mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-11-27 05:50:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
24a8359b25
curl/lib
History
Kamil Dudka 24a8359b25 http: do not leak basic auth credentials on re-used connections 
CVE-2015-3236

This partially reverts commit curl-7_39_0-237-g87c4abb

Reported-by: Tomas Tomecek, Kamil Dudka
Bug: http://curl.haxx.se/docs/adv_20150617A.html
2015-06-17 07:43:13 +02:00
..
vtls schannel: schannel_recv overhaul 2015-06-17 00:17:03 -04:00
.gitignore
amigaos.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
amigaos.h
arpa_telnet.h
asyn-ares.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
asyn-thread.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
asyn.h
base64.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
checksrc.pl checksrc: detect fopen() for text without the FOPEN_* macros 2015-06-02 08:28:10 +02:00
checksrc.whitelist checksrc: detect fopen() for text without the FOPEN_* macros 2015-06-02 08:28:10 +02:00
CMakeLists.txt cmake: install the dll file to the correct directory 2015-02-20 14:17:32 +01:00
config-amigaos.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
config-dos.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
config-mac.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
config-os400.h OS400: enable NTLM authentication 2014-12-05 18:42:39 +01:00
config-riscos.h
config-symbian.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
config-tpf.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
config-vxworks.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
config-win32.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
config-win32ce.h checksrc: Windows-specific input fixes 2015-03-30 22:39:13 +02:00
conncache.c conncache: fixed memory leak on OOM (torture tests) 2015-05-24 11:19:07 +02:00
conncache.h bundles: store no/default/pipeline/multiplex 2015-05-18 09:33:36 +02:00
connect.c CURLOPT_OPENSOCKETFUNCTION: return error at once 2015-06-09 00:22:02 +02:00
connect.h code/docs: Use correct case for IPv4 and IPv6 2014-12-27 11:31:55 +00:00
content_encoding.c
content_encoding.h
cookie.c cookie: Stop exporting any-domain cookies 2015-06-03 21:48:47 -04:00
cookie.h
curl_addrinfo.c Bug #149: Deletion of unnecessary checks before calls of the function "free" 2015-03-16 12:13:56 +01:00
curl_addrinfo.h libcurl: add UNIX domain sockets support 2014-12-04 02:52:19 +01:00
curl_base64.h
curl_config.h.cmake openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
curl_des.c openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
curl_des.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
curl_endian.c curl_endian: Fixed build when 64-bit integers are not supported (Part 2) 2015-01-16 23:01:27 +00:00
curl_endian.h endian: Added big endian read functions 2015-01-01 20:45:29 +00:00
curl_fnmatch.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
curl_fnmatch.h
curl_gethostname.c
curl_gethostname.h
curl_gssapi.c sasl_gssapi: Fixed honouring of no mutual authentication 2014-12-04 22:05:14 +00:00
curl_gssapi.h gssapi: Remove need for duplicated GSS_C_NT_HOSTBASED_SERVICE definitions 2015-01-09 20:37:47 +00:00
curl_hmac.h
curl_ldap.h
curl_md4.h curl_md4.h: Updated copyright year following recent edit 2014-12-06 19:36:27 +00:00
curl_md5.h
curl_memory.h curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
curl_memrchr.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
curl_memrchr.h
curl_multibyte.c free: instead of Curl_safefree() 2015-03-16 15:01:15 +01:00
curl_multibyte.h ldap: Renamed the CURL_LDAP_WIN definition to USE_WIN32_LDAP 2015-01-18 20:52:43 +00:00
curl_ntlm_core.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
curl_ntlm_core.h openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
curl_ntlm_msgs.c Curl_ssl_md5sum: return CURLcode 2015-03-25 08:32:12 +01:00
curl_ntlm_msgs.h sasl: Reduced the need for two sets of NTLM functions 2014-11-23 16:45:30 +00:00
curl_ntlm_wb.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
curl_ntlm_wb.h build: Fixed no NTLM support for email when CURL_DISABLE_HTTP is defined 2014-11-09 12:54:34 +00:00
curl_ntlm.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
curl_ntlm.h build: Fixed no NTLM support for email when CURL_DISABLE_HTTP is defined 2014-11-09 12:54:34 +00:00
curl_printf.h vtls: use curl_printf.h all over 2015-03-03 23:17:43 +01:00
curl_rtmp.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
curl_rtmp.h
curl_sasl_gssapi.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
curl_sasl_sspi.c sasl_sspi: Populate domain from the realm in the challenge 2015-04-26 16:12:23 +02:00
curl_sasl.c sasl_sspi: Populate domain from the realm in the challenge 2015-04-26 16:12:23 +02:00
curl_sasl.h sasl_sspi: Populate domain from the realm in the challenge 2015-04-26 16:12:23 +02:00
curl_sec.h krb5_encode: remove unused argument 2014-10-08 12:25:07 +02:00
curl_setup_once.h
curl_setup.h curl_setup: Change fopen text macros to use 't' for MSDOS 2015-06-02 14:04:00 -04:00
curl_sspi.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
curl_sspi.h sasl_sspi: Populate domain from the realm in the challenge 2015-04-26 16:12:23 +02:00
curl_threads.c free: instead of Curl_safefree() 2015-03-16 15:01:15 +01:00
curl_threads.h win32: Updated some legacy APIs to use the newer extended versions 2014-11-16 17:30:17 +00:00
curlx.h vtls: use curl_printf.h all over 2015-03-03 23:17:43 +01:00
dict.c dict: rename byte to avoid compiler shadowed declaration warning 2015-03-23 10:16:10 +01:00
dict.h
dotdot.c
dotdot.h
easy.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
easyif.h
escape.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
escape.h
file.c read_callback: move to SessionHandle from connectdata 2015-05-20 23:06:45 +02:00
file.h
fileinfo.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
fileinfo.h
firefox-db2pem.sh firefox-db2pem: fix wildcard to find Firefox default profile 2015-04-13 15:31:26 +02:00
formdata.c checksrc: detect fopen() for text without the FOPEN_* macros 2015-06-02 08:28:10 +02:00
formdata.h
ftp.c read_callback: move to SessionHandle from connectdata 2015-05-20 23:06:45 +02:00
ftp.h FTP: fix IPv6 host using link-local address 2015-01-08 22:32:37 +01:00
ftplistparser.c Bug #149: Deletion of unnecessary checks before calls of the function "free" 2015-03-16 12:13:56 +01:00
ftplistparser.h
getenv.c
getinfo.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
getinfo.h
gopher.c free: instead of Curl_safefree() 2015-03-16 15:01:15 +01:00
gopher.h
hash.c hostip: fix unintended destruction of hash table 2015-05-18 11:15:43 +02:00
hash.h hostip: fix unintended destruction of hash table 2015-05-18 11:15:43 +02:00
hmac.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
hostasyn.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
hostcheck.c openssl: remove all uses of USE_SSLEAY 2015-03-05 10:57:52 +01:00
hostcheck.h
hostip4.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
hostip6.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
hostip.c hostip: fix unintended destruction of hash table 2015-05-18 11:15:43 +02:00
hostip.h hostcache: made all host caches use structs, not pointers 2015-05-12 09:46:53 +02:00
hostsyn.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
http2.c http2: Copy data passed in Curl_http2_switched into HTTP/2 connection buffer 2015-05-25 23:07:49 +02:00
http2.h http2: set default concurrency, fix ConnectionExists for multiplex 2015-05-18 09:33:47 +02:00
http_chunks.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
http_chunks.h
http_digest.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
http_digest.h http_digest: Moved algorithm definitions to SASL module 2014-11-05 13:40:08 +00:00
http_negotiate_sspi.c http_negotiate_sspi: added missing data variable 2015-04-30 12:13:49 +02:00
http_negotiate.c Negotiate: custom service names for SPNEGO. 2015-04-28 08:29:56 +02:00
http_negotiate.h http_negotiate: Return CURLcode in Curl_input_negotiate() instead of int 2015-01-17 14:57:17 +00:00
http_proxy.c http2: separate multiplex/pipelining + cleanup memory leaks 2015-05-18 08:57:18 +02:00
http_proxy.h
http.c http: do not leak basic auth credentials on re-used connections 2015-06-17 07:43:13 +02:00
http.h http: Add some include guards for the new HTTP/2 stuff 2015-05-18 20:53:58 -04:00
idn_win32.c copyright: Updated the copyright year following recent updates 2014-12-14 22:39:27 +00:00
if2ip.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
if2ip.h IPV6: address scope != scope id 2014-12-16 13:52:06 +01:00
imap.c free: instead of Curl_safefree() 2015-03-16 15:01:15 +01:00
imap.h SASL: common state engine for imap/pop3/smtp 2015-01-20 17:33:05 +01:00
inet_ntop.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
inet_ntop.h checksrc: use space after comma 2015-03-17 13:57:37 +01:00
inet_pton.c
inet_pton.h
krb5.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
ldap.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
libcurl.def
libcurl.plist
libcurl.rc
libcurl.vers.in
llist.c
llist.h
Makefile.am INTERNALS: cat lib/README* >> INTERNALS 2015-06-09 23:57:22 +02:00
makefile.amiga
Makefile.b32 build: update depedency versions, urls, example makefiles 2015-04-30 08:29:00 +02:00
makefile.dj
Makefile.inc bundles: merged into conncache.c 2015-05-12 23:21:33 +02:00
Makefile.m32 build: bump version in default nghttp2 paths 2015-05-19 07:42:16 +02:00
Makefile.netware build: update depedency versions, urls, example makefiles 2015-04-30 08:29:00 +02:00
Makefile.vc6 build: removed bundles.c from make files 2015-05-14 14:55:48 +02:00
Makefile.vxworks build: updated dependencies in makefiles. 2014-12-05 14:54:25 +01:00
Makefile.Watcom build: update depedency versions, urls, example makefiles 2015-04-30 08:29:00 +02:00
md4.c MD(4|5): make the MD4_* and MD5_* functions static 2015-02-06 14:26:32 +01:00
md5.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
memdebug.c curl_setup: Add macros for FOPEN_READTEXT, FOPEN_WRITETEXT 2015-06-01 03:21:23 -04:00
memdebug.h checksrc: use space after comma 2015-03-17 13:57:37 +01:00
mk-ca-bundle.pl mk-ca-bundle bugfix: Don't report SHA1 numbers with "-q". 2015-03-11 14:47:41 +01:00
mk-ca-bundle.vbs mk-ca-bundle.vbs: update copyright year. 2014-11-18 13:47:13 +01:00
mprintf.c
multi.c urldata: store POST size in state.infilesize too 2015-06-14 23:31:01 +02:00
multihandle.h http2: set default concurrency, fix ConnectionExists for multiplex 2015-05-18 09:33:47 +02:00
multiif.h http2: set default concurrency, fix ConnectionExists for multiplex 2015-05-18 09:33:47 +02:00
netrc.c curl_setup: Add macros for FOPEN_READTEXT, FOPEN_WRITETEXT 2015-06-01 03:21:23 -04:00
netrc.h
non-ascii.c non-ascii: Reduce variable usage 2014-12-20 14:43:02 +00:00
non-ascii.h
nonblock.c
nonblock.h
nwlib.c Bug #149: Deletion of unnecessary checks before calls of the function "free" 2015-03-16 12:13:56 +01:00
nwos.c
objnames-test08.sh
objnames-test10.sh
objnames.inc
openldap.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
parsedate.c parsedate.c: Fixed compilation warning 2014-12-10 11:38:38 +00:00
parsedate.h
pingpong.c Bug #149: Deletion of unnecessary checks before calls of the function "free" 2015-03-16 12:13:56 +01:00
pingpong.h
pipeline.c pipeline: switch some code over to functions 2015-05-18 09:33:47 +02:00
pipeline.h pipeline: switch some code over to functions 2015-05-18 09:33:47 +02:00
pop3.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
pop3.h SASL: common state engine for imap/pop3/smtp 2015-01-20 17:33:05 +01:00
progress.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
progress.h
rawstr.c
rawstr.h
rtsp.c rtsp_do: fix DEAD CODE 2015-06-15 09:05:07 +02:00
rtsp.h
security.c security:choose_mech fix DEAD CODE warning 2015-06-15 09:02:46 +02:00
select.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
select.h
sendf.c CURLMOPT_PIPELINE: bit 1 is for multiplexing 2015-05-18 08:57:18 +02:00
sendf.h Curl_client_write() & al.: chop long data, convert data only once. 2014-12-09 15:43:51 +01:00
setup-os400.h vtls: remove QsoSSL 2014-10-13 16:33:47 +02:00
setup-vms.h checksrc: use space after comma 2015-03-17 13:57:37 +01:00
share.c share_init: fix OOM crash 2015-05-22 16:26:14 +02:00
share.h hostcache: made all host caches use structs, not pointers 2015-05-12 09:46:53 +02:00
sigpipe.h
slist.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
slist.h
smb.c SMB: rangecheck values read off incoming packet 2015-06-17 07:43:13 +02:00
smb.h smb: Use the connection's upload buffer 2014-12-30 13:10:30 +00:00
smtp.c free: instead of Curl_safefree() 2015-03-16 15:01:15 +01:00
smtp.h SASL: common state engine for imap/pop3/smtp 2015-01-20 17:33:05 +01:00
sockaddr.h
socks_gssapi.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
socks_sspi.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
socks.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
socks.h
speedcheck.c
speedcheck.h
splay.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
splay.h
ssh.c read_callback: move to SessionHandle from connectdata 2015-05-20 23:06:45 +02:00
ssh.h checksrc: use space after comma 2015-03-17 13:57:37 +01:00
strdup.c checksrc: use space after comma 2015-03-17 13:57:37 +01:00
strdup.h curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds 2014-11-05 08:05:14 +01:00
strequal.c
strequal.h
strerror.c strerror: Change SEC_E_ILLEGAL_MESSAGE description 2015-05-22 02:30:38 -04:00
strerror.h
strtok.c
strtok.h
strtoofft.c
strtoofft.h copyright: Updated the copyright year following recent updates 2014-12-14 22:39:27 +00:00
telnet.c telnet: Fix read-callback change for Windows builds 2015-05-21 23:26:32 -04:00
telnet.h
tftp.c curl_memory: make curl_memory.h the second-last header file loaded 2015-03-24 23:47:01 +01:00
tftp.h
timeval.c timeval: typecast for better type (on Amiga) 2015-01-20 08:53:14 +01:00
timeval.h
transfer.c debug: remove http2 debug leftovers 2015-06-10 23:16:37 +02:00
transfer.h read_callback: move to SessionHandle from connectdata 2015-05-20 23:06:45 +02:00
url.c parse_proxy: switch off tunneling if non-HTTP proxy 2015-05-22 16:19:53 +02:00
url.h Negotiate: custom service names for SPNEGO. 2015-04-28 08:29:56 +02:00
urldata.h schannel: schannel_recv overhaul 2015-06-17 00:17:03 -04:00
version.c mprintf.h: remove #ifdef CURLDEBUG 2015-03-03 12:36:18 +01:00
warnless.c
warnless.h
wildcard.c Bug #149: Deletion of unnecessary checks before calls of the function "free" 2015-03-16 12:13:56 +01:00
wildcard.h
x509asn1.c cyassl: Implement public key pinning 2015-04-22 17:07:19 -04:00
x509asn1.h cyassl: Implement public key pinning 2015-04-22 17:07:19 -04:00