be used to correctly detect ssh2 + support and this library must be copied in libcurl.pc otherwise + compilation of any application (such as upmpdcli) with libcurl will fail + when trying to found mbedtls functions included in libssh2. So, replace + pkg-config --libs-only-l by pkg-config --libs. + + Fixes: + - http://autobuild.buildroot.net/results/43e24b22a77f616d6198c10435dcc23cc3b9088a + + Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> + Closes #2613 + +- RELEASE-NOTES: synced + +- [Bernhard Walle brought this change] + + cmake: check for getpwuid_r + + The autotools-based build system does it, so we do it also in CMake. + + Bug: #2609 + Signed-off-by: Bernhard Walle <bernhard@bwalle.de> + +- cmdline-opts/gen.pl: warn if mutexes: or see-also: list non-existing options + +- [Frank Gevaerts brought this change] + + curl.1: Fix cmdline-opts reference errors. + + --data, --form, and --ntlm were declared to be mutually exclusive with + non-existing options. --data and --form referred to --upload (which is + short for --upload-file and therefore did work, so this one was merely + a bit confusing), --ntlm referred to --negotiated instead of --negotiate. + + Closes #2612 + +- [Frank Gevaerts brought this change] + + docs: fix cmdline-opts metadata headers case consistency. + + Almost all headers start with an uppercase letter, but some didn't. + +- mailmap: Max Savenkov + +Sergei Nikulov (28 May 2018) +- [Max Savenkov brought this change] + + Fix the test for fsetxattr and strerror_r tests in CMake to work without compiling + +Daniel Stenberg (27 May 2018) +- mailmap: a Richard Alcock fixup + +- [Richard Alcock brought this change] + + schannel: add failf calls for client certificate failures + + Closes #2604 + +- [Richard Alcock brought this change] + + winbuild: In MakefileBuild.vc fix typo DISTDIR->DIRDIST + + Change requirement from $(DISTDIR) to $(DIRDIST) + + closes #2603 + +- [Richard Alcock brought this change] + + winbuild: only delete OUTFILE if it exists + + This removes the slightly annoying "Could not file LIBCURL_OBJS.inc" and + "Could not find CURL_OBJS.inc.inc" message when building into a clean + folder. + + closes #2602 + +- [Alejandro R. Sedeño brought this change] + + content_encoding: handle zlib versions too old for Z_BLOCK + + Fallback on Z_SYNC_FLUSH when Z_BLOCK is not available. + + Fixes #2606 + Closes #2608 + +- multi: provide a socket to wait for in Curl_protocol_getsock + + ... even when there's no protocol specific handler setup. + + Bug: https://curl.haxx.se/mail/lib-2018-05/0062.html + Reported-by: Sean Miller + Closes #2600 + +- [Linus Lewandowski brought this change] + + httpauth: add support for Bearer tokens + + Closes #2102 + +- TODO: CURLINFO_PAUSE_STATE + + Closes #2588 + +Sergei Nikulov (24 May 2018) +- cmake: set -d postfix for debug builds if not specified + using -DCMAKE_DEBUG_POSTFIX explicitly + + fixes #2121, obsoletes #2384 + +Daniel Stenberg (23 May 2018) +- configure: add basic test of --with-ssl prefix + + When given a prefix, the $PREFIX_OPENSSL/lib/openssl.pc or + $PREFIX_OPENSSL/include/openssl/ssl.h files must be present or cause an + error. Helps users detect when giving configure the wrong path. + + Reported-by: Oleg Pudeyev + Assisted-by: Per Malmberg + Fixes #2580 + +Patrick Monnerat (22 May 2018) +- http resume: skip body if http code 416 (range error) is ignored. + + This avoids appending error data to already existing good data. + + Test 92 is updated to match this change. + New test 1156 checks all combinations of --range/--resume, --fail, + Content-Range header and http status code 200/416. + + Fixes #1163 + Reported-By: Ithubg on github + Closes #2578 + +Daniel Stenberg (22 May 2018) +- tftp: make sure error is zero terminated before printfing it + +- configure: add missing m4/ax_compile_check_sizeof.m4 + + follow-up to mistake in 6876ccf90b4 + +Jay Satiro (22 May 2018) +- [Johannes Schindelin brought this change] + + schannel: make CAinfo parsing resilient to CR/LF + + OpenSSL has supported --cacert for ages, always accepting LF-only line + endings ("Unix line endings") as well as CR/LF line endings ("Windows + line endings"). + + When we introduced support for --cacert also with Secure Channel (or in + cURL speak: "WinSSL"), we did not take care to support CR/LF line + endings, too, even if we are much more likely to receive input in that + form when using Windows. + + Let's fix that. + + Happily, CryptQueryObject(), the function we use to parse the ca-bundle, + accepts CR/LF input already, and the trailing LF before the END + CERTIFICATE marker catches naturally any CR/LF line ending, too. So all + we need to care about is the BEGIN CERTIFICATE marker. We do not + actually need to verify here that the line ending is CR/LF. Just + checking for a CR or an LF is really plenty enough. + + Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> + + Closes https://github.com/curl/curl/pull/2592 + +Daniel Stenberg (22 May 2018) +- CURLOPT_ACCEPT_ENCODING.3: add brotli and clarify a bit + +- RELEASE-NOTES: synced + +- KNOWN_BUGS: mention the -O with %-encoded file names + + Closes #2573 + +- checksrc: make sure sizeof() is used *with* parentheses + + ... and unify the source code to adhere. + + Closes #2563 + +- curl: added --styled-output + + It is enabled by default, so --no-styled-output will switch off the + detection/use of bold headers. + + Closes #2538 + +- curl: show headers in bold + + The feature is only enabled if the output is believed to be a tty. + + -J: There's some minor differences and improvements in -J handling, as + now J should work with -i and it actually creates a file first using the + initial name and then *renames* that to the one found in + Content-Disposition (if any). + + -i: only shows headers for HTTP transfers now (as documented). + Previously it would also show for pieces of the transfer that were HTTP + (for example when doing FTP over a HTTP proxy). + + -i: now shows trailers as well. Previously they were not shown at all. + + --libcurl: the CURLOPT_HEADER is no longer set, as the header output is + now done in the header callback. + +- configure: compile-time SIZEOF checks + + ... instead of exeucting code to get the size. Removes the use of + LD_LIBRARY_PATH for this. + + Fixes #2586 + Closes #2589 + Reported-by: Bernhard Walle + +- configure: replace AC_TRY_RUN with CURL_RUN_IFELSE + + ... and export LD_LIBRARY_PATH properly. This is a follow-up from + 2d4c215. + + Fixes #2586 + Reported-by: Bernhard Walle + +- docs: clarify CURLOPT_HTTPGET somewhat + + Reported-by: bsammon on github + Fixes #2590 + +- curl_fnmatch: only allow two asterisks for matching + + The previous limit of 5 can still end up in situation that takes a very + long time and consumes a lot of CPU. + + If there is still a rare use case for this, a user can provide their own + fnmatch callback for a version that allows a larger set of wildcards. + + This commit was triggered by yet another OSS-Fuzz timeout due to this. + Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8369 + + Closes #2587 + +- checksrc: fix too long line + + follow-up to e05ad5d + +- [Aleks brought this change] + + docs: mention HAproxy protocol "version 1" + + ...as there's also a version 2. + + Closes #2579 + +- examples/progressfunc: make it build on older libcurls + + This example was changed in ce2140a8c1 to use the new microsecond based + getinfo option. This change makes it conditionally keep using the older + option so that the example still builds with older libcurl versions. + + Closes #2584 + +- stub_gssapi: fix numerous 'unused parameter' warnings + + follow-up to d9e92fd9fd1d + +- [Philip Prindeville brought this change] + + getinfo: add microsecond precise timers for various intervals + + Provide a set of new timers that return the time intervals using integer + number of microseconds instead of floats. + + The new info names are as following: + + CURLINFO_APPCONNECT_TIME_T + CURLINFO_CONNECT_TIME_T + CURLINFO_NAMELOOKUP_TIME_T + CURLINFO_PRETRANSFER_TIME_T + CURLINFO_REDIRECT_TIME_T + CURLINFO_STARTTRANSFER_TIME_T + CURLINFO_TOTAL_TIME_T + + Closes #2495 + +- openssl: acknowledge --tls-max for default version too + + ... previously it only used the max setting if a TLS version was also + explicitly asked for. + + Reported-by: byte_bucket + Fixes #2571 + Closes #2572 + +- bump: start working on the pending 7.61.0 + +- [Dagobert Michelsen brought this change] + + tests/libtest/Makefile: Do not unconditionally add gcc-specific flags + + The warning flag leads e.g. Sun Studio compiler to bail out. + + Closes #2576 + +- schannel_verify: fix build for non-schannel + +Jay Satiro (16 May 2018) +- rand: fix typo + +- schannel: disable manual verify if APIs not available + + .. because original MinGW and old compilers do not have the Windows API + definitions needed to support manual verification. + +- [Archangel_SDY brought this change] + + schannel: disable client cert option if APIs not available + + Original MinGW targets Windows 2000 by default, which lacks some APIs and + definitions for this feature. Disable it if these APIs are not available. + + Closes https://github.com/curl/curl/pull/2522 + Version 7.60.0 (15 May 2018) Daniel Stenberg (15 May 2018) @@ -6122,1050 +7269,3 @@ Daniel Stenberg (28 Aug 2017) Reported-by: Michael Smith Fixes #1828 Closes #1833 - -Dan Fandrich (26 Aug 2017) -- tests: Make sure libtests & unittests call curl_global_cleanup() - - These were missed in commit c468c27b. - -Jay Satiro (26 Aug 2017) -- [theantigod brought this change] - - winbuild: fix embedded manifest option - - Embedded manifest option didn't work due to incorrect path. - - Fixes https://github.com/curl/curl/issues/1832 - -Daniel Stenberg (25 Aug 2017) -- fuzz/Makefile.am: remove curlbuild.h leftovers - -- examples/threaded-ssl: mention that this is for openssl before 1.1 - -- imap: use defined names for response codes - - When working on this code I found the previous setup a bit weird while - using proper defines increases readability. - - Closes #1824 - -- CURLOPT_USERPWD.3: see also CURLOPT_PROXYUSERPWD - -- imap: support PREAUTH - - It is a defined possible greeting at server startup that means the - connection is already authenticated. See - https://tools.ietf.org/html/rfc3501#section-7.1.4 - - Test 846 added to verify. - - Fixes #1818 - Closes #1820 - -Jay Satiro (23 Aug 2017) -- config-tpf: define SIZEOF_LONG - - Recent changes that replaced CURL_SIZEOF_LONG in the source with - SIZEOF_LONG broke builds that use the premade configuration files and - don't have SIZEOF_LONG defined. - - Bug: https://github.com/curl/curl/issues/1816 - -Dan Fandrich (23 Aug 2017) -- test1453: Fixed <features> - -Daniel Stenberg (22 Aug 2017) -- [Gisle Vanem brought this change] - - config-dos: add missing defines, SIZEOF_* and two others - - Bug: #1816 - -- curl: shorten and clean up CA cert verification error message - - The previous message was just too long for ordinary people and it was - encouraging users to use `--insecure` a little too easy. - - Based-on-work-by: Frank Denis - - Closes #1810 - Closes #1817 - -- request-target.d: mention added in 7.55.0 - -Marcel Raad (22 Aug 2017) -- tool_main: turn off MinGW CRT's globbing - - By default, the MinGW CRT globs command-line arguments. This prevents - getting a single asterisk into an argument as test 1299 does. Turn off - globbing by setting the global variable _CRT_glob to 0 for MinGW. - - Fixes https://github.com/curl/curl/issues/1751 - Closes https://github.com/curl/curl/pull/1813 - -Viktor Szakats (22 Aug 2017) -- makefile.m32: add support for libidn2 - - libidn was replaced with libidn2 last year in configure. - Caveat: libidn2 may depend on a list of further libs. - These can be manually specified via CURL_LDFLAG_EXTRAS. - - Closes https://github.com/curl/curl/pull/1815 - -Jay Satiro (22 Aug 2017) -- [Viktor Szakats brought this change] - - config-win32: define SIZEOF_LONG - - Recent changes that replaced CURL_SIZEOF_LONG in the source with - SIZEOF_LONG broke builds that use the premade configuration files and - don't have SIZEOF_LONG defined. - - Closes https://github.com/curl/curl/pull/1814 - -Daniel Stenberg (20 Aug 2017) -- cmake: enable picky compiler options with clang and gcc - - closes #1799 - -- curl/system.h: fix build for hppa - - Reported-by: John David Anglin - Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872502#10 - -- [Even Rouault brought this change] - - tftp: fix memory leak on too long filename - - Fixes - - $ valgrind --leak-check=full ~/install-curl-git/bin/curl tftp://localhost/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz - - ==9752== Memcheck, a memory error detector - ==9752== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. - ==9752== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info - ==9752== Command: /home/even/install-curl-git/bin/curl tftp://localhost/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz - ==9752== - curl: (71) TFTP file name too long - - ==9752== - ==9752== HEAP SUMMARY: - ==9752== 505 bytes in 1 blocks are definitely lost in loss record 11 of 11 - ==9752== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) - ==9752== by 0x4E61CED: Curl_urldecode (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) - ==9752== by 0x4E75868: tftp_state_machine (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) - ==9752== by 0x4E761B6: tftp_do (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) - ==9752== by 0x4E711B6: multi_runsingle (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) - ==9752== by 0x4E71D00: curl_multi_perform (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) - ==9752== by 0x4E6950D: curl_easy_perform (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) - ==9752== by 0x40E0B7: operate_do (in /home/even/install-curl-git/bin/curl) - ==9752== by 0x40E849: operate (in /home/even/install-curl-git/bin/curl) - ==9752== by 0x402693: main (in /home/even/install-curl-git/bin/curl) - - Fixes https://oss-fuzz.com/v2/testcase-detail/5232311106797568 - Credit to OSS Fuzz - - Closes #1808 - -Dan Fandrich (19 Aug 2017) -- runtests: fixed case insensitive matching of keywords - - Commit 5c2aac71 didn't work in the case of mixed-case keywords given on - the command-line. - -- tests: Make sure libtests call curl_global_cleanup() - - This ensures that global data allocations are freed so Valgrind stays - happy. This was a problem with at least PolarSSL and mbedTLS. - -Daniel Stenberg (18 Aug 2017) -- RELEASE-NOTES: synced with 8baead425 - -- scripts/contri*sh: use "git log --use-mailmap" - -- mailmap: de-duplify some git authors - -- http2_recv: return error better on fatal h2 errors - - Ref #1012 - Figured-out-by: Tatsuhiro Tsujikawa - -- KNOWN_BUGS: HTTP test server 'connection-monitor' problems - - Closes #868 - -- curl/system.h: check for __ppc__ as well - - ... regression since issue #1774 (commit 10b3df10596a) since obviously - some older gcc doesn't know __powerpc__ while some newer doesn't know - __ppc__ ... - - Fixes #1797 - Closes #1798 - Reported-by: Ryan Schmidt - -- [Jan Alexander Steffens (heftig) brought this change] - - http: Don't wait on CONNECT when there is no proxy - - Since curl 7.55.0, NetworkManager almost always failed its connectivity - check by timeout. I bisected this to 5113ad04 (http-proxy: do the HTTP - CONNECT process entirely non-blocking). - - This patch replaces !Curl_connect_complete with Curl_connect_ongoing, - which returns false if the CONNECT state was left uninitialized and lets - the connection continue. - - Closes #1803 - Fixes #1804 - - Also-fixed-by: Gergely Nagy - -- [Johannes Schindelin brought this change] - - metalink: adjust source code style - - Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> - -- CURL_SIZEOF_LONG: removed, use only SIZEOF_LONG - -- lib557: no longer use CURL_SIZEOF_* defines - -- config-win32: define SIZEOF_CURL_OFF_T - -- cmake: sizeof curl_off_t, remove unused detections - -- system.h: remove all CURL_SIZEOF_* defines - - ... as they're not used externally and internally we check for the sizes - already in configure etc. - - Closes #1767 - -- ftp: fix CWD when doing multicwd then nocwd on same connection - - Fixes #1782 - Closes #1787 - Reported-by: Peter Lamare - -- CURLOPT_SSH_COMPRESSION.3: enable with 1L - - (leaves other values reserved for the future) - -- compressed-ssh.d: "Added: 7.56.0" - -- curl/system.h: checksrc compliance - -Jay Satiro (17 Aug 2017) -- [Viktor Szakats brought this change] - - ssh: add the ability to enable compression (for SCP/SFTP) - - The required low-level logic was already available as part of - `libssh2` (via `LIBSSH2_FLAG_COMPRESS` `libssh2_session_flag()`[1] - option.) - - This patch adds the new `libcurl` option `CURLOPT_SSH_COMPRESSION` - (boolean) and the new `curl` command-line option `--compressed-ssh` - to request this `libssh2` feature. To have compression enabled, it - is required that the SSH server supports a (zlib) compatible - compression method and that `libssh2` was built with `zlib` support - enabled. - - [1] https://www.libssh2.org/libssh2_session_flag.html - - Ref: https://github.com/curl/curl/issues/1732 - Closes https://github.com/curl/curl/pull/1735 - -- examples/ftpuploadresume: checksrc compliance - -- [Maksim Stsepanenka brought this change] - - http_proxy: fix build error for CURL_DOES_CONVERSIONS - - Closes https://github.com/curl/curl/pull/1793 - -GitHub (16 Aug 2017) -- [Nick Zitzmann brought this change] - - configure: check for __builtin_available() availability (#1788) - - This change does two things: - 1. It un-breaks the build in Xcode 9.0. (Xcode 9.0 is currently - failing trying to compile connectx() in lib/connect.c.) - 2. It finally weak-links the connectx() function, and falls back on - connect() when run on older operating systems. - -Daniel Stenberg (16 Aug 2017) -- travis: add metalink to some osx builds - - Closes #1790 - -- [Max Dymond brought this change] - - coverage: Use two coveralls commands to get lib/vtls results - - closes #1747 - -- darwinssi: fix error: variable length array used - -- m4/curl-compilers.m4: use proper quotes around string, not backticks - - ... when setting clang version to assume 3.7 - - Caused a lot of "integer expression expected" warnings by configure. - -- [Benbuck Nason brought this change] - - cmake: remove dead code for DISABLED_THREADSAFE - - Closes #1786 - -Jay Satiro (15 Aug 2017) -- [Jakub Zakrzewski brought this change] - - curl-confopts.m4: fix --disable-threaded-resolver - - Closes https://github.com/curl/curl/issues/1784 - -Daniel Stenberg (15 Aug 2017) -- [Ryan Winograd brought this change] - - progress: Track total times following redirects - - Update the progress timers `t_nslookup`, `t_connect`, `t_appconnect`, - `t_pretransfer`, and `t_starttransfer` to track the total times for - these activities when a redirect is followed. Previously, only the times - for the most recent request would be tracked. - - Related changes: - - - Rename `Curl_pgrsResetTimesSizes` to `Curl_pgrsResetTransferSizes` - now that the function only resets transfer sizes and no longer - modifies any of the progress timers. - - - Add a bool to the `Progress` struct that is used to prevent - double-counting `t_starttransfer` times. - - Added test case 1399. - - Fixes #522 and Known Bug 1.8 - Closes #1602 - Reported-by: joshhe on github - -- [Benbuck Nason brought this change] - - cmake: remove dead code for CURL_DISABLE_RTMP - - Closes #1785 - -Kamil Dudka (15 Aug 2017) -- zsh.pl: produce a working completion script again - - Commit curl-7_54_0-118-g8b2f22e changed the output format of curl --help - to use <file> and <dir> instead of FILE and DIR, which caused zsh.pl to - produce a broken completion script: - - % curl --<TAB> - _curl:10: no such file or directory: seconds - - Closes #1779 - -Daniel Stenberg (15 Aug 2017) -- curlver: toward 7.56.0? - -- RELEASE-NOTES: synced with 91c46dc44 - -- test1449: FTP download range with an too large size - -- strtoofft: reduce integer overflow risks globally - - ... make sure we bail out on overflows. - - Reported-by: Brian Carpenter - Closes #1758 - -- travis: build the examples too - - to make sure they keep building warning-free - - Closes #1777 - -- runtests: match keywords case insensitively - -- examples/ftpuploadresume.c: use portable code - - ... converted from the MS specific _snscanf() - -Version 7.55.1 (13 Aug 2017) - -Daniel Stenberg (13 Aug 2017) -- RELEASE-NOTES/THANKS: curl 7.55.1 release time - -- gitignore: ignore .xz now instead of .lzma - -- [Sergei Nikulov brought this change] - - cmake: Threads detection update. ref: #1702 - - Closes #1719 - -- ipv6_scope: support unique local addresses - - Fixes #1764 - Closes #1773 - Reported-by: James Slaughter - -- [Alex Potapenko brought this change] - - curl/system.h: GCC doesn't define __ppc__ on PowerPC, uses __powerpc__ - - Closes #1774 - -- test1448: verify redirect to IDN using URL - - Closes #1772 - -- [Salah-Eddin Shaban brought this change] - - redirect: skip URL encoding for host names - - This fixes redirects to IDN URLs - - Fixes #1441 - Closes #1762 - Reported by: David Lord - -- test2032: mark as flaky (again) - -- travis: test cmake build on tarball too - - Could've prevented #1755 - -- [Simon Warta brought this change] - - cmake: allow user to override CMAKE_DEBUG_POSTFIX - - Closes #1763 - -- connect-to.d: better language - -- connect-to.d: clarified - -- bagder/Curl_tvdiff_us: fix the math - - Regression since adef394ac5 (released in 7.55.0) - - Reported-by: Han Qiao - Fixes #1769 - Closes #1771 - -- curl/system.h: add Oracle Solaris Studio - - Fixes #1752 - -- [Alessandro Ghedini brought this change] - - docs: fix typo funtion -> function - - Closes #1770 - -Alessandro Ghedini (12 Aug 2017) -- docs: fix grammar in CURL_SSLVERSION_MAX_DEFAULT description - -- docs: fix typo stuct -> struct - -Dan Fandrich (12 Aug 2017) -- test1447: require a curl with http support - -Daniel Stenberg (11 Aug 2017) -- [Thomas Petazzoni brought this change] - - curl/system.h: support more architectures - - The long list of architectures in include/curl/system.h is annoying to - maintain, and needs to be extended for each and every architecture to - support. - - Instead, let's rely on the __SIZEOF_LONG__ define of the gcc compiler - (we are in the GNUC condition anyway), which tells us if long is 4 - bytes or 8 bytes. - - This fixes the build of libcurl 7.55.0 on architectures such as - OpenRISC or ARC. - - Closes #1766 - - Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> - -- test2033: this went flaky again - - Suspicion: when we enabled the threaded resolver by default. - -- test1447: verifies the parse proxy fix in 6e0e152ce5c - -- [Even Rouault brought this change] - - parse_proxy(): fix memory leak in case of invalid proxy server name - - Fixes the below leak: - - $ valgrind --leak-check=full ~/install-curl-git/bin/curl --proxy "http://a:b@/x" http://127.0.0.1 - curl: (5) Couldn't resolve proxy name - ==5048== - ==5048== HEAP SUMMARY: - ==5048== in use at exit: 532 bytes in 12 blocks - ==5048== total heap usage: 5,288 allocs, 5,276 frees, 445,271 bytes allocated - ==5048== - ==5048== 2 bytes in 1 blocks are definitely lost in loss record 1 of 12 - ==5048== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) - ==5048== by 0x4E6CB79: parse_login_details (url.c:5614) - ==5048== by 0x4E6BA82: parse_proxy (url.c:5091) - ==5048== by 0x4E6C46D: create_conn_helper_init_proxy (url.c:5346) - ==5048== by 0x4E6EA18: create_conn (url.c:6498) - ==5048== by 0x4E6F9B4: Curl_connect (url.c:6967) - ==5048== by 0x4E86D05: multi_runsingle (multi.c:1436) - ==5048== by 0x4E88432: curl_multi_perform (multi.c:2160) - ==5048== by 0x4E7C515: easy_transfer (easy.c:708) - ==5048== by 0x4E7C74A: easy_perform (easy.c:794) - ==5048== by 0x4E7C7B1: curl_easy_perform (easy.c:813) - ==5048== by 0x414025: operate_do (tool_operate.c:1563) - ==5048== - ==5048== 2 bytes in 1 blocks are definitely lost in loss record 2 of 12 - ==5048== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) - ==5048== by 0x4E6CBB6: parse_login_details (url.c:5621) - ==5048== by 0x4E6BA82: parse_proxy (url.c:5091) - ==5048== by 0x4E6C46D: create_conn_helper_init_proxy (url.c:5346) - ==5048== by 0x4E6EA18: create_conn (url.c:6498) - ==5048== by 0x4E6F9B4: Curl_connect (url.c:6967) - ==5048== by 0x4E86D05: multi_runsingle (multi.c:1436) - ==5048== by 0x4E88432: curl_multi_perform (multi.c:2160) - ==5048== by 0x4E7C515: easy_transfer (easy.c:708) - ==5048== by 0x4E7C74A: easy_perform (easy.c:794) - ==5048== by 0x4E7C7B1: curl_easy_perform (easy.c:813) - ==5048== by 0x414025: operate_do (tool_operate.c:1563) - - Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2984 - Credit to OSS Fuzz for discovery - - Closes #1761 - -- RELEASE-NOTES: synced with 37f2195a9 - -- curlver: bump to 7.55.1 - -- openssl: fix "error: this statement may fall through" - - A gcc7 warning. - -- [David Benjamin brought this change] - - openssl: remove CONST_ASN1_BIT_STRING. - - Just making the pointer as const works for the pre-1.1.0 path too. - - Closes #1759 - -- maketgz: remove old *.dist files before making the tarball - - To avoid "old crap" unintentionally getting shipped. - - Bug: https://curl.haxx.se/mail/lib-2017-08/0050.html - Reported-by: Christian Weisgerber - -Jay Satiro (10 Aug 2017) -- mkhelp.pl: allow executing this script directly - - - Enable execute permission (chmod +x) - - - Change interpreter to /usr/bin/env perl - - Ref: https://github.com/curl/curl/issues/1743 - -Daniel Stenberg (10 Aug 2017) -- configure: use the threaded resolver backend by default if possible - - Closes #1647 - -- cmake: move cmake_uninstall.cmake to CMake/ - - Closes #1756 - -- metalink: fix error: ‘*’ in boolean context, suggest ‘&&’ instead - -- dist: fix the cmake build by shipping cmake_uninstall.cmake.in too - - Fixes #1755 - -- travis: verify "make install" - - Help-by: Jay Satiro - Closes #1753 - -Marcel Raad (10 Aug 2017) -- build: check out *.sln files with Windows line endings - - Visual Studio doesn't like LF line endings in solution files and always - converts them to CRLF when doing changes to the solution. Notably, this - affects the solutions in the release archive. - - Closes https://github.com/curl/curl/pull/1746 - -- gitignore: ignore top-level .vs folder - - This folder is generated when using the CMake build system from within - Visual Studio. - - Closes https://github.com/curl/curl/pull/1746 - -Jay Satiro (10 Aug 2017) -- digest_sspi: Don't reuse context if the user/passwd has changed - - Bug: https://github.com/curl/curl/issues/1685 - Reported-by: paulharris@users.noreply.github.com - - Assisted-by: Isaac Boukris - - Closes https://github.com/curl/curl/pull/1742 - -Daniel Stenberg (9 Aug 2017) -- [Adam Sampson brought this change] - - dist: Add dictserver.py/negtelnetserver.py to EXTRA_DIST - - These weren't included in the 7.55.0 release, but are required in order - to run the full test suite. - - Closes #1744 - -- [Adam Sampson brought this change] - - curl: do bounds check using a double comparison - - The fix for this in 8661a0aacc01492e0436275ff36a21734f2541bb wasn't - complete: if the parsed number in num is larger than will fit in a long, - the conversion is undefined behaviour (causing test1427 to fail for me - on IA32 with GCC 7.1, although it passes on AMD64 and ARMv7). Getting - rid of the cast means the comparison will be done using doubles. - - It might make more sense for the max argument to also be a double... - - Fixes #1750 - Closes #1749 - -- make install: add 8 missing man pages to the installation - -- build: fix 'make install' with configure, install docs/libcurl/* too - - Broken since d24838d4da9faa - - Reported-by: Bernard Spil - -Version 7.55.0 (9 Aug 2017) - -Daniel Stenberg (9 Aug 2017) -- RELEASE-NOTES: curl 7.55.0 - -- THANKS: 20 new contributors in 7.55.0 - -- [Viktor Szakats brought this change] - - docs/comments: Update to secure URL versions - - Closes #1741 - -- configure: fix recv/send/select detection on Android - - ... since they now provide several functions as - __attribute__((overloadable)), the argument detection logic need - updates. - - Patched-by: destman at github - - Fixes #1738 - Closes #1739 - -Marcel Raad (8 Aug 2017) -- ax_code_coverage.m4: update to latest version - - This updates the script to aad5ad5fedb306b39f901a899b7bd305b66c418d - from August 01, 2017. Notably, this removes the lconv version whitelist. - - Closes https://github.com/curl/curl/pull/1716 - -Daniel Stenberg (7 Aug 2017) -- test1427: verify command line parser integer overflow detection - -- curl: detect and bail out early on parameter integer overflows - - Make the number parser aware of the maximum limit curl accepts for a - value and return an error immediately if larger, instead of running an - integer overflow later. - - Fixes #1730 - Closes #1736 - -- glob: do not continue parsing after a strtoul() overflow range - - Added test 1289 to verify. - - CVE-2017-1000101 - - Bug: https://curl.haxx.se/docs/adv_20170809A.html - Reported-by: Brian Carpenter - -- tftp: reject file name lengths that don't fit - - ... and thereby avoid telling send() to send off more bytes than the - size of the buffer! - - CVE-2017-1000100 - - Bug: https://curl.haxx.se/docs/adv_20170809B.html - Reported-by: Even Rouault - - Credit to OSS-Fuzz for the discovery - -- [Even Rouault brought this change] - - file: output the correct buffer to the user - - Regression brought by 7c312f84ea930d8 (April 2017) - - CVE-2017-1000099 - - Bug: https://curl.haxx.se/docs/adv_20170809C.html - - Credit to OSS-Fuzz for the discovery - -- easy_events: make event data static - - First: this function is only used in debug-builds and not in - release/real builds. It is used to drive tests using the event-based - API. - - A pointer to the local struct is passed to CURLMOPT_TIMERDATA, but the - CURLMOPT_TIMERFUNCTION calback can in fact be called even after this - funtion returns, namely when curl_multi_remove_handle() is called. - - Reported-by: Brian Carpenter - -- getparameter: avoid returning uninitialized 'usedarg' - - Fixes #1728 - -Marcel Raad (5 Aug 2017) -- [Isaac Boukris brought this change] - - gssapi: fix memory leak of output token in multi round context - - When multiple rounds are needed to establish a security context - (usually ntlm), we overwrite old token with a new one without free. - Found by proposed gss tests using stub a gss implementation (by - valgrind error), though I have confirmed the leak with a real - gssapi implementation as well. - - Closes https://github.com/curl/curl/pull/1733 - -- darwinssl: fix compiler warning - - clang complains: - vtls/darwinssl.c:40:8: error: extra tokens at end of #endif directive - [-Werror,-Wextra-tokens] - - This breaks the darwinssl build on Travis. Fix it by making this token - a comment. - - Closes https://github.com/curl/curl/pull/1734 - -- CMake: fix CURL_WERROR for MSVC - - When using CURL_WERROR in MSVC builds, the debug flags were overridden - by the release flags and /WX got added twice in debug mode. - - Closes https://github.com/curl/curl/pull/1715 - -Daniel Stenberg (4 Aug 2017) -- RELEASE-NOTES: synced with 561e9217c - -- test1010: verify that #1718 is fixed - - ... by doing two transfers in nocwd mode and check that there's no - superfluous CWD command. - -- FTP: skip unnecessary CWD when in nocwd mode - - ... when reusing a connection. If it didn't do any CWD previously. - - Fixes #1718 - -Marcel Raad (4 Aug 2017) -- travis: explicitly specify dist - - This makes the builds more reproducible as travis is currently rolling - out trusty as default dist [1]. Specifically, this avoids coverage - check failures when trusty is used as seen in [2] until we figure out - what's wrong. - - [1] https://blog.travis-ci.com/2017-07-11-trusty-as-default-linux-is-coming - [2] https://github.com/curl/curl/pull/1692 - - Closes https://github.com/curl/curl/pull/1725 - -Daniel Stenberg (4 Aug 2017) -- travis: BUILD_TYPE => T - - (to make the full line appear nicer on travis web UI) - -- travis: add osx build with darwinssl - - Closes #1706 - -- darwin: silence compiler warnings - - With a clang pragma and three type fixes - - Fixes #1722 - -- BUILD.WINDOWS: mention buildconf.bat for builds off git - -- darwinssl: fix curlssl_sha256sum() compiler warnings on first argument - -- test130: verify comments in .netrc - -- [Gisle Vanem brought this change] - - netrc: skip lines starting with '#' - - Bug: https://curl.haxx.se/mail/lib-2017-08/0008.html - -Marcel Raad (3 Aug 2017) -- CMake: set MSVC warning level to 4 - - The MSVC warning level defaults to 3 in CMake. Change it to 4, which is - consistent with the Visual Studio and NMake builds. Disable level 4 - warning C4127 for the library and additionally C4306 for the test - servers to get a clean CURL_WERROR build as that warning is raised in - some macros in older Visual Studio versions. - - Ref: https://github.com/curl/curl/pull/1667#issuecomment-314082794 - Closes https://github.com/curl/curl/pull/1711 - -Daniel Stenberg (2 Aug 2017) -- CURLOPT_NETRC.3: fix typo in 7e48aa386156f9c2 - - Reported-by: Viktor Szakats - -- CURLOPT_NETRC.3: mention the file name on windows - - ... and CURLOPT_NETRC_FILE(3). - -- travis: build osx with libressl too - -- travis: build osx with openssl too - -- tests/server/util: fix curltime mistake from 4dee50b9c80f9 - -Marcel Raad (1 Aug 2017) -- curl_threads: fix MSVC compiler warning - - Use LongToHandle to convert from long to HANDLE in the Win32 - implementation. - This should fix the following warning when compiling with - MSVC 11 (2012) in 64-bit mode: - lib\curl_threads.c(113): warning C4306: - 'type cast' : conversion from 'long' to 'HANDLE' of greater size - - Closes https://github.com/curl/curl/pull/1717 - -Daniel Stenberg (1 Aug 2017) -- BUGS: improved phrasing about security bugs - - Reported-by: Max Dymond - -- BUGS: clarify how to report security related bugs - -- [Brad Spencer brought this change] - - multi: fix request timer management - - There are some bugs in how timers are managed for a single easy handle - that causes the wrong "next timeout" value to be reported to the - application when a new minimum needs to be recomputed and that new - minimum should be an existing timer that isn't currently set for the - easy handle. When the application drives a set of easy handles via the - `curl_multi_socket_action()` API (for example), it gets told to wait the - wrong amount of time before the next call, which causes requests to - linger for a long time (or, it is my guess, possibly forever). - - Bug: https://curl.haxx.se/mail/lib-2017-07/0033.html - -Jay Satiro (1 Aug 2017) -- curl_setup: Define CURL_NO_OLDIES for building libcurl - - .. to catch accidental use of deprecated error codes. - - Ref: https://github.com/curl/curl/issues/1688#issuecomment-316764237 - -Daniel Stenberg (1 Aug 2017) -- [Jeremy Tan brought this change] - - configure: fix the check for IdnToUnicode - - Fixes #1669 - Closes #1713 - -- http: fix response code parser to avoid integer overflow - - test 1429 and 1433 were updated to work with the stricter HTTP status line - parser. - - Closes #1714 - Reported-by: Brian Carpenter - -Jay Satiro (31 Jul 2017) -- [Dwarakanath Yadavalli brought this change] - - libcurl: Stop using error codes defined under CURL_NO_OLDIES - - Fixes https://github.com/curl/curl/issues/1688 - Closes https://github.com/curl/curl/pull/1712 - -- include.d: clarify --include is only for response headers - - Follow-up to 171f8de and de6de94. - - Bug: https://github.com/curl/curl/commit/de6de94#commitcomment-23370851 - Reported-by: Daniel Stenberg - -Daniel Stenberg (30 Jul 2017) -- [Jason Juang brought this change] - - cmake: support make uninstall - - Closes #1674 - -- RELEASE-NOTES: synced with 001701c47 - -Marcel Raad (29 Jul 2017) -- AppVeyor: now really use CURL_WERROR - - It was misspelled as CURL_ERROR in commit - 2d86e8d1286e0fbe3d811e2e87fa0b5e53722db4. - - Closes https://github.com/curl/curl/pull/1686 - -Jay Satiro (29 Jul 2017) -- tool_help: clarify --include is only for response headers - - Follow-up to 171f8de. - - Ref: https://github.com/curl/curl/issues/1704 - -- splay: fix signed/unsigned mismatch warning - - Follow-up to 4dee50b. - - Ref: https://github.com/curl/curl/pull/1693 - -Daniel Stenberg (28 Jul 2017) -- include.d: clarify that it concerns the response headers - - Reported-by: olesteban at github - Fixes #1704 - -- [Johannes Schindelin brought this change] - - curl_rtmp: fix a compiler warning - - The headers of librtmp declare the socket as `int`, and on Windows, that - disagrees with curl_socket_t. - - Bug: #1652 - - Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> - -- test1323: verify curlx_tvdiff - -- timeval: struct curltime is a struct timeval replacement - - ... to make all libcurl internals able to use the same data types for - the struct members. The timeval struct differs subtly on several - platforms so it makes it cumbersome to use everywhere. - - Ref: #1652 - Closes #1693 - -- darwinssl: fix variable type mistake (regression) - - ... which made --tlsv1.2 not work because it would blank the max tls - version variable. - - Reported-by: Nick Miyake - Bug: #1703 - -- multi: mention integer overflow risk if using > 500 million sockets - - Reported-by: ovidiu-benea@users.noreply.github.com - - Closes #1675 - Closes #1683 - -- checksrc: escape open brace in regex - - ... to silence warning. - -Kamil Dudka (20 Jul 2017) -- nss: fix a possible use-after-free in SelectClientCert() - - ... causing a SIGSEGV in showit() in case the handle used to initiate - the connection has already been freed. - - This commit fixes a bug introduced in curl-7_19_5-204-g5f0cae803. - - Reported-by: Rob Sanders - Bug: https://bugzilla.redhat.com/1436158 - -- nss: unify the coding style of nss_send() and nss_recv() - - No changes in behavior intended by this commit. - -Marcel Raad (18 Jul 2017) -- tests/server/resolve.c: fix deprecation warning - - MSVC warns that gethostbyname is deprecated. Always use getaddrinfo - instead to fix this when IPv6 is enabled, also for IPv4 resolves. This - is also consistent with what libcurl does. - - Closes https://github.com/curl/curl/pull/1682 - -Jay Satiro (17 Jul 2017) -- darwinssl: fix pinnedpubkey build error - - - s/SessionHandle/Curl_easy/ - - Bug: https://github.com/curl/curl/commit/eb16305#commitcomment-23035670 - Reported-by: Gisle Vanem - -Marcel Raad (16 Jul 2017) -- rtspd: fix GCC warning after MSVC warning fix - - Older GCC warns: - /tests/server/rtspd.c:1194:10: warning: missing braces around - initializer [-Wmissing-braces] - - Fix this by using memset instead of an initializer. - -- libtest: fix MSVC warning C4706 - - With warning level 4, MSVC warns about assignments within conditional - expressions. Change the while loop to a do-while loop to fix this. This - change is also consistent with CODE_STYLE.md. - -- sockfilt: suppress conversion warning with explicit cast - - MSVC warns when implicitly casting -1 to unsigned long. - -- rtspd: fix MSVC level 4 warning - - warning C4701: potentially uninitialized local variable 'req' used |