summaryrefslogtreecommitdiff
path: root/lib/formdata.c
Commit message (Collapse)AuthorAgeFilesLines
* form/mime: field names are not allowed to contain zero-valued bytes.Patrick Monnerat2017-09-221-5/+32
| | | | | Also suppress length argument of curl_mime_name() (names are always zero-terminated).
* code style: use spaces around plusesDaniel Stenberg2017-09-111-2/+2
|
* code style: use spaces around equals signsDaniel Stenberg2017-09-111-3/+3
|
* mime: drop internal FILE * support.Patrick Monnerat2017-09-061-2/+10
| | | | | | | | - The part kind MIMEKIND_FILE and associated code are suppressed. - Seek data origin offset not used anymore: suppressed. - MIMEKIND_NAMEDFILE renamed MIMEKIND_FILE; associated fields/functions renamed accordingly. - Curl_getformdata() processes stdin via a callback.
* mime: unified to use the typedef'd mime structs everywhereDaniel Stenberg2017-09-051-5/+5
| | | | ... and slightly edited to follow our code style better.
* mime: remove support "-" stdin pseudo-file name in curl_mime_filedata().Patrick Monnerat2017-09-031-1/+4
| | | | | | | | | | | | | | | This feature is badly supported in Windows: as a replacement, a caller has to use curl_mime_data_cb() with fread, fseek and possibly fclose callbacks to process opened files. The cli tool and documentation are updated accordingly. The feature is however kept internally for form API compatibility, with the known caveats it always had. As a side effect, stdin size is not determined by the cli tool even if possible and this results in a chunked transfer encoding. Test 173 is updated accordingly.
* mime: new MIME API.Patrick Monnerat2017-09-021-739/+106
| | | | | | | Available in HTTP, SMTP and IMAP. Deprecates the FORM API. See CURLOPT_MIMEPOST. Lib code and associated documentation.
* formdata: fix -Wcomma warningMarcel Raad2017-05-111-1/+1
| | | | | | | clang 5.0 complains: possible misuse of comma operator here [-Wcomma] Change the comma to a semicolon to fix that.
* formboundary: convert assert into run-time checkDaniel Stenberg2017-05-091-1/+2
| | | | | | | | | ... to really make sure the boundary fits in the target buffer. Fixes unused parameter 'buflen' warning. Reported-by: Michael Kaufmann Bug: https://github.com/curl/curl/pull/1468#issuecomment-300078754
* rand: treat fake entropy the same regardless of endiannessJay Satiro2017-05-081-24/+15
| | | | | | | | | | | | | | | | | When the random seed is purposely made predictable for testing purposes by using the CURL_ENTROPY environment variable, process that data in an endian agnostic way so the the initial random seed is the same regardless of endianness. - Change Curl_rand to write to a char array instead of int array. - Add Curl_rand_hex to write random hex characters to a buffer. Fixes #1315 Closes #1468 Co-authored-by: Daniel Stenberg Reported-by: Michael Kaufmann
* lib: remove unused codeMarcel Raad2017-04-261-3/+0
| | | | | | | | This fixes the following clang warnings: macro is not used [-Wunused-macros] will never be executed [-Wunreachable-code] Closes https://github.com/curl/curl/pull/1448
* Improve code readbilitySylvestre Ledru2017-03-131-58/+55
| | | | | | ... by removing the else branch after a return, break or continue. Closes #1310
* build: fix gcc7 implicit fallthrough warningsAlexis La Goutte2017-03-031-0/+1
| | | | | | | Mark intended fallthroughs with /* FALLTHROUGH */ so that gcc will know it's expected and won't warn on [-Wimplicit-fallthrough=]. Closes https://github.com/curl/curl/pull/1297
* formdata: check for EOF when reading from stdinDaniel Stenberg2017-02-231-2/+2
| | | | | | Reported-by: shachaf@users.noreply.github.com Fixes #1281
* formdata: use NULL, not 0, when returning pointersDaniel Stenberg2016-12-251-1/+1
|
* checksrc: warn for assignments within if() expressionsDaniel Stenberg2016-12-141-6/+6
| | | | | ... they're already frowned upon in our source code style guide, this now enforces the rule harder.
* checksrc: stricter no-space-before-paren enforcementDaniel Stenberg2016-12-131-2/+2
| | | | In order to make the code style more uniform everywhere
* checksrc: move open braces to comply with function declaration styleDaniel Stenberg2016-11-241-1/+2
|
* checksrc: code style: use 'char *name' styleDaniel Stenberg2016-11-241-9/+9
|
* Curl_rand: fixed and moved to rand.cDaniel Stenberg2016-11-141-2/+7
| | | | | | | | | | | | | Now Curl_rand() is made to fail if it cannot get the necessary random level. Changed the proto of Curl_rand() slightly to provide a number of ints at once. Moved out from vtls, since it isn't a TLS function and vtls provides Curl_ssl_random() for this to use. Discussion: https://curl.haxx.se/mail/lib-2016-11/0119.html
* strcasecompare: is the new name for strequal()Daniel Stenberg2016-10-311-6/+6
| | | | | | | ... to make it less likely that we forget that the function actually does case insentive compares. Also replaced several invokes of the function with a plain strcmp when case sensitivity is not an issue (like comparing with "-").
* formpost: avoid silent snprintf() truncationDaniel Stenberg2016-10-081-10/+25
| | | | | | | | | | The previous use of snprintf() could make libcurl silently truncate some input data and not report that back on overly large input, which could make data get sent over the network in a bad format. Example: $ curl --form 'a=b' -H "Content-Type: $(perl -e 'print "A"x4100')"
* formpost: trying to attach a directory no longer crashesDaniel Stenberg2016-10-041-7/+8
| | | | | | | | The error path would previously add a freed entry to the linked list. Reported-by: Toby Peterson Fixes #1053
* internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg2016-06-221-4/+4
|
* lib: include curl_printf.h as one of the last headersDaniel Stenberg2016-04-291-2/+1
| | | | | | | | | | | | | | | | | | | | curl_printf.h defines printf to curl_mprintf, etc. This can cause problems with external headers which may use __attribute__((format(printf, ...))) markers etc. To avoid that they cause problems with system includes, we include curl_printf.h after any system headers. That makes the three last headers to always be, and we keep them in this order: curl_printf.h curl_memory.h memdebug.h None of them include system headers, they all do funny #defines. Reported-by: David Benjamin Fixes #743
* code: style updatesDaniel Stenberg2016-04-031-5/+5
|
* formdata: use appropriate fopen() macrosDaniel Stenberg2016-04-031-3/+3
|
* formdata.c: Fixed compilation warningSteve Holme2016-03-181-1/+1
| | | | | | | | | | | | | | | formdata.c:390: warning: cast from pointer to integer of different size Introduced in commit ca5f9341ef this happens because a char*, which is 32-bits wide in 32-bit land, is being cast to a curl_off_t which is 64-bits wide where 64-bit integers are supported by the compiler. This doesn't happen in 64-bit land as a pointer is the same size as a curl_off_t. This fix doesn't address the fact that a 64-bit value cannot be used for CURLFORM_CONTENTLEN when set in a form array and compiled on a 32-bit platforms, it does at least suppress the compilation warning.
* formpost: fix memory leaks in AddFormData error branchesDaniel Stenberg2016-02-291-11/+25
| | | | | Reported-by: Dmitry-Me Fixes #688
* URLs: change all http:// URLs to https://Daniel Stenberg2016-02-031-1/+1
|
* formdata: Check if length is too large for memoryJay Satiro2015-12-071-4/+11
| | | | | | | | | | - If the size of the length type (curl_off_t) is greater than the size of the size_t type then check before allocating memory to make sure the value of length will fit in a size_t without overflow. If it doesn't then return CURLE_BAD_FUNCTION_ARGUMENT. Bug: https://github.com/bagder/curl/issues/425#issuecomment-154518679 Reported-by: Steve Holme
* formadd: support >2GB files on windowsDaniel Stenberg2015-11-021-17/+24
| | | | Closes #425
* curl.h: s/HTTPPOST_/CURL_HTTPOST_Daniel Stenberg2015-10-311-0/+8
| | | | | | | | | Fixes a name space pollution at the cost of programs using one of these defines will no longer compile. However, the vast majority of libcurl programs that do multipart formposts use curl_formadd() to build this list. Closes #506
* build: fix failures with -Wcast-align and -WerrorTatsuhiro Tsujikawa2015-09-261-1/+1
| | | | Closes #457
* checksrc: detect fopen() for text without the FOPEN_* macrosDaniel Stenberg2015-06-021-2/+2
| | | | | | | | Follow-up to e8423f9ce150 with discussionis in https://github.com/bagder/curl/pull/258 This check scans for fopen() with a mode string without 'b' present, as it may indicate that an FOPEN_* define should rather be used.
* curl_memory: make curl_memory.h the second-last header file loadedDan Fandrich2015-03-241-2/+2
| | | | | | | This header file must be included after all header files except memdebug.h, as it does similar memory function redefinitions and can be similarly affected by conflicting definitions in system or dependent library headers.
* free: instead of Curl_safefree()Daniel Stenberg2015-03-161-12/+12
| | | | | | | | | | | | Since we just started make use of free(NULL) in order to simplify code, this change takes it a step further and: - converts lots of Curl_safefree() calls to good old free() - makes Curl_safefree() not check the pointer before free() The (new) rule of thumb is: if you really want a function call that frees a pointer and then assigns it to NULL, then use Curl_safefree(). But we will prefer just using free() from now on.
* Bug #149: Deletion of unnecessary checks before a few calls of cURL functionsMarkus Elfring2015-03-161-2/+1
| | | | | | | | | | | | The following functions return immediately if a null pointer was passed. * Curl_cookie_cleanup * curl_formfree It is therefore not needed that a function caller repeats a corresponding check. This issue was fixed by using the software Coccinelle 1.0.0-rc24. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
* Bug #149: Deletion of unnecessary checks before calls of the function "free"Markus Elfring2015-03-161-7/+5
| | | | | | | | | | | The function "free" is documented in the way that no action shall occur for a passed null pointer. It is therefore not needed that a function caller repeats a corresponding check. http://stackoverflow.com/questions/18775608/free-a-null-pointer-anyway-or-check-first This issue was fixed by using the software Coccinelle 1.0.0-rc24. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
* mprintf.h: remove #ifdef CURLDEBUGDaniel Stenberg2015-03-031-4/+2
| | | | | ... and as a consequence, introduce curl_printf.h with that re-define magic instead and make all libcurl code use that instead.
* curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of boundsDaniel Stenberg2014-11-051-43/+9
| | | | | | | | | | | | | When duplicating a handle, the data to post was duplicated using strdup() when it could be binary and contain zeroes and it was not even zero terminated! This caused read out of bounds crashes/segfaults. Since the lib/strdup.c file no longer is easily shared with the curl tool with this change, it now uses its own version instead. Bug: http://curl.haxx.se/docs/adv_20141105.html CVE: CVE-2014-3707 Reported-By: Symeon Paraschoudis
* code cleanup: we prefer 'CURLcode result'Daniel Stenberg2014-10-241-8/+6
| | | | | | | | | | | | | | ... for the local variable name in functions holding the return code. Using the same name universally makes code easier to read and follow. Also, unify code for checking for CURLcode errors with: if(result) or if(!result) instead of if(result == CURLE_OK), if(CURLE_OK == result) or if(result != CURLE_OK)
* FormAdd: precaution against memdup() of NULL pointerDaniel Stenberg2014-10-081-1/+1
| | | | | | | | Coverity CID 252518. This function is in general far too complicated for its own good and really should be broken down into several smaller funcitons instead - but I'm adding this protection here now since it seems there's a risk the code flow can end up here and dereference a NULL pointer.
* formdata: removed unnecessary USE_SSLEAY useDaniel Stenberg2014-09-131-5/+1
|
* formdata: Must use Curl_safefree instead of freeDan Fandrich2014-02-091-1/+1
|
* formdata: Fixed memory leak on OOM conditionDan Fandrich2014-02-081-1/+3
|
* formpost: use semicolon in multipart/mixedDaniel Stenberg2014-02-071-2/+2
| | | | | | | | | | | Not comma, which is an inconsistency and a mistake probably inherited from the examples section of RFC1867. This bug has been present since the day curl started to support multipart formposts, back in the 90s. Reported-by: Rob Davies Bug: http://curl.haxx.se/bug/view.cgi?id=1333
* vtls: renamed sslgen.[ch] to vtls.[ch]Daniel Stenberg2013-12-201-1/+1
|
* vtls: created subdir, moved sslgen.[ch] there, updated all include linesDaniel Stenberg2013-12-201-1/+1
|
* formadd: wrong pointer for file name when CURLFORM_BUFFERPTR usedDaniel Stenberg2013-08-041-5/+7
| | | | | | | | | | | | | | | The internal function that's used to detect known file extensions for the default Content-Type got the the wrong pointer passed in when CURLFORM_BUFFER + CURLFORM_BUFFERPTR were used. This had the effect that strlen() would be used which could lead to an out-of-bounds read (and thus segfault). In most cases it would only lead to it not finding or using the correct default content-type. It also showed that test 554 and test 587 were testing for the previous/wrong behavior and now they're updated as well. Bug: http://curl.haxx.se/bug/view.cgi?id=1262 Reported-by: Konstantin Isakov
View Lorry Controller Status