summaryrefslogtreecommitdiff
path: root/lib/tftp.c
Commit message (Collapse)AuthorAgeFilesLines
* tftp: use the current blksize for recvfrom()Daniel Stenberg2019-05-201-1/+1
| | | | | | bug: https://curl.haxx.se/docs/CVE-2019-5436.html Reported-by: l00p3r on hackerone CVE-2019-5436
* urldata: simplify bytecountersDaniel Stenberg2019-03-011-2/+2
| | | | | | | | | | | | | - no need to have them protocol specific - no need to set pointers to them with the Curl_setup_transfer() call - make Curl_setup_transfer() operate on a transfer pointer, not connection - switch some counters from long to the more proper curl_off_t type Closes #3627
* strerror: make the strerror function use local buffersDaniel Stenberg2019-02-261-10/+16
| | | | | | | | | | | | | | | | Instead of using a fixed 256 byte buffer in the connectdata struct. In my build, this reduces the size of the connectdata struct by 11.8%, from 2160 to 1904 bytes with no functionality or performance loss. This also fixes a bug in schannel's Curl_verify_certificate where it called Curl_sspi_strerror when it should have called Curl_strerror for string from GetLastError. the only effect would have been no text or the wrong text being shown for the error. Co-authored-by: Jay Satiro Closes #3612
* snprintf: renamed and we now only use msnprintf()Daniel Stenberg2018-11-231-7/+7
| | | | | | | | | | | The function does not return the same value as snprintf() normally does, so readers may be mislead into thinking the code works differently than it actually does. A different function name makes this easier to detect. Reported-by: Tomas Hoger Assisted-by: Daniel Gustafsson Fixes #3296 Closes #3297
* url: use the URL API internally as wellDaniel Stenberg2018-09-221-2/+2
| | | | | | ... to make it a truly unified URL parser. Closes #3017
* all: s/int/size_t cleanupDaniel Stenberg2018-09-011-3/+3
| | | | | | Assisted-by: Rikard Falkeborn Closes #2922
* cppcheck: fix warningsMarian Klymov2018-06-111-9/+7
| | | | | | | | | | | | | - Get rid of variable that was generating false positive warning (unitialized) - Fix issues in tests - Reduce scope of several variables all over etc Closes #2631
* tftp: make sure error is zero terminated before printfing itDaniel Stenberg2018-05-221-1/+4
|
* curl_setup: provide a CURL_SA_FAMILY_T type if none existsDaniel Stenberg2018-04-071-2/+2
| | | | | | | ... and use this type instead of 'sa_family_t' in the code since several platforms don't have it. Closes #2463
* build: add picky compiler warning flags for gcc 6 and 7Eric Gallager2018-04-071-1/+1
|
* Curl_timeleft: change return type to timediff_tDaniel Stenberg2017-10-281-1/+1
| | | | | | | | returning 'time_t' is problematic when that type is unsigned and we return values less than zero to signal "already expired", used in several places in the code. Closes #2021
* time: rename Curl_tvnow to Curl_nowDaniel Stenberg2017-10-251-1/+1
| | | | | | | | | | ... since the 'tv' stood for timeval and this function does not return a timeval struct anymore. Also, cleaned up the Curl_timediff*() functions to avoid typecasts and clean up the descriptive comments. Closes #2011
* code style: use spaces around plusesDaniel Stenberg2017-09-111-21/+21
|
* code style: use spaces around equals signsDaniel Stenberg2017-09-111-8/+8
|
* tftp: fix memory leak on too long filenameEven Rouault2017-08-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes $ valgrind --leak-check=full ~/install-curl-git/bin/curl tftp://localhost/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz ==9752== Memcheck, a memory error detector ==9752== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==9752== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info ==9752== Command: /home/even/install-curl-git/bin/curl tftp://localhost/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz ==9752== curl: (71) TFTP file name too long ==9752== ==9752== HEAP SUMMARY: ==9752== 505 bytes in 1 blocks are definitely lost in loss record 11 of 11 ==9752== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==9752== by 0x4E61CED: Curl_urldecode (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) ==9752== by 0x4E75868: tftp_state_machine (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) ==9752== by 0x4E761B6: tftp_do (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) ==9752== by 0x4E711B6: multi_runsingle (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) ==9752== by 0x4E71D00: curl_multi_perform (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) ==9752== by 0x4E6950D: curl_easy_perform (in /home/even/install-curl-git/lib/libcurl.so.4.4.0) ==9752== by 0x40E0B7: operate_do (in /home/even/install-curl-git/bin/curl) ==9752== by 0x40E849: operate (in /home/even/install-curl-git/bin/curl) ==9752== by 0x402693: main (in /home/even/install-curl-git/bin/curl) Fixes https://oss-fuzz.com/v2/testcase-detail/5232311106797568 Credit to OSS Fuzz Closes #1808
* tftp: reject file name lengths that don't fitDaniel Stenberg2017-08-071-1/+6
| | | | | | | | | | | | ... and thereby avoid telling send() to send off more bytes than the size of the buffer! CVE-2017-1000100 Bug: https://curl.haxx.se/docs/adv_20170809B.html Reported-by: Even Rouault Credit to OSS-Fuzz for the discovery
* libcurl: Stop using error codes defined under CURL_NO_OLDIESDwarakanath Yadavalli2017-07-311-1/+1
| | | | | Fixes https://github.com/curl/curl/issues/1688 Closes https://github.com/curl/curl/pull/1712
* handler: refactor connection checkingMax Dymond2017-06-301-0/+1
| | | | | | Add a new type of callback to Curl_handler which performs checks on the connection. Alter RTSP so that it uses this callback to do its own check on connection health.
* tftp: silence bad-function-cast warningMarcel Raad2017-05-071-2/+6
| | | | | The cases this warns about are handled elsewhere, so just use an intermediate variable to silence the warning.
* Improve code readbilitySylvestre Ledru2017-03-131-3/+3
| | | | | | ... by removing the else branch after a return, break or continue. Closes #1310
* checksrc: stricter no-space-before-paren enforcementDaniel Stenberg2016-12-131-2/+2
| | | | In order to make the code style more uniform everywhere
* checksrc: code style: use 'char *name' styleDaniel Stenberg2016-11-241-1/+1
|
* lib: fix compiler warnings after de4de4e3c7cMarcel Raad2016-11-181-1/+1
| | | | | | | | | Visual C++ now complains about implicitly casting time_t (64-bit) to long (32-bit). Fix this by changing some variables from long to time_t, or explicitly casting to long where the public interface would be affected. Closes #1131
* strcasecompare: all case insensitive string compares ignore locale nowDaniel Stenberg2016-10-311-1/+1
| | | | | We had some confusions on when each function was used. We should not act differently on different locales anyway.
* escape: avoid using curl_easy_unescape() internallyDaniel Stenberg2016-10-311-4/+5
| | | | Since the internal Curl_urldecode() function has a better API.
* select: switch to macros in uppercaseDaniel Stenberg2016-10-181-1/+1
| | | | | | | | | | Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
* TFTP: Fix upload problem with piped inputSerj Kalichev2016-08-041-3/+15
| | | | | | | | When input stream for curl is stdin and input stream is not a file but generated by a script then curl can truncate data transfer to arbitrary size since a partial packet is treated as end of transfer by TFTP. Fixes #857
* internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg2016-06-221-10/+10
|
* lib: include curl_printf.h as one of the last headersDaniel Stenberg2016-04-291-2/+2
| | | | | | | | | | | | | | | | | | | | curl_printf.h defines printf to curl_mprintf, etc. This can cause problems with external headers which may use __attribute__((format(printf, ...))) markers etc. To avoid that they cause problems with system includes, we include curl_printf.h after any system headers. That makes the three last headers to always be, and we keep them in this order: curl_printf.h curl_memory.h memdebug.h None of them include system headers, they all do funny #defines. Reported-by: David Benjamin Fixes #743
* code: style updatesDaniel Stenberg2016-04-031-9/+9
|
* TFTP: add option to suppress TFTP option requests (Part 2)Jay Satiro2016-02-231-1/+1
| | | | | | | | | | - Add tests. - Add an example to CURLOPT_TFTP_NO_OPTIONS.3. - Add --tftp-no-options to expose CURLOPT_TFTP_NO_OPTIONS. Bug: https://github.com/curl/curl/issues/481
* TFTP: add option to suppress TFTP option requests (Part 1)Michael Koenig2016-02-231-27/+30
| | | | | | | | | | | Some TFTP server implementations ignore the "TFTP Option extension" (RFC 1782-1784, 2347-2349), or implement it in a flawed way, causing problems with libcurl. Another switch for curl_easy_setopt "CURLOPT_TFTP_NO_OPTIONS" is introduced which prevents libcurl from sending TFTP option requests to a server, avoiding many problems caused by faulty implementations. Bug: https://github.com/curl/curl/issues/481
* URLs: change all http:// URLs to https://Daniel Stenberg2016-02-031-1/+1
|
* curl_memory: make curl_memory.h the second-last header file loadedDan Fandrich2015-03-241-2/+2
| | | | | | | This header file must be included after all header files except memdebug.h, as it does similar memory function redefinitions and can be similarly affected by conflicting definitions in system or dependent library headers.
* checksrc: detect and remove space before trailing semicolonsDaniel Stenberg2015-03-171-3/+3
|
* checksrc: use space before paren in "return (expr);"Daniel Stenberg2015-03-171-6/+6
|
* free: instead of Curl_safefree()Daniel Stenberg2015-03-161-1/+1
| | | | | | | | | | | | Since we just started make use of free(NULL) in order to simplify code, this change takes it a step further and: - converts lots of Curl_safefree() calls to good old free() - makes Curl_safefree() not check the pointer before free() The (new) rule of thumb is: if you really want a function call that frees a pointer and then assigns it to NULL, then use Curl_safefree(). But we will prefer just using free() from now on.
* mprintf.h: remove #ifdef CURLDEBUGDaniel Stenberg2015-03-031-4/+1
| | | | | ... and as a consequence, introduce curl_printf.h with that re-define magic instead and make all libcurl code use that instead.
* ftp: Use 'CURLcode result' for curl result codesSteve Holme2015-02-051-45/+49
|
* code cleanup: we prefer 'CURLcode result'Daniel Stenberg2014-10-241-22/+22
| | | | | | | | | | | | | | ... for the local variable name in functions holding the return code. Using the same name universally makes code easier to read and follow. Also, unify code for checking for CURLcode errors with: if(result) or if(!result) instead of if(result == CURLE_OK), if(CURLE_OK == result) or if(result != CURLE_OK)
* bits.close: introduce connection close trackingDaniel Stenberg2014-05-221-3/+3
| | | | | | | Make all code use connclose() and connkeep() when changing the "close state" for a connection. These two macros take a string argument with an explanation, and debug builds of curl will include that in the debug output. Helps tracking connection re-use/close issues.
* INFILESIZE: fields in UserDefined must not be changed run-timeDaniel Stenberg2014-04-261-4/+4
| | | | | | set.infilesize in this case was modified in several places, which could lead to repeated requests using the same handle to get unintendent/wrong consequences based on what the previous request did!
* tftp.c: fix possible dereference of null pointerMarc Hoersken2014-04-181-0/+3
|
* TFTP: fix crash on time-outDaniel Stenberg2014-01-281-2/+3
| | | | | | | | tftp_done() can get called with its TFTP state pointer still being NULL on an early time-out, which caused a segfault when dereferenced. Reported-by: Glenn Sheridan Bug: http://curl.haxx.se/mail/lib-2014-01/0246.html
* mprintf: Replaced internal usage of FORMAT_OFF_T and FORMAT_OFF_TUSteve Holme2013-12-311-1/+2
| | | | | | | | | Following commit 0aafd77fa4c6f2, replaced the internal usage of FORMAT_OFF_T and FORMAT_OFF_TU with the external versions that we expect API programmers to use. This negates the need for separate definitions which were subtly different under different platforms/compilers.
* TFTP: let tftp_multi_statemach()'s return codes throughJames Dury2013-12-071-1/+1
| | | | | | | It would otherwise always clobber the return code with new function calls and it couldn't return timeout etc. Bug: http://curl.haxx.se/bug/view.cgi?id=1310
* TFTP: make the CURLOPT_LOW_SPEED* options workDaniel Stenberg2013-08-221-0/+10
| | | | | | | | | | ... this also makes sure that the progess callback gets called more often during TFTP transfers. Added test 1238 to verify. Bug: http://curl.haxx.se/bug/view.cgi?id=1269 Reported-by: Jo3
* urldata: clean up the use of the protocol specific structsDaniel Stenberg2013-08-121-12/+0
| | | | | | | | 1 - always allocate the struct in protocol->setup_connection. Some protocol handlers had to get this function added. 2 - always free at the end of a request. This is also an attempt to keep less memory in the handle after it is completed.
* always-multi: always use non-blocking internalsDaniel Stenberg2013-01-171-130/+2
| | | | | | | | | | Remove internal separated behavior of the easy vs multi intercace. curl_easy_perform() is now using the multi interface itself. Several minor multi interface quirks and bugs have been fixed in the process. Much help with debugging this has been provided by: Yang Tse
* build: fix circular header inclusion with other packagesYang Tse2013-01-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit renames lib/setup.h to lib/curl_setup.h and renames lib/setup_once.h to lib/curl_setup_once.h. Removes the need and usage of a header inclusion guard foreign to libcurl. [1] Removes the need and presence of an alarming notice we carried in old setup_once.h [2] ---------------------------------------- 1 - lib/setup_once.h used __SETUP_ONCE_H macro as header inclusion guard up to commit ec691ca3 which changed this to HEADER_CURL_SETUP_ONCE_H, this single inclusion guard is enough to ensure that inclusion of lib/setup_once.h done from lib/setup.h is only done once. Additionally lib/setup.h has always used __SETUP_ONCE_H macro to protect inclusion of setup_once.h even after commit ec691ca3, this was to avoid a circular header inclusion triggered when building a c-ares enabled version with c-ares sources available which also has a setup_once.h header. Commit ec691ca3 exposes the real nature of __SETUP_ONCE_H usage in lib/setup.h, it is a header inclusion guard foreign to libcurl belonging to c-ares's setup_once.h The renaming this commit does, fixes the circular header inclusion, and as such removes the need and usage of a header inclusion guard foreign to libcurl. Macro __SETUP_ONCE_H no longer used in libcurl. 2 - Due to the circular interdependency of old lib/setup_once.h and the c-ares setup_once.h header, old file lib/setup_once.h has carried back from 2006 up to now days an alarming and prominent notice about the need of keeping libcurl's and c-ares's setup_once.h in sync. Given that this commit fixes the circular interdependency, the need and presence of mentioned notice is removed. All mentioned interdependencies come back from now old days when the c-ares project lived inside a curl subdirectory. This commit removes last traces of such fact.
View Lorry Controller Status