curl/lib
Daniel Stenberg 19f66c7575 Thanks for the notification iDEFENCE. We are the "initial vendor" and we sure
got no notification, no mail, no nothing.

You didn't even bother to mail us when you went public with this. Cool.

NTLM buffer overflow fix, as reported here:

http://www.securityfocus.com/archive/1/391042
2005-02-22 07:44:14 +00:00
..
.cvsignore
amigaos.c
amigaos.h
arpa_telnet.h
base64.c
base64.h
ca-bundle.crt
config-amigaos.h
config-mac.h
config-riscos.h
config-vms.h
config-win32.h
config-win32ce.h
config.dj
connect.c close the socket properly when returning error due to failing localbind 2005-02-17 14:45:03 +00:00
connect.h
content_encoding.c Fix for a bug report that compressed files that are exactly 64 KiB long 2005-02-07 19:12:37 +00:00
content_encoding.h
cookie.c
cookie.h
curllib.dsw
curlx.h
dict.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
dict.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
easy.c better error checking and SSL init by David Byron 2005-02-09 23:04:51 +00:00
easyif.h
escape.c
escape.h
file.c Removed all uses of strftime() since it uses the localised version of the 2005-02-11 00:03:49 +00:00
file.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
formdata.c
formdata.h
ftp.c Fixed bad krb4 code. It always tried to use krb4 if built enabled. 2005-02-11 22:50:57 +00:00
ftp.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
getenv.c
getinfo.c
getinfo.h
hash.c
hash.h
hostares.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
hostasyn.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
hostip4.c
hostip6.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
hostip.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
hostip.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
hostsyn.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
hostthre.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
http_chunks.c
http_chunks.h
http_digest.c
http_digest.h
http_negotiate.c
http_negotiate.h
http_ntlm.c Thanks for the notification iDEFENCE. We are the "initial vendor" and we sure 2005-02-22 07:44:14 +00:00
http_ntlm.h
http.c Ralph Mitchell reported a flaw when you used a proxy with auth, and you 2005-02-18 23:53:07 +00:00
http.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
if2ip.c
if2ip.h
inet_ntoa_r.h
inet_ntop.c
inet_ntop.h
inet_pton.c
inet_pton.h
krb4.c
krb4.h
ldap.c Set 'bits.close' in case of malloc fail. 2005-02-09 14:28:35 +00:00
ldap.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
libcurl.def
libcurl.framework.make
libcurl.imp
libcurl.plist
libcurl.rc
llist.c
llist.h
Makefile.am
makefile.amiga
Makefile.b32
makefile.dj
Makefile.inc Removed all uses of strftime() since it uses the localised version of the 2005-02-11 00:03:49 +00:00
Makefile.m32
Makefile.netware
Makefile.riscos
Makefile.vc6
Makefile.Watcom
md5.c
md5.h
memdebug.c
memdebug.h
memory.h
mprintf.c
msvcproj.foot
msvcproj.head
multi.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
multiif.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
netrc.c
netrc.h
nwlib.c
parsedate.c Removed all uses of strftime() since it uses the localised version of the 2005-02-11 00:03:49 +00:00
parsedate.h Removed all uses of strftime() since it uses the localised version of the 2005-02-11 00:03:49 +00:00
progress.c
progress.h
README.ares
README.curlx
README.encoding
README.hostip
README.httpauth
README.memoryleak
security.c
security.h
select.c
select.h
sendf.c
sendf.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
setup.h
share.c
share.h
speedcheck.c
speedcheck.h
ssluse.c init fix for non-SSL builds 2005-02-10 07:45:08 +00:00
ssluse.h better error checking and SSL init by David Byron 2005-02-09 23:04:51 +00:00
strequal.c
strequal.h
strerror.c Handle CURLE_LOGIN_DENIED in strerror.c. 2005-02-09 13:59:40 +00:00
strerror.h
strtok.c
strtok.h
strtoofft.c
strtoofft.h
telnet.c FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
telnet.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
timeval.c
timeval.h
transfer.c Christopher R. Palmer reported a problem with HTTP-POSTing using "anyauth" 2005-02-16 14:31:23 +00:00
transfer.h Rename Curl_pretransfersec() to *_second_connect() since it does not just 2005-02-14 09:30:40 +00:00
url.c prevent a compiler warning 2005-02-09 22:47:57 +00:00
url.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
urldata.h FTP code turned into state machine. Not completely yet, but a good start. 2005-02-09 13:06:40 +00:00
version.c

$Id$
                                  _   _ ____  _     
                              ___| | | |  _ \| |    
                             / __| | | | |_) | |    
                            | (__| |_| |  _ <| |___ 
                             \___|\___/|_| \_\_____|

             How To Track Down Suspected Memory Leaks in libcurl
             ===================================================

Single-threaded

  Please note that this memory leak system is not adjusted to work in more
  than one thread. If you want/need to use it in a multi-threaded app. Please
  adjust accordingly.


Build

  Rebuild libcurl with -DCURLDEBUG (usually, rerunning configure with
  --enable-debug fixes this). 'make clean' first, then 'make' so that all
  files actually are rebuilt properly. It will also make sense to build
  libcurl with the debug option (usually -g to the compiler) so that debugging
  it will be easier if you actually do find a leak in the library.

  This will create a library that has memory debugging enabled.

Modify Your Application

  Add a line in your application code:

       curl_memdebug("filename");

  This will make the malloc debug system output a full trace of all resource
  using functions to the given file name. Make sure you rebuild your program
  and that you link with the same libcurl you built for this purpose as
  described above.

Run Your Application

  Run your program as usual. Watch the specified memory trace file grow.

  Make your program exit and use the proper libcurl cleanup functions etc. So
  that all non-leaks are returned/freed properly.

Analyze the Flow

  Use the tests/memanalyze.pl perl script to analyze the memdump file:

    tests/memanalyze.pl < memdump

  This now outputs a report on what resources that were allocated but never
  freed etc. This report is very fine for posting to the list!

  If this doesn't produce any output, no leak was detected in libcurl. Then
  the leak is mostly likely to be in your code.