Go to file
Tobias Stoeckmann 94b03664de mprintf: Fix dollar string handling
Verify that specified parameters are in range. If parameters are too
large, fail early on and avoid out of boundary accesses.

Also do not read behind boundaries of illegal format strings.

These are defensive measures since it is expected that format strings
are well-formed. Format strings should not be modifiable by user
input due to possible generic format string attacks.

Closes https://github.com/curl/curl/pull/5722
2020-07-27 03:42:59 -04:00
.github CI/macos: set minimum macOS version 2020-07-26 16:31:33 +02:00
CMake content_encoding: add zstd decoding support 2020-07-12 18:11:37 +02:00
docs travis: update quiche builds for new boringssl layout 2020-07-18 12:35:21 +02:00
include curl.h: update CURLINFO_LASTONE 2020-07-23 02:44:53 -04:00
lib mprintf: Fix dollar string handling 2020-07-27 03:42:59 -04:00
m4 configure: allow disabling warnings 2020-07-17 09:35:16 +02:00
packages windows: add unicode to feature list 2020-07-14 08:30:17 +00:00
plan9 copyright: fix out-of-date copyright ranges and missing headers 2020-03-24 15:05:59 +01:00
projects projects: Add crypt32.lib to dependencies for all OpenSSL configs 2020-06-04 03:37:55 -04:00
scripts travis: update quiche builds for new boringssl layout 2020-07-18 12:35:21 +02:00
src util: silence conversion warnings 2020-07-19 10:34:58 +02:00
tests util: silence conversion warnings 2020-07-19 10:34:58 +02:00
winbuild curl_multibyte: add to curlx 2020-05-14 18:13:27 +02:00
.azure-pipelines.yml CI/azure: unconditionally enable warnings-as-errors with autotools 2020-07-22 20:08:23 +02:00
.cirrus.yml cirrus-ci: upgrade 11-STABLE to 11.4 2020-07-11 02:42:54 -04:00
.dcignore .dcignore: ignore tests and docs directories 2020-06-27 00:07:37 +02:00
.dir-locals.el copyright: fix out-of-date copyright ranges and missing headers 2020-03-24 15:05:59 +01:00
.gitattributes .gitattributes: make tabs in indentation a visible error 2018-12-06 20:21:17 +01:00
.gitignore .gitignore: add directory containing the stats repo 2020-06-05 19:54:34 +02:00
.lgtm.yml copyright: fix out-of-date copyright ranges and missing headers 2020-03-24 15:05:59 +01:00
.mailmap mailmap: Nicolas Sterchele 2020-06-12 13:41:52 +02:00
.travis.yml travis: update quiche builds for new boringssl layout 2020-07-18 12:35:21 +02:00
acinclude.m4 build: fixed build for systems with select() in unistd.h 2020-03-31 10:59:06 +02:00
appveyor.yml appveyor: collect libcurl.dll variants with prefix or suffix 2020-07-13 21:00:39 +02:00
buildconf buildconf: remove -print from the find command that removes files 2020-06-10 23:40:00 +02:00
buildconf.bat copyrights: update all copyright notices to 2019 on files changed this year 2019-11-02 23:15:56 +01:00
CHANGES
CMakeLists.txt CMake: fix test for warning suppressions 2020-07-23 16:13:35 +02:00
configure.ac content_encoding: add zstd decoding support 2020-07-12 18:11:37 +02:00
COPYING COPYING: it's 2020! 2020-01-03 15:12:46 +01:00
curl-config.in copyright: updated year ranges out of sync 2020-05-24 00:02:33 +02:00
GIT-INFO
libcurl.pc.in libcurl.pc: Merge Libs.private into Libs for static-only builds 2020-05-12 08:53:12 +02:00
MacOSX-Framework copyright: fix out-of-date copyright ranges and missing headers 2020-03-24 15:05:59 +01:00
Makefile.am CMake: add HTTP/3 support (ngtcp2+nghttp3, quiche) 2020-05-10 23:36:41 +02:00
Makefile.dist build: remove the Borland specific makefiles 2018-06-02 11:23:40 +02:00
maketgz maketgz: delete .bak files, fix indentation 2018-06-15 23:28:34 +00:00
README README: mention that the docs is in docs/ 2020-01-27 13:06:45 +01:00
README.md README.md: add Azure DevOps Pipelines build status badge 2020-03-03 17:11:26 +01:00
RELEASE-NOTES RELEASE-NOTES: synced 2020-07-26 12:24:08 +02:00
SECURITY.md SECURITY.md: minor rephrase 2020-03-30 08:53:25 +02:00

curl logo

CII Best Practices Coverity passed Travis-CI Build Status AppVeyor Build Status Azure DevOps Build Status Cirrus Build Status Backers on Open Collective Sponsors on Open Collective Language Grade: C/C++ Codacy Badge Fuzzing Status

Curl is a command-line tool for transferring data specified with URL syntax. Find out how to use curl by reading the curl.1 man page or the MANUAL document. Find out how to install Curl by reading the INSTALL document.

libcurl is the library curl is using to do its job. It is readily available to be used by your software. Read the libcurl.3 man page to learn how!

You can find answers to the most frequent questions we get in the FAQ document.

Study the COPYING file for distribution terms and similar. If you distribute curl binaries or other binaries that involve libcurl, you might enjoy the LICENSE-MIXING document.

Contact

If you have problems, questions, ideas or suggestions, please contact us by posting to a suitable mailing list.

All contributors to the project are listed in the THANKS document.

Website

Visit the curl web site for the latest news and downloads.

Git

To download the very latest source from the Git server do this:

git clone https://github.com/curl/curl.git

(you'll get a directory named curl created, filled with the source code)

Security problems

Report suspected security problems via our HackerOne page and not in public!

Notice

Curl contains pieces of source code that is Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan. This notice is included here to comply with the distribution terms.

Backers

Thank you to all our backers! 🙏 [Become a backer]

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]