Re: [RELEASE] curl 7.70.0

2020-04-30 Thread Dennis Clarke via curl-library
On 2020-04-29 02:13, Daniel Stenberg via curl-library wrote: Hello team! snipage Hey there. Sorry but the hard core C99 compiler on Solaris 10 gives a nasty error about strdup in the test stage. Easy to overcome and when I adjust the CC and CFLAGS to allow for a lessor std=iso9899:1999 but no

Re: dynbuf: PR #5300

2020-04-30 Thread Daniel Stenberg via curl-library
On Thu, 30 Apr 2020, David Chapman via curl-library wrote: https://github.com/curl/curl/pull/5300 Years ago I got tired of sprintf() buffer overflow problems and wrote my own version of sprintf(), passing in a function pointer block.  The first use was to reallocate sprintf() buffers on the

Re: Presentation: The state of curl 2020

2020-04-30 Thread Dan Fandrich via curl-library
On Thu, Apr 30, 2020 at 11:55:44AM +0200, Daniel Stenberg via curl-library wrote: > I've been silent about curl up 2020 the online version as I've been > seriously uninspired of what to do about it. So here's this presentation at > least and I really wouldn't mind hearing if anyone wants to do any

Re: dynbuf: PR #5300

2020-04-30 Thread David Chapman via curl-library
On 4/30/2020 6:10 AM, Daniel Stenberg via curl-library wrote: Hi team, In PR 5300 I'm introducing a library-wide change that I wanted to make you all aware of! # Background 1 - Looking back, several of our past security problems have been related to reallocs and ridiculous string lengths.

Return code of server side scp command differs between curl and scp clients

2020-04-30 Thread Daniel Carpenter via curl-library
Dear all, Could anyone help me work out a difference in behaviour between using curl with an scp protocol vs /usr/bin/scp ? On the server, I have a small Python wrapper script which defers to an scp subprocess, using ForceCommand in my sshd config. Using either curl or scp on the client copie

Re: Test 1453 and dynamic ports

2020-04-30 Thread Dan Fandrich via curl-library
On Thu, Apr 30, 2020 at 02:11:43PM +0200, Daniel Stenberg wrote: > I think %NOLISTENPORT seems like the most effective change for this case, as > it avoids running a server in vein and it will get the desired effect. I've created PR#5314 with this approach. There were 26 tests affected, although o

dynbuf: PR #5300

2020-04-30 Thread Daniel Stenberg via curl-library
Hi team, In PR 5300 I'm introducing a library-wide change that I wanted to make you all aware of! # Background 1 - Looking back, several of our past security problems have been related to reallocs and ridiculous string lengths. 2 - It is rather ineffective to feature multiple almost identi

Re: Test 1453 and dynamic ports

2020-04-30 Thread Daniel Stenberg via curl-library
On Thu, 30 Apr 2020, Dan Fandrich via curl-library wrote: Test 1453 now fails when run on its own and I think it's due to the new dynamic port code. ... Since [...] is globbing syntax, curl complains early, before it even really runs anything. The problem won't be seen in most cases because

Presentation: The state of curl 2020

2020-04-30 Thread Daniel Stenberg via curl-library
Hi friends, During the last few years I've done a "the state of curl" presentations at curl up, summing up where we are right now in several different aspects. As curl up 2020 is not happening physically, I've instead recorded my presentation and I'm now putting it online for those of you who

Test 1453 and dynamic ports

2020-04-30 Thread Dan Fandrich via curl-library
Test 1453 now fails when run on its own and I think it's due to the new dynamic port code. The test is specified with tftp but not tftp because it doesn't actually need the server running (it's designed to fail early). However, the test harness replaces the %TFTPPORT in the command section with the