mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-11-27 05:50:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
2322891330
curl/lib
History
Daniel Stenberg 5ff2c5ff25
FTP: zero terminate the entry path even on bad input 
... a single double quote could leave the entry path buffer without a zero
terminating byte. CVE-2017-1000254

Test 1152 added to verify.

Reported-by: Max Dymond
Bug: https://curl.haxx.se/docs/adv_20171004.html
2017-10-02 07:50:17 +02:00
..
vauth ntlm: move NTLM_NEEDS_NSS_INIT define into core NTLM header 2017-09-23 13:58:14 -04:00
vtls ntlm: move NTLM_NEEDS_NSS_INIT define into core NTLM header 2017-09-23 13:58:14 -04:00
.gitattributes .gitattributes: force shell scripts to LF 2017-04-17 08:32:13 +02:00
.gitignore
amigaos.c
amigaos.h
arpa_telnet.h
asyn-ares.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
asyn-thread.c asyn-thread: Fixed cleanup after OOM 2017-08-29 00:35:19 +02:00
asyn.h
base64.c
checksrc.pl checksrc: detect and warn for multiple spaces 2017-09-12 09:50:24 +02:00
CMakeLists.txt CMake: set MSVC warning level to 4 2017-08-03 08:39:23 +02:00
config-amigaos.h
config-dos.h config-dos: add missing defines, SIZEOF_* and two others 2017-08-22 23:34:47 +02:00
config-mac.h
config-os400.h
config-riscos.h
config-symbian.h
config-tpf.h config-tpf: define SIZEOF_LONG 2017-08-23 03:17:10 -04:00
config-vxworks.h
config-win32.h config-win32: define SIZEOF_LONG 2017-08-22 02:24:09 -04:00
config-win32ce.h config-win32: define SIZEOF_LONG 2017-08-22 02:24:09 -04:00
conncache.c llist: no longer uses malloc 2017-04-22 11:25:27 +02:00
conncache.h timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
connect.c connect: fix race condition with happy eyeballs timeout 2017-09-29 08:51:59 +02:00
connect.h timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
content_encoding.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
content_encoding.h
cookie.c cookie: fix memory leak if path was set twice in header 2017-09-30 23:40:50 +02:00
cookie.h cookies: reject oversized cookies 2017-09-18 22:55:50 +02:00
curl_addrinfo.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
curl_addrinfo.h
curl_base64.h
curl_config.h.cmake cmake: sizeof curl_off_t, remove unused detections 2017-08-17 10:26:59 +02:00
curl_des.c
curl_des.h
curl_endian.c curl_endian: remove unused functions 2017-06-02 13:30:41 +02:00
curl_endian.h curl_endian: remove unused functions 2017-06-02 13:30:41 +02:00
curl_fnmatch.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
curl_fnmatch.h
curl_gethostname.c
curl_gethostname.h
curl_gssapi.c
curl_gssapi.h
curl_hmac.h
curl_ldap.h
curl_md4.h mbedtls: enable NTLM (& SMB) even if MD4 support is unavailable 2017-04-21 22:42:14 +02:00
curl_md5.h
curl_memory.h
curl_memrchr.c
curl_memrchr.h
curl_multibyte.c
curl_multibyte.h
curl_ntlm_core.c ntlm: use strict order for SSL backend #if branches 2017-09-22 19:01:28 +00:00
curl_ntlm_core.h ntlm: move NTLM_NEEDS_NSS_INIT define into core NTLM header 2017-09-23 13:58:14 -04:00
curl_ntlm_wb.c ntlm: move NTLM_NEEDS_NSS_INIT define into core NTLM header 2017-09-23 13:58:14 -04:00
curl_ntlm_wb.h
curl_printf.h
curl_rtmp.c curl_rtmp: fix a compiler warning 2017-07-28 16:41:29 +02:00
curl_rtmp.h
curl_sasl.c Curl_base64_encode: always call with a real data handle. 2017-09-02 12:49:59 +01:00
curl_sasl.h
curl_sec.h
curl_setup_once.h curl_setup_once: Remove ERRNO/SET_ERRNO macros 2017-07-10 02:09:27 -04:00
curl_setup.h openssl: Integrate Peter Wu's SSLKEYLOGFILE implementation 2017-09-05 23:56:54 -04:00
curl_sspi.c
curl_sspi.h
curl_threads.c curl_threads: fix MSVC compiler warning 2017-08-01 17:22:30 +02:00
curl_threads.h
curlx.h
dict.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
dict.h
dotdot.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
dotdot.h
easy.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
easyif.h
escape.c escape.c: error: pointer targets differ in signedness 2017-09-15 16:56:23 +02:00
escape.h
file.c file_range: avoid integer overflow when figuring out byte range 2017-09-23 18:21:15 +02:00
file.h
fileinfo.c llist: no longer uses malloc 2017-04-22 11:25:27 +02:00
fileinfo.h llist: no longer uses malloc 2017-04-22 11:25:27 +02:00
firefox-db2pem.sh
formdata.c form/mime: field names are not allowed to contain zero-valued bytes. 2017-09-22 01:08:29 +01:00
formdata.h mime: unified to use the typedef'd mime structs everywhere 2017-09-05 17:33:16 +01:00
ftp.c FTP: zero terminate the entry path even on bad input 2017-10-02 07:50:17 +02:00
ftp.h ftp: fix CWD when doing multicwd then nocwd on same connection 2017-08-17 10:08:11 +02:00
ftplistparser.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
ftplistparser.h
getenv.c
getinfo.c getinfo: access SSL internals via Curl_ssl 2017-08-28 14:56:57 +02:00
getinfo.h
gopher.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
gopher.h
hash.c code style: use space after semicolon 2017-09-12 09:50:24 +02:00
hash.h llist: no longer uses malloc 2017-04-22 11:25:27 +02:00
hmac.c
hostasyn.c
hostcheck.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
hostcheck.h
hostip4.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
hostip6.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
hostip.c code style: remove wrong uses of multiple spaces 2017-09-12 13:54:54 +02:00
hostip.h
hostsyn.c
http2.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
http2.h http2: fix OOM crash 2017-06-18 23:57:45 +02:00
http_chunks.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
http_chunks.h
http_digest.c
http_digest.h
http_negotiate.c
http_negotiate.h
http_ntlm.c ntlm: move NTLM_NEEDS_NSS_INIT define into core NTLM header 2017-09-23 13:58:14 -04:00
http_ntlm.h
http_proxy.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
http_proxy.h http_proxy: fix build with http and proxy 2017-06-18 15:18:15 +02:00
http.c http: add custom empty headers to repeated requests 2017-09-28 21:25:22 +02:00
http.h Curl_checkheaders: make it available for IMAP and SMTP too 2017-09-11 00:26:17 +02:00
idn_win32.c
if2ip.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
if2ip.h ipv6_scope: support unique local addresses 2017-08-13 17:52:15 +02:00
imap.c imap: quote atoms properly when escaping characters 2017-09-22 14:43:37 +02:00
imap.h imap: support PREAUTH 2017-08-23 23:58:49 +02:00
inet_ntop.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
inet_ntop.h
inet_pton.c curl_setup_once: Remove ERRNO/SET_ERRNO macros 2017-07-10 02:09:27 -04:00
inet_pton.h inet_pton: fix include on windows to get prototype 2017-07-05 13:28:19 +02:00
krb5.c krb5: use private buffer for temp string, not receive buffer 2017-05-01 22:55:29 +02:00
ldap.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
libcurl.plist
libcurl.rc
libcurl.vers.in
llist.c multi: use a fixed array of timers instead of malloc 2017-05-10 12:55:36 +02:00
llist.h llist: no longer uses malloc 2017-04-22 11:25:27 +02:00
Makefile.am configure: remove --enable-soname-bump and SONAME_BUMP 2017-09-06 08:43:36 +02:00
makefile.amiga
Makefile.b32
makefile.dj lib: fix the djgpp build 2017-06-21 07:46:21 +02:00
Makefile.inc mime: new MIME API. 2017-09-02 17:47:10 +01:00
Makefile.m32 makefile.m32: add multissl support 2017-08-30 10:44:50 +00:00
Makefile.netware includes: remove curl/curlbuild.h and curl/curlrules.h 2017-06-14 11:07:33 +02:00
Makefile.vxworks
Makefile.Watcom lib/curl_setup.h: remove CURL_WANTS_CA_BUNDLE_ENV 2017-06-15 11:11:15 +02:00
md4.c MD(4|5): silence cast-align clang warning 2017-06-02 21:58:48 +02:00
md5.c MD(4|5): silence cast-align clang warning 2017-06-02 21:58:48 +02:00
memdebug.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
memdebug.h
mime.c form/mime: field names are not allowed to contain zero-valued bytes. 2017-09-22 01:08:29 +01:00
mime.h form/mime: field names are not allowed to contain zero-valued bytes. 2017-09-22 01:08:29 +01:00
mk-ca-bundle.pl mk-ca-bundle.pl: Check curl's exit code after certdata download 2017-06-16 01:58:23 -04:00
mk-ca-bundle.vbs
mprintf.c code style: remove wrong uses of multiple spaces 2017-09-12 13:54:54 +02:00
multi.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
multihandle.h timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
multiif.h expire: remove Curl_expire_latest() 2017-06-08 10:50:47 +02:00
netrc.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
netrc.h
non-ascii.c non-ascii: use iconv() with 'char **' argument 2017-09-15 16:56:23 +02:00
non-ascii.h mime: new MIME API. 2017-09-02 17:47:10 +01:00
nonblock.c
nonblock.h
nwlib.c
nwos.c
objnames-test08.sh
objnames-test10.sh
objnames.inc
openldap.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
parsedate.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
parsedate.h
pingpong.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
pingpong.h timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
pipeline.c PIPELINING_SERVER_BL: cleanup the internal list use 2017-06-19 09:14:49 +02:00
pipeline.h
pop3.c handler: refactor connection checking 2017-06-30 10:17:27 +02:00
pop3.h
progress.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
progress.h progress: Track total times following redirects 2017-08-15 18:58:31 +02:00
rand.c timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
rand.h rand: treat fake entropy the same regardless of endianness 2017-05-08 23:24:29 +02:00
rtsp.c rtsp: Segfault in rtsp.c when using WRITEDATA 2017-09-15 15:43:48 +02:00
rtsp.h handler: refactor connection checking 2017-06-30 10:17:27 +02:00
security.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
select.c timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
select.h select.h: avoid macro redefinition harder 2017-07-05 13:28:28 +02:00
sendf.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
sendf.h
setup-os400.h
setup-vms.h
share.c
share.h
sigpipe.h
slist.c
slist.h
smb.c smb: rename variable to fix shadowing warning 2017-07-09 14:42:13 +02:00
smb.h
smtp.c smtp: fix memory leak in OOM 2017-09-20 11:33:46 +02:00
smtp.h
sockaddr.h
socks_gssapi.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
socks_sspi.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
socks.c socks: fix incorrect port number in SOCKS4 error message 2017-09-18 03:07:57 -04:00
socks.h
speedcheck.c timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
speedcheck.h timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
splay.c code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
splay.h code style: remove wrong uses of multiple spaces 2017-09-12 13:54:54 +02:00
ssh.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
ssh.h
strcase.c strcase: corrected comment header for Curl_strcasecompare() 2017-08-31 11:37:36 +02:00
strcase.h
strdup.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
strdup.h
strerror.c strerror: Preserve Windows error code in some functions 2017-07-11 01:53:23 -04:00
strerror.h
strtok.c
strtok.h
strtoofft.c strtooff: fix build for systems with long long but no strtoll option 2017-08-27 19:07:38 +02:00
strtoofft.h system.h: remove all CURL_SIZEOF_* defines 2017-08-17 10:26:53 +02:00
system_win32.c
system_win32.h
telnet.c code style: use space after semicolon 2017-09-12 09:50:24 +02:00
telnet.h
tftp.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
tftp.h
timeval.c bagder/Curl_tvdiff_us: fix the math 2017-08-12 17:25:50 +02:00
timeval.h timeval: struct curltime is a struct timeval replacement 2017-07-28 15:51:25 +02:00
transfer.c conversions: fix several compiler warnings 2017-09-15 16:58:35 +02:00
transfer.h Curl_checkheaders: make it available for IMAP and SMTP too 2017-09-11 00:26:17 +02:00
url.c Set and use more necessary options when some protocols are disabled 2017-09-30 02:10:54 +02:00
url.h
urldata.h code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
version.c version: add the CURL_VERSION_MULTI_SSL feature flag 2017-08-28 22:56:49 +02:00
warnless.c CURL_SIZEOF_LONG: removed, use only SIZEOF_LONG 2017-08-17 10:27:00 +02:00
warnless.h
wildcard.c
wildcard.h
x509asn1.c x509asn1: fix implicit-fallthrough warning with GCC 7 2017-06-03 20:10:52 +02:00
x509asn1.h