When generating the new filename, make sure we aren't overflowing the
size_t limit when calculating the new length. This is mostly academic
but good code hygeine nonetheless.
Closes: #8771
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Print the boolean value as its string representation instead of with
%hhu which isn't a format we typically use.
Closes: #8763
Reviewed-by: Nick Banks <nibanks@microsoft.com>
Hyper now has the ability to preserve header order. This commit adds a
few lines setting the connection options for this feature.
Related to issue #8617Closes#8707
To simplify, and also since the returned name is not the full actual
name used for the check. The port number and zone id is also involved,
so just showing the name is misleading.
Closes#8750
- Test 973 redirects from HTTP to FTP, clear auth
- Test 974 redirects from HTTP to HTTP different port, clear auth
- Test 975 redirects from HTTP to FTP, permitted to keep auth
- Test 976 redirects from HTTP to HTTP different port, permitted to keep
auth
Making it just skip the check unless exactly 32 is too brittle. Even if
the docs says it needs to be exactly 32, it is be safer to make the
comparison fail here instead.
Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1549461Closes#8745
Also move static function safecmp() as non-static Curl_safecmp() since
its purpose is needed at several places.
Bug: https://curl.se/docs/CVE-2022-22576.html
CVE-2022-22576
Closes#8746
In order to avoid the risk of it being used in an accidental trigraph in
the generated code.
Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1548535Closes#8742
The copy command introduced in e498a9b1f had leftover '>' from the
previous sed command it replaced, which broke its syntax. Fix by
removing.
Reported-by: Emanuele Torre <torreemanuele6@gmail.com>
The script was moved in 8e22fc68e7 but the lines that called it
was not changed to reflect it's new position
Signed-off-by: Christopher Degawa <ccom@randomderp.com>
Closes#8728
Set the libcurl version in libcurl.plist like how libcurl.vers is
created.
Closes: #8692
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Nick Zitzmann <nickzman@gmail.com>
The existing programming had some issues with errorhandling for reading
the cookie file. If the file failed to open, we would silently ignore it
and continue as if there was no file (or stdin) passed. In this case, we
would also call fclose() on the NULL FILE pointer, which is undefined
behavior. Fix by ensuring that the FILE pointer is set before calling
fclose on it, and issue a warning in case the file cannot be opened.
Erroring out on nonexisting file would break backwards compatibility of
very old behavior so we can't really go there.
Closes: #8699
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Jay Satiro <raysatiro@yahoo.com>
