Yang Tse [Fri, 5 Mar 2010 03:15:19 +0000 (03:15 +0000)]
Constantine Sapuntzakis detected and fixed a double free in builds done
with threaded resolver enabled (Windows default configuration) that would
get triggered when a curl handle is closed while doing DNS resolution.
Daniel Stenberg [Tue, 2 Mar 2010 22:02:56 +0000 (22:02 +0000)]
- [Daniel Johnson] I've been trying to build libcurl with clang on Darwin and
ran into some issues with the GSSAPI tests in configure.ac. The tests first
try to determine the include dirs and libs and set CPPFLAGS and LIBS
accordingly. It then checks for the headers and finally sets LIBS a second
time, causing the libs to be included twice. The first setting of LIBS seems
redundant and should be left out, since the first part is otherwise just
about finding headers.
My second issue is that 'krb5-config --libs gssapi' on Darwin is less than
useless and returns junk that, while it happens to work with gcc, causes
clang to choke. For example, --libs returns $CFLAGS along with the libs,
which is really retarded. Simply setting 'LIBS="$LIBS -lgssapi_krb5
-lresolv"' on Darwin is sufficient.
Daniel Stenberg [Tue, 2 Mar 2010 21:20:22 +0000 (21:20 +0000)]
- Based on patch provided by Jacob Moshenko, the transfer logic now properly
makes sure that when using sub-second timeouts, there's no final bad 1000ms
wait. Previously, a sub-second timeout would often make the elapsed time end
up the time rounded up to the nearest second (e.g. 1s for 200ms timeout)
Daniel Stenberg [Tue, 2 Mar 2010 13:41:18 +0000 (13:41 +0000)]
- Andrei Benea filed bug report #2956698 and pointed out that the
CURLOPT_CERTINFO feature leaked memory due to a missing OpenSSL function
call. He provided the patch to fix it too.
Daniel Stenberg [Tue, 2 Mar 2010 13:34:57 +0000 (13:34 +0000)]
- Markus Duft pointed out in bug #2961796 that even though Interix has a
poll() function it doesn't quite work the way we want it so we must disable
it, and he also provided a patch for it.
Daniel Stenberg [Tue, 2 Mar 2010 13:26:23 +0000 (13:26 +0000)]
- Made the pingpong timeout code properly deal with the response timeout AND
the global timeout if set. Also, as was reported in the bug report #2956437
by Ryan Chan, the time stamp to use as basis for the per command timeout was
not set properly in the DONE phase for FTP (and not for SMTP) so I fixed
that just now. This was a regression compared to 7.19.7 due to the
conversion of FTP code over to the generic pingpong concepts.
Daniel Stenberg [Mon, 1 Mar 2010 21:59:07 +0000 (21:59 +0000)]
- Wesley Miaw reported bug #2958179 which identified a case of looping during
OpenSSL based SSL handshaking even though the multi interface was used and
there was no good reason for it.
Yang Tse [Thu, 25 Feb 2010 06:59:04 +0000 (06:59 +0000)]
Fixed bug report #2958074 indicating
(http://curl.haxx.se/bug/view.cgi?id=2958074) that curl on Windows with
option --trace-time did not use local time when timestamping trace lines.
This could also happen on other systems depending on time souurce.
Yang Tse [Mon, 22 Feb 2010 18:56:29 +0000 (18:56 +0000)]
convert Curl_ultous() and Curl_ultouc() functions to curlx_ultous() and
curlx_ultouc(), exposing them through curlx.h to allow proper code reuse
later in our test harness.
Patrick Monnerat [Mon, 22 Feb 2010 12:41:02 +0000 (12:41 +0000)]
- Proper handling of STARTTLS on SMTP, taking CURLUSESSL_TRY into account.
- SMTP falls back to RFC821 HELO when EHLO fails (and SSL is not required).
- Use of true local host name (i.e.: via gethostname()) when available, as default argument to SMTP HELO/EHLO.
- Test case 804 for HELO fallback.
Daniel Stenberg [Sat, 20 Feb 2010 22:29:59 +0000 (22:29 +0000)]
- Fixed the SMTP compliance by making sure RCPT TO addresses are specified
properly in angle brackets. Recipients provided with CURLOPT_MAIL_RCPT now
get angle bracket wrapping automatically by libcurl unless the recipient
starts with an angle bracket as then the app is assumed to deal with that
properly on its own.
Daniel Stenberg [Sat, 20 Feb 2010 21:56:48 +0000 (21:56 +0000)]
- I made the SMTP code expect a 250 response back from the server after the
full DATA has been sent, and I modified the test SMTP server to also send
that response. As usual, the DONE operation that is made after a completed
transfer is still not doable in a non-blocking way so this waiting for 250
is unfortunately made blockingly.
Daniel Stenberg [Sun, 14 Feb 2010 22:51:43 +0000 (22:51 +0000)]
75. NTLM authentication involving unicode user name or password.
http://curl.haxx.se/mail/lib-2009-10/0024.html
http://curl.haxx.se/bug/view.cgi?id=2944325
Daniel Stenberg [Fri, 12 Feb 2010 22:23:46 +0000 (22:23 +0000)]
- Jack Zhang reported a problem with SMTP: we wrongly used multiple addresses
in the same RCPT TO line, when they should be sent in separate single
commands. I updated test case 802 to verify this.
- I also fixed a bad use of my_setopt_str() of CURLOPT_MAIL_RCPT in the curl
tool which made it try to output it as string for the --libcurl feature
which could lead to crashes.
Daniel Stenberg [Tue, 9 Feb 2010 09:35:48 +0000 (09:35 +0000)]
- When downloading compressed content over HTTP and the app as asked libcurl
to automatically uncompress it with the CURLOPT_ENCODING option, libcurl
could wrongly provide the callback with more data than what the maximum
documented amount. An application could thus get tricked into badness if the
maximum limit was trusted to be enforced by libcurl itself (as it is
documented).
This is further detailed and explained in the libcurl security advisory 20100209 at
Yang Tse [Thu, 4 Feb 2010 14:41:01 +0000 (14:41 +0000)]
Modified test case 557 to additionally verify libcurl's internal curl_m*printf()
functions formatting functionality when handling signed and unsigned shorts.