Blame SOURCES/0061-curl-7.29.0-CVE-2018-1000122.patch

f0f8d7
From 9f163418fabbe6219ab04cfe9bf81d2f33bd54d7 Mon Sep 17 00:00:00 2001
f0f8d7
From: Richy Kim <richy@fb.com>
f0f8d7
Date: Tue, 20 Dec 2016 05:48:15 -0500
b7b705
Subject: [PATCH 01/18] CURLOPT_BUFFERSIZE: support enlarging receive buffer
f0f8d7
f0f8d7
Replace use of fixed macro BUFSIZE to define the size of the receive
f0f8d7
buffer.  Reappropriate CURLOPT_BUFFERSIZE to include enlarging receive
f0f8d7
buffer size.  Upon setting, resize buffer if larger than the current
f0f8d7
default size up to a MAX_BUFSIZE (512KB). This can benefit protocols
f0f8d7
like SFTP.
f0f8d7
f0f8d7
Closes #1222
f0f8d7
f0f8d7
Upstream-commit: 6b7616690e5370c21e3a760321af6bf4edbabfb6
f0f8d7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f0f8d7
---
f0f8d7
 docs/libcurl/curl_easy_setopt.3  | 12 ++++++------
f0f8d7
 docs/libcurl/symbols-in-versions |  1 +
f0f8d7
 include/curl/curl.h              |  5 +++++
f0f8d7
 lib/easy.c                       |  6 ++++++
f0f8d7
 lib/file.c                       |  2 +-
f0f8d7
 lib/ftp.c                        |  4 ++--
f0f8d7
 lib/http.c                       |  3 ++-
f0f8d7
 lib/telnet.c                     |  5 +++--
f0f8d7
 lib/url.c                        | 28 +++++++++++++++++++++++-----
f0f8d7
 lib/urldata.h                    |  5 ++++-
f0f8d7
 10 files changed, 53 insertions(+), 18 deletions(-)
f0f8d7
f0f8d7
diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3
f0f8d7
index cbebfba..17b632f 100644
f0f8d7
--- a/docs/libcurl/curl_easy_setopt.3
f0f8d7
+++ b/docs/libcurl/curl_easy_setopt.3
f0f8d7
@@ -938,12 +938,12 @@ to using the share interface instead! See \fICURLOPT_SHARE\fP and
f0f8d7
 .IP CURLOPT_BUFFERSIZE
f0f8d7
 Pass a long specifying your preferred size (in bytes) for the receive buffer
f0f8d7
 in libcurl.  The main point of this would be that the write callback gets
f0f8d7
-called more often and with smaller chunks. This is just treated as a request,
f0f8d7
-not an order. You cannot be guaranteed to actually get the given size. (Added
f0f8d7
-in 7.10)
f0f8d7
-
f0f8d7
-This size is by default set as big as possible (CURL_MAX_WRITE_SIZE), so it
f0f8d7
-only makes sense to use this option if you want it smaller.
f0f8d7
+called more often and with smaller chunks.  Secondly, for some protocols,
f0f8d7
+there's a benefit of having a larger buffer for performance.  This is just
f0f8d7
+treated as a request, not an order. You cannot be guaranteed to actually get
f0f8d7
+the given size.  This buffer size is by default \fICURL_MAX_WRITE_SIZE\fP
f0f8d7
+(16kB). The maximum buffer size allowed to set is \fICURL_MAX_READ_SIZE\fP
f0f8d7
+(512kB).  (Added in 7.10)
f0f8d7
 .IP CURLOPT_PORT
f0f8d7
 Pass a long specifying what remote port number to connect to, instead of the
f0f8d7
 one specified in the URL or the default port for the used protocol.
f0f8d7
diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
f0f8d7
index b0b6232..e2cce4c 100644
f0f8d7
--- a/docs/libcurl/symbols-in-versions
f0f8d7
+++ b/docs/libcurl/symbols-in-versions
f0f8d7
@@ -639,6 +639,7 @@ CURL_LOCK_TYPE_DNS              7.10          -           7.10.2
f0f8d7
 CURL_LOCK_TYPE_NONE             7.10          -           7.10.2
f0f8d7
 CURL_LOCK_TYPE_SSL_SESSION      7.10          -           7.10.2
f0f8d7
 CURL_MAX_HTTP_HEADER            7.19.7
f0f8d7
+CURL_MAX_READ_SIZE              7.53.0
f0f8d7
 CURL_MAX_WRITE_SIZE             7.9.7
f0f8d7
 CURL_NETRC_IGNORED              7.9.8
f0f8d7
 CURL_NETRC_OPTIONAL             7.9.8
f0f8d7
diff --git a/include/curl/curl.h b/include/curl/curl.h
f0f8d7
index 0375a64..8b639fa 100644
f0f8d7
--- a/include/curl/curl.h
f0f8d7
+++ b/include/curl/curl.h
f0f8d7
@@ -170,6 +170,11 @@ typedef int (*curl_progress_callback)(void *clientp,
f0f8d7
                                       double ultotal,
f0f8d7
                                       double ulnow);
f0f8d7
 
f0f8d7
+#ifndef CURL_MAX_READ_SIZE
f0f8d7
+  /* The maximum receive buffer size configurable via CURLOPT_BUFFERSIZE. */
f0f8d7
+#define CURL_MAX_READ_SIZE 524288
f0f8d7
+#endif
f0f8d7
+
f0f8d7
 #ifndef CURL_MAX_WRITE_SIZE
f0f8d7
   /* Tests have proven that 20K is a very bad buffer size for uploads on
f0f8d7
      Windows, while 16K for some odd reason performed a lot better.
f0f8d7
diff --git a/lib/easy.c b/lib/easy.c
f0f8d7
index 0e9ba18..5d4d5ae 100644
f0f8d7
--- a/lib/easy.c
f0f8d7
+++ b/lib/easy.c
f0f8d7
@@ -563,6 +563,11 @@ CURL *curl_easy_duphandle(CURL *incurl)
f0f8d7
    * get setup on-demand in the code, as that would probably decrease
f0f8d7
    * the likeliness of us forgetting to init a buffer here in the future.
f0f8d7
    */
f0f8d7
+  outcurl->set.buffer_size = data->set.buffer_size;
f0f8d7
+  outcurl->state.buffer = malloc(CURL_BUFSIZE(outcurl->set.buffer_size) + 1);
f0f8d7
+  if(!outcurl->state.buffer)
f0f8d7
+    goto fail;
f0f8d7
+
f0f8d7
   outcurl->state.headerbuff = malloc(HEADERSIZE);
f0f8d7
   if(!outcurl->state.headerbuff)
f0f8d7
     goto fail;
f0f8d7
@@ -633,6 +638,7 @@ CURL *curl_easy_duphandle(CURL *incurl)
f0f8d7
   if(outcurl) {
f0f8d7
     curl_slist_free_all(outcurl->change.cookielist);
f0f8d7
     outcurl->change.cookielist = NULL;
f0f8d7
+    Curl_safefree(outcurl->state.buffer);
f0f8d7
     Curl_safefree(outcurl->state.headerbuff);
f0f8d7
     Curl_safefree(outcurl->change.url);
f0f8d7
     Curl_safefree(outcurl->change.referer);
f0f8d7
diff --git a/lib/file.c b/lib/file.c
f0f8d7
index 038bf42..1ad4758 100644
f0f8d7
--- a/lib/file.c
f0f8d7
+++ b/lib/file.c
f0f8d7
@@ -473,7 +473,7 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
f0f8d7
      date. */
f0f8d7
   if(data->set.opt_no_body && data->set.include_header && fstated) {
f0f8d7
     CURLcode result;
f0f8d7
-    snprintf(buf, sizeof(data->state.buffer),
f0f8d7
+    snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
f0f8d7
              "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);
f0f8d7
     result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
f0f8d7
     if(result)
f0f8d7
diff --git a/lib/ftp.c b/lib/ftp.c
f0f8d7
index a9826ce..730b695 100644
f0f8d7
--- a/lib/ftp.c
f0f8d7
+++ b/lib/ftp.c
f0f8d7
@@ -2136,7 +2136,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
f0f8d7
         /* we have a time, reformat it */
f0f8d7
         time_t secs=time(NULL);
f0f8d7
         /* using the good old yacc/bison yuck */
f0f8d7
-        snprintf(buf, sizeof(conn->data->state.buffer),
f0f8d7
+        snprintf(buf, CURL_BUFSIZE(conn->data->set.buffer_size),
f0f8d7
                  "%04d%02d%02d %02d:%02d:%02d GMT",
f0f8d7
                  year, month, day, hour, minute, second);
f0f8d7
         /* now, convert this into a time() value: */
f0f8d7
@@ -2347,7 +2347,7 @@ static CURLcode ftp_state_size_resp(struct connectdata *conn,
f0f8d7
   if(instate == FTP_SIZE) {
f0f8d7
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
f0f8d7
     if(-1 != filesize) {
f0f8d7
-      snprintf(buf, sizeof(data->state.buffer),
f0f8d7
+      snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
f0f8d7
                "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);
f0f8d7
       result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
f0f8d7
       if(result)
f0f8d7
diff --git a/lib/http.c b/lib/http.c
f0f8d7
index 1487fb2..f4368c4 100644
f0f8d7
--- a/lib/http.c
f0f8d7
+++ b/lib/http.c
f0f8d7
@@ -247,7 +247,8 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
f0f8d7
     pwd = conn->passwd;
f0f8d7
   }
f0f8d7
 
f0f8d7
-  snprintf(data->state.buffer, sizeof(data->state.buffer), "%s:%s", user, pwd);
f0f8d7
+  snprintf(data->state.buffer, CURL_BUFSIZE(data->set.buffer_size),
f0f8d7
+           "%s:%s", user, pwd);
f0f8d7
 
f0f8d7
   error = Curl_base64_encode(data,
f0f8d7
                              data->state.buffer, strlen(data->state.buffer),
f0f8d7
diff --git a/lib/telnet.c b/lib/telnet.c
f0f8d7
index 77d8b7b..89452dd 100644
f0f8d7
--- a/lib/telnet.c
f0f8d7
+++ b/lib/telnet.c
f0f8d7
@@ -1421,6 +1421,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
f0f8d7
 
f0f8d7
   /* Keep on listening and act on events */
f0f8d7
   while(keepon) {
f0f8d7
+    const size_t buf_size = CURL_BUFSIZE(data->set.buffer_size);
f0f8d7
     waitret = WaitForMultipleObjects(obj_count, objs, FALSE, wait_timeout);
f0f8d7
     switch(waitret) {
f0f8d7
     case WAIT_TIMEOUT:
f0f8d7
@@ -1455,7 +1456,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
f0f8d7
           if(!readfile_read)
f0f8d7
             break;
f0f8d7
 
f0f8d7
-          if(!ReadFile(stdin_handle, buf, sizeof(data->state.buffer),
f0f8d7
+          if(!ReadFile(stdin_handle, buf, buf_size,
f0f8d7
                        &readfile_read, NULL)) {
f0f8d7
             keepon = FALSE;
f0f8d7
             code = CURLE_READ_ERROR;
f0f8d7
@@ -1474,7 +1475,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
f0f8d7
 
f0f8d7
     case WAIT_OBJECT_0 + 1:
f0f8d7
     {
f0f8d7
-      if(!ReadFile(stdin_handle, buf, sizeof(data->state.buffer),
f0f8d7
+      if(!ReadFile(stdin_handle, buf, buf_size,
f0f8d7
                    &readfile_read, NULL)) {
f0f8d7
         keepon = FALSE;
f0f8d7
         code = CURLE_READ_ERROR;
f0f8d7
diff --git a/lib/url.c b/lib/url.c
f0f8d7
index 89958a7..32e7e2e 100644
f0f8d7
--- a/lib/url.c
f0f8d7
+++ b/lib/url.c
f0f8d7
@@ -441,6 +441,7 @@ CURLcode Curl_close(struct SessionHandle *data)
f0f8d7
   }
f0f8d7
   data->change.url = NULL;
f0f8d7
 
f0f8d7
+  Curl_safefree(data->state.buffer);
f0f8d7
   Curl_safefree(data->state.headerbuff);
f0f8d7
 
f0f8d7
   Curl_flush_cookies(data, 1);
f0f8d7
@@ -612,6 +613,12 @@ CURLcode Curl_open(struct SessionHandle **curl)
f0f8d7
 
f0f8d7
   /* We do some initial setup here, all those fields that can't be just 0 */
f0f8d7
 
f0f8d7
+  data->state.buffer = malloc(BUFSIZE + 1);
f0f8d7
+  if(!data->state.buffer) {
f0f8d7
+    DEBUGF(fprintf(stderr, "Error: malloc of buffer failed\n"));
f0f8d7
+    res = CURLE_OUT_OF_MEMORY;
f0f8d7
+  }
f0f8d7
+
f0f8d7
   data->state.headerbuff = malloc(HEADERSIZE);
f0f8d7
   if(!data->state.headerbuff) {
f0f8d7
     DEBUGF(fprintf(stderr, "Error: malloc of headerbuff failed\n"));
f0f8d7
@@ -642,8 +649,8 @@ CURLcode Curl_open(struct SessionHandle **curl)
f0f8d7
 
f0f8d7
   if(res) {
f0f8d7
     Curl_resolver_cleanup(data->state.resolver);
f0f8d7
-    if(data->state.headerbuff)
f0f8d7
-      free(data->state.headerbuff);
f0f8d7
+    free(data->state.buffer);
f0f8d7
+    free(data->state.headerbuff);
f0f8d7
     Curl_freeset(data);
f0f8d7
     free(data);
f0f8d7
     data = NULL;
f0f8d7
@@ -1960,9 +1967,20 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
f0f8d7
      */
f0f8d7
     data->set.buffer_size = va_arg(param, long);
f0f8d7
 
f0f8d7
-    if((data->set.buffer_size> (BUFSIZE -1 )) ||
f0f8d7
-       (data->set.buffer_size < 1))
f0f8d7
-      data->set.buffer_size = 0; /* huge internal default */
f0f8d7
+    if(data->set.buffer_size > MAX_BUFSIZE)
f0f8d7
+      data->set.buffer_size = MAX_BUFSIZE; /* huge internal default */
f0f8d7
+    else if(data->set.buffer_size < 1)
f0f8d7
+      data->set.buffer_size = BUFSIZE;
f0f8d7
+
f0f8d7
+    /* Resize only if larger than default buffer size. */
f0f8d7
+    if(data->set.buffer_size > BUFSIZE) {
f0f8d7
+      data->state.buffer = realloc(data->state.buffer,
f0f8d7
+                                   data->set.buffer_size + 1);
f0f8d7
+      if(!data->state.buffer) {
f0f8d7
+        DEBUGF(fprintf(stderr, "Error: realloc of buffer failed\n"));
f0f8d7
+        result = CURLE_OUT_OF_MEMORY;
f0f8d7
+      }
f0f8d7
+    }
f0f8d7
 
f0f8d7
     break;
f0f8d7
 
f0f8d7
diff --git a/lib/urldata.h b/lib/urldata.h
f0f8d7
index 7431825..a7807cf 100644
f0f8d7
--- a/lib/urldata.h
f0f8d7
+++ b/lib/urldata.h
f0f8d7
@@ -196,6 +196,9 @@
f0f8d7
 /* Download buffer size, keep it fairly big for speed reasons */
f0f8d7
 #undef BUFSIZE
f0f8d7
 #define BUFSIZE CURL_MAX_WRITE_SIZE
f0f8d7
+#undef MAX_BUFSIZE
f0f8d7
+#define MAX_BUFSIZE CURL_MAX_READ_SIZE
f0f8d7
+#define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
f0f8d7
 
f0f8d7
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
f0f8d7
    of need. */
f0f8d7
@@ -1174,7 +1177,7 @@ struct UrlState {
f0f8d7
   char *headerbuff; /* allocated buffer to store headers in */
f0f8d7
   size_t headersize;   /* size of the allocation */
f0f8d7
 
f0f8d7
-  char buffer[BUFSIZE+1]; /* download buffer */
f0f8d7
+  char *buffer; /* download buffer */
f0f8d7
   char uploadbuffer[BUFSIZE+1]; /* upload buffer */
f0f8d7
   curl_off_t current_speed;  /* the ProgressShow() funcion sets this,
f0f8d7
                                 bytes / second */
f0f8d7
-- 
f0f8d7
2.14.3
f0f8d7
f0f8d7
f0f8d7
From f175a713c964d351012baaf8c78c1b468cc6aba0 Mon Sep 17 00:00:00 2001
f0f8d7
From: Daniel Stenberg <daniel@haxx.se>
f0f8d7
Date: Mon, 24 Apr 2017 15:33:57 +0200
b7b705
Subject: [PATCH 02/18] http: use private user:password output buffer
f0f8d7
f0f8d7
Don't clobber the receive buffer.
f0f8d7
f0f8d7
Upstream-commit: 94460878cc634b590a7282e3fe60ceafb62d141a
f0f8d7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f0f8d7
---
f0f8d7
 lib/http.c | 32 +++++++++++++++++++-------------
f0f8d7
 1 file changed, 19 insertions(+), 13 deletions(-)
f0f8d7
f0f8d7
diff --git a/lib/http.c b/lib/http.c
f0f8d7
index f4368c4..12e7dc3 100644
f0f8d7
--- a/lib/http.c
f0f8d7
+++ b/lib/http.c
f0f8d7
@@ -234,7 +234,8 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
f0f8d7
   char **userp;
f0f8d7
   const char *user;
f0f8d7
   const char *pwd;
f0f8d7
-  CURLcode error;
f0f8d7
+  CURLcode result;
f0f8d7
+  char *out;
f0f8d7
 
f0f8d7
   if(proxy) {
f0f8d7
     userp = &conn->allocptr.proxyuserpwd;
f0f8d7
@@ -247,27 +248,32 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
f0f8d7
     pwd = conn->passwd;
f0f8d7
   }
f0f8d7
 
f0f8d7
-  snprintf(data->state.buffer, CURL_BUFSIZE(data->set.buffer_size),
f0f8d7
-           "%s:%s", user, pwd);
f0f8d7
+  out = aprintf("%s:%s", user, pwd);
f0f8d7
+  if(!out)
f0f8d7
+    return CURLE_OUT_OF_MEMORY;
f0f8d7
 
f0f8d7
-  error = Curl_base64_encode(data,
f0f8d7
-                             data->state.buffer, strlen(data->state.buffer),
f0f8d7
-                             &authorization, &size);
f0f8d7
-  if(error)
f0f8d7
-    return error;
f0f8d7
+  result = Curl_base64_encode(data, out, strlen(out), &authorization, &size);
f0f8d7
+  if(result)
f0f8d7
+    goto fail;
f0f8d7
 
f0f8d7
-  if(!authorization)
f0f8d7
-    return CURLE_REMOTE_ACCESS_DENIED;
f0f8d7
+  if(!authorization) {
f0f8d7
+    result = CURLE_REMOTE_ACCESS_DENIED;
f0f8d7
+    goto fail;
f0f8d7
+  }
f0f8d7
 
f0f8d7
   Curl_safefree(*userp);
f0f8d7
   *userp = aprintf("%sAuthorization: Basic %s\r\n",
f0f8d7
                    proxy?"Proxy-":"",
f0f8d7
                    authorization);
f0f8d7
   free(authorization);
f0f8d7
-  if(!*userp)
f0f8d7
-    return CURLE_OUT_OF_MEMORY;
f0f8d7
+  if(!*userp) {
f0f8d7
+    result = CURLE_OUT_OF_MEMORY;
f0f8d7
+    goto fail;
f0f8d7
+  }
f0f8d7
 
f0f8d7
-  return CURLE_OK;
f0f8d7
+  fail:
f0f8d7
+  free(out);
f0f8d7
+  return result;
f0f8d7
 }
f0f8d7
 
f0f8d7
 /* pickoneauth() selects the most favourable authentication method from the
f0f8d7
-- 
f0f8d7
2.14.3
f0f8d7
f0f8d7
f0f8d7
From 6ff175806c338223a2a9a69f6ae8ae2b91dc2b56 Mon Sep 17 00:00:00 2001
f0f8d7
From: Daniel Stenberg <daniel@haxx.se>
f0f8d7
Date: Mon, 24 Apr 2017 16:05:46 +0200
b7b705
Subject: [PATCH 03/18] ftp: use private buffer for temp storage, not receive
f0f8d7
 buffer
f0f8d7
f0f8d7
Upstream-commit: 349789e645a306a6ee467ef90a57f6cc306ca92e
f0f8d7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f0f8d7
---
f0f8d7
 lib/ftp.c | 22 ++++++++++++----------
f0f8d7
 1 file changed, 12 insertions(+), 10 deletions(-)
f0f8d7
f0f8d7
diff --git a/lib/ftp.c b/lib/ftp.c
f0f8d7
index 730b695..10a21ce 100644
f0f8d7
--- a/lib/ftp.c
f0f8d7
+++ b/lib/ftp.c
f0f8d7
@@ -2130,17 +2130,17 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
f0f8d7
       /* we got a time. Format should be: "YYYYMMDDHHMMSS[.sss]" where the
f0f8d7
          last .sss part is optional and means fractions of a second */
f0f8d7
       int year, month, day, hour, minute, second;
f0f8d7
-      char *buf = data->state.buffer;
f0f8d7
-      if(6 == sscanf(buf+4, "%04d%02d%02d%02d%02d%02d",
f0f8d7
+      if(6 == sscanf(&data->state.buffer[4], "%04d%02d%02d%02d%02d%02d",
f0f8d7
                      &year, &month, &day, &hour, &minute, &second)) {
f0f8d7
         /* we have a time, reformat it */
f0f8d7
+        char timebuf[24];
f0f8d7
         time_t secs=time(NULL);
f0f8d7
-        /* using the good old yacc/bison yuck */
f0f8d7
-        snprintf(buf, CURL_BUFSIZE(conn->data->set.buffer_size),
f0f8d7
+
f0f8d7
+        snprintf(timebuf, sizeof(timebuf),
f0f8d7
                  "%04d%02d%02d %02d:%02d:%02d GMT",
f0f8d7
                  year, month, day, hour, minute, second);
f0f8d7
         /* now, convert this into a time() value: */
f0f8d7
-        data->info.filetime = (long)curl_getdate(buf, &secs;;
f0f8d7
+        data->info.filetime = (long)curl_getdate(timebuf, &secs;;
f0f8d7
       }
f0f8d7
 
f0f8d7
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
f0f8d7
@@ -2151,6 +2151,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
f0f8d7
          ftpc->file &&
f0f8d7
          data->set.get_filetime &&
f0f8d7
          (data->info.filetime>=0) ) {
f0f8d7
+        char headerbuf[128];
f0f8d7
         time_t filetime = (time_t)data->info.filetime;
f0f8d7
         struct tm buffer;
f0f8d7
         const struct tm *tm = &buffer;
f0f8d7
@@ -2160,7 +2161,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
f0f8d7
           return result;
f0f8d7
 
f0f8d7
         /* format: "Tue, 15 Nov 1994 12:45:26" */
f0f8d7
-        snprintf(buf, BUFSIZE-1,
f0f8d7
+        snprintf(headerbuf, sizeof(headerbuf),
f0f8d7
                  "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
f0f8d7
                  Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
f0f8d7
                  tm->tm_mday,
f0f8d7
@@ -2169,7 +2170,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
f0f8d7
                  tm->tm_hour,
f0f8d7
                  tm->tm_min,
f0f8d7
                  tm->tm_sec);
f0f8d7
-        result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
f0f8d7
+        result = Curl_client_write(conn, CLIENTWRITE_BOTH, headerbuf, 0);
f0f8d7
         if(result)
f0f8d7
           return result;
f0f8d7
       } /* end of a ridiculous amount of conditionals */
f0f8d7
@@ -2347,9 +2348,10 @@ static CURLcode ftp_state_size_resp(struct connectdata *conn,
f0f8d7
   if(instate == FTP_SIZE) {
f0f8d7
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
f0f8d7
     if(-1 != filesize) {
f0f8d7
-      snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
f0f8d7
+      char clbuf[128];
f0f8d7
+      snprintf(clbuf, sizeof(clbuf),
f0f8d7
                "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);
f0f8d7
-      result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
f0f8d7
+      result = Curl_client_write(conn, CLIENTWRITE_BOTH, clbuf, 0);
f0f8d7
       if(result)
f0f8d7
         return result;
f0f8d7
     }
f0f8d7
@@ -2450,7 +2452,6 @@ static CURLcode ftp_state_get_resp(struct connectdata *conn,
f0f8d7
   CURLcode result = CURLE_OK;
f0f8d7
   struct SessionHandle *data = conn->data;
f0f8d7
   struct FTP *ftp = data->state.proto.ftp;
f0f8d7
-  char *buf = data->state.buffer;
f0f8d7
 
f0f8d7
   if((ftpcode == 150) || (ftpcode == 125)) {
f0f8d7
 
f0f8d7
@@ -2494,6 +2495,7 @@ static CURLcode ftp_state_get_resp(struct connectdata *conn,
f0f8d7
        *
f0f8d7
        * Example D above makes this parsing a little tricky */
f0f8d7
       char *bytes;
f0f8d7
+      char *buf = data->state.buffer;
f0f8d7
       bytes=strstr(buf, " bytes");
f0f8d7
       if(bytes--) {
f0f8d7
         long in=(long)(bytes-buf);
f0f8d7
-- 
f0f8d7
2.14.3
f0f8d7
f0f8d7
f0f8d7
From b67324919089fc4f9bb7a38a6a31174883a4bc24 Mon Sep 17 00:00:00 2001
f0f8d7
From: Daniel Stenberg <daniel@haxx.se>
f0f8d7
Date: Tue, 25 Apr 2017 00:09:22 +0200
b7b705
Subject: [PATCH 04/18] CURLOPT_BUFFERSIZE: 1024 bytes is now the minimum size
f0f8d7
f0f8d7
The buffer is needed to receive FTP, HTTP CONNECT responses etc so
f0f8d7
already at this size things risk breaking and smaller is certainly not
f0f8d7
wise.
f0f8d7
f0f8d7
Upstream-commit: c2ddc12d6086b522703c8b80a72ab791680f1a28
f0f8d7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f0f8d7
---
f0f8d7
 lib/url.c     | 15 +++++++++------
f0f8d7
 lib/urldata.h |  1 +
f0f8d7
 2 files changed, 10 insertions(+), 6 deletions(-)
f0f8d7
f0f8d7
diff --git a/lib/url.c b/lib/url.c
f0f8d7
index 32e7e2e..f87dca4 100644
f0f8d7
--- a/lib/url.c
f0f8d7
+++ b/lib/url.c
f0f8d7
@@ -1965,15 +1965,17 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
f0f8d7
      * The application kindly asks for a differently sized receive buffer.
f0f8d7
      * If it seems reasonable, we'll use it.
f0f8d7
      */
f0f8d7
-    data->set.buffer_size = va_arg(param, long);
f0f8d7
+    arg = va_arg(param, long);
f0f8d7
 
f0f8d7
-    if(data->set.buffer_size > MAX_BUFSIZE)
f0f8d7
-      data->set.buffer_size = MAX_BUFSIZE; /* huge internal default */
f0f8d7
-    else if(data->set.buffer_size < 1)
f0f8d7
-      data->set.buffer_size = BUFSIZE;
f0f8d7
+    if(arg > MAX_BUFSIZE)
f0f8d7
+      arg = MAX_BUFSIZE; /* huge internal default */
f0f8d7
+    else if(arg < 1)
f0f8d7
+      arg = BUFSIZE;
f0f8d7
+    else if(arg < MIN_BUFSIZE)
f0f8d7
+      arg = BUFSIZE;
f0f8d7
 
f0f8d7
     /* Resize only if larger than default buffer size. */
f0f8d7
-    if(data->set.buffer_size > BUFSIZE) {
f0f8d7
+    if(arg > BUFSIZE) {
f0f8d7
       data->state.buffer = realloc(data->state.buffer,
f0f8d7
                                    data->set.buffer_size + 1);
f0f8d7
       if(!data->state.buffer) {
f0f8d7
@@ -1981,6 +1983,7 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
f0f8d7
         result = CURLE_OUT_OF_MEMORY;
f0f8d7
       }
f0f8d7
     }
f0f8d7
+    data->set.buffer_size = arg;
f0f8d7
 
f0f8d7
     break;
f0f8d7
 
f0f8d7
diff --git a/lib/urldata.h b/lib/urldata.h
f0f8d7
index a7807cf..cd96e8f 100644
f0f8d7
--- a/lib/urldata.h
f0f8d7
+++ b/lib/urldata.h
f0f8d7
@@ -198,6 +198,7 @@
f0f8d7
 #define BUFSIZE CURL_MAX_WRITE_SIZE
f0f8d7
 #undef MAX_BUFSIZE
f0f8d7
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
f0f8d7
+#define MIN_BUFSIZE 1024
f0f8d7
 #define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
f0f8d7
 
f0f8d7
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
f0f8d7
-- 
f0f8d7
2.14.3
f0f8d7
f0f8d7
f0f8d7
From 9798012315c087168c5a4a1dc56eacfe82c69626 Mon Sep 17 00:00:00 2001
f0f8d7
From: Daniel Stenberg <daniel@haxx.se>
f0f8d7
Date: Tue, 25 Apr 2017 00:15:28 +0200
b7b705
Subject: [PATCH 05/18] file: use private buffer for C-L output
f0f8d7
f0f8d7
... instead of clobbering the download buffer.
f0f8d7
f0f8d7
Upstream-commit: 7c312f84ea930d89c0f0f774b50032c4f9ae30e4
f0f8d7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f0f8d7
---
f0f8d7
 lib/file.c | 7 ++++---
f0f8d7
 1 file changed, 4 insertions(+), 3 deletions(-)
f0f8d7
f0f8d7
diff --git a/lib/file.c b/lib/file.c
f0f8d7
index 1ad4758..b6bf18e 100644
f0f8d7
--- a/lib/file.c
f0f8d7
+++ b/lib/file.c
f0f8d7
@@ -473,9 +473,10 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
f0f8d7
      date. */
f0f8d7
   if(data->set.opt_no_body && data->set.include_header && fstated) {
f0f8d7
     CURLcode result;
f0f8d7
-    snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
f0f8d7
+    char header[80];
f0f8d7
+    snprintf(header, sizeof(header),
f0f8d7
              "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);
f0f8d7
-    result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
f0f8d7
+    result = Curl_client_write(conn, CLIENTWRITE_BOTH, header, 0);
f0f8d7
     if(result)
f0f8d7
       return result;
f0f8d7
 
f0f8d7
@@ -493,7 +494,7 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
f0f8d7
         return result;
f0f8d7
 
f0f8d7
       /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
f0f8d7
-      snprintf(buf, BUFSIZE-1,
f0f8d7
+      snprintf(header, sizeof(header),
f0f8d7
                "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
f0f8d7
                Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
f0f8d7
                tm->tm_mday,
f0f8d7
-- 
f0f8d7
2.14.3
f0f8d7
f0f8d7
f0f8d7
From f4868e737e9f8d719cb9897506da2c7f92dfd87d Mon Sep 17 00:00:00 2001
f0f8d7
From: Daniel Stenberg <daniel@haxx.se>
f0f8d7
Date: Tue, 25 Apr 2017 00:16:10 +0200
b7b705
Subject: [PATCH 06/18] buffer_size: make sure it always has the correct size
f0f8d7
f0f8d7
Removes the need for CURL_BUFSIZE
f0f8d7
f0f8d7
Upstream-commit: f535f4f5fc6cbdce1aec5a3481cec37369dca468
f0f8d7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f0f8d7
---
f0f8d7
 lib/easy.c    | 2 +-
f0f8d7
 lib/telnet.c  | 2 +-
f0f8d7
 lib/url.c     | 2 ++
f0f8d7
 lib/urldata.h | 1 -
f0f8d7
 4 files changed, 4 insertions(+), 3 deletions(-)
f0f8d7
f0f8d7
diff --git a/lib/easy.c b/lib/easy.c
f0f8d7
index 5d4d5ae..9cad5f1 100644
f0f8d7
--- a/lib/easy.c
f0f8d7
+++ b/lib/easy.c
f0f8d7
@@ -564,7 +564,7 @@ CURL *curl_easy_duphandle(CURL *incurl)
f0f8d7
    * the likeliness of us forgetting to init a buffer here in the future.
f0f8d7
    */
f0f8d7
   outcurl->set.buffer_size = data->set.buffer_size;
f0f8d7
-  outcurl->state.buffer = malloc(CURL_BUFSIZE(outcurl->set.buffer_size) + 1);
f0f8d7
+  outcurl->state.buffer = malloc(outcurl->set.buffer_size + 1);
f0f8d7
   if(!outcurl->state.buffer)
f0f8d7
     goto fail;
f0f8d7
 
f0f8d7
diff --git a/lib/telnet.c b/lib/telnet.c
f0f8d7
index 89452dd..e43b423 100644
f0f8d7
--- a/lib/telnet.c
f0f8d7
+++ b/lib/telnet.c
f0f8d7
@@ -1421,7 +1421,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
f0f8d7
 
f0f8d7
   /* Keep on listening and act on events */
f0f8d7
   while(keepon) {
f0f8d7
-    const size_t buf_size = CURL_BUFSIZE(data->set.buffer_size);
f0f8d7
+    const size_t buf_size = (DWORD)data->set.buffer_size;
f0f8d7
     waitret = WaitForMultipleObjects(obj_count, objs, FALSE, wait_timeout);
f0f8d7
     switch(waitret) {
f0f8d7
     case WAIT_TIMEOUT:
f0f8d7
diff --git a/lib/url.c b/lib/url.c
f0f8d7
index f87dca4..81de7c2 100644
f0f8d7
--- a/lib/url.c
f0f8d7
+++ b/lib/url.c
f0f8d7
@@ -577,6 +577,8 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
f0f8d7
   set->tcp_keepintvl = 60;
f0f8d7
   set->tcp_keepidle = 60;
f0f8d7
 
f0f8d7
+  set->buffer_size = BUFSIZE;
f0f8d7
+
f0f8d7
   return res;
f0f8d7
 }
f0f8d7
 
f0f8d7
diff --git a/lib/urldata.h b/lib/urldata.h
f0f8d7
index cd96e8f..fbe69c2 100644
f0f8d7
--- a/lib/urldata.h
f0f8d7
+++ b/lib/urldata.h
f0f8d7
@@ -199,7 +199,6 @@
f0f8d7
 #undef MAX_BUFSIZE
f0f8d7
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
f0f8d7
 #define MIN_BUFSIZE 1024
f0f8d7
-#define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
f0f8d7
 
f0f8d7
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
f0f8d7
    of need. */
f0f8d7
-- 
f0f8d7
2.14.3
f0f8d7
f0f8d7
b7b705
From 43d9e7acc44c9849f85882d2ec18c2a609f90809 Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 00:48:56 +0200
b7b705
Subject: [PATCH 07/18] http: don't clobber the receive buffer for timecond
b7b705
b7b705
Upstream-commit: 87eb8d5b30ce2adfe2673cc0b1abf6ca68891cc4
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/http.c | 37 +++++++++++++++++++------------------
b7b705
 1 file changed, 19 insertions(+), 18 deletions(-)
b7b705
b7b705
diff --git a/lib/http.c b/lib/http.c
b7b705
index 12e7dc3..6ecdda2 100644
b7b705
--- a/lib/http.c
b7b705
+++ b/lib/http.c
b7b705
@@ -1607,9 +1607,10 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
b7b705
                                 Curl_send_buffer *req_buffer)
b7b705
 {
b7b705
   const struct tm *tm;
b7b705
-  char *buf = data->state.buffer;
b7b705
   CURLcode result = CURLE_OK;
b7b705
   struct tm keeptime;
b7b705
+  char datestr[80];
b7b705
+  const char *condp;
b7b705
 
b7b705
   result = Curl_gmtime(data->set.timevalue, &keeptime);
b7b705
   if(result) {
b7b705
@@ -1618,6 +1619,19 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
b7b705
   }
b7b705
   tm = &keeptime;
b7b705
 
b7b705
+  switch(data->set.timecondition) {
b7b705
+  default:
b7b705
+  case CURL_TIMECOND_IFMODSINCE:
b7b705
+    condp = "If-Modified-Since";
b7b705
+    break;
b7b705
+  case CURL_TIMECOND_IFUNMODSINCE:
b7b705
+    condp = "If-Unmodified-Since";
b7b705
+    break;
b7b705
+  case CURL_TIMECOND_LASTMOD:
b7b705
+    condp = "Last-Modified";
b7b705
+    break;
b7b705
+  }
b7b705
+
b7b705
   /* The If-Modified-Since header family should have their times set in
b7b705
    * GMT as RFC2616 defines: "All HTTP date/time stamps MUST be
b7b705
    * represented in Greenwich Mean Time (GMT), without exception. For the
b7b705
@@ -1626,8 +1640,9 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
b7b705
    */
b7b705
 
b7b705
   /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
b7b705
-  snprintf(buf, BUFSIZE-1,
b7b705
-           "%s, %02d %s %4d %02d:%02d:%02d GMT",
b7b705
+  snprintf(datestr, sizeof(datestr),
b7b705
+           "%s: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
b7b705
+           condp,
b7b705
            Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
b7b705
            tm->tm_mday,
b7b705
            Curl_month[tm->tm_mon],
b7b705
@@ -1636,21 +1651,7 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
b7b705
            tm->tm_min,
b7b705
            tm->tm_sec);
b7b705
 
b7b705
-  switch(data->set.timecondition) {
b7b705
-  case CURL_TIMECOND_IFMODSINCE:
b7b705
-  default:
b7b705
-    result = Curl_add_bufferf(req_buffer,
b7b705
-                              "If-Modified-Since: %s\r\n", buf);
b7b705
-    break;
b7b705
-  case CURL_TIMECOND_IFUNMODSINCE:
b7b705
-    result = Curl_add_bufferf(req_buffer,
b7b705
-                              "If-Unmodified-Since: %s\r\n", buf);
b7b705
-    break;
b7b705
-  case CURL_TIMECOND_LASTMOD:
b7b705
-    result = Curl_add_bufferf(req_buffer,
b7b705
-                              "Last-Modified: %s\r\n", buf);
b7b705
-    break;
b7b705
-  }
b7b705
+  result = Curl_add_buffer(req_buffer, datestr, strlen(datestr));
b7b705
 
b7b705
   return result;
b7b705
 }
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 91ca8ea3e4e984070ef07dbc1a7258ced3b6982a Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 00:50:04 +0200
b7b705
Subject: [PATCH 08/18] pingpong: use the set buffer size
b7b705
b7b705
Upstream-commit: b8191e975faa7810ed3d858205b0b3f0d297f0b2
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/pingpong.c | 15 +++++++++------
b7b705
 1 file changed, 9 insertions(+), 6 deletions(-)
b7b705
b7b705
diff --git a/lib/pingpong.c b/lib/pingpong.c
b7b705
index 16b4ad3..c4666fe 100644
b7b705
--- a/lib/pingpong.c
b7b705
+++ b/lib/pingpong.c
b7b705
@@ -309,7 +309,8 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
b7b705
 
b7b705
   keepon=TRUE;
b7b705
 
b7b705
-  while((pp->nread_resp
b7b705
+  while((pp->nread_resp < (size_t)data->set.buffer_size) &&
b7b705
+        (keepon && !result)) {
b7b705
 
b7b705
     if(pp->cache) {
b7b705
       /* we had data in the "cache", copy that instead of doing an actual
b7b705
@@ -319,7 +320,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
b7b705
        * it would have been populated with something of size int to begin
b7b705
        * with, even though its datatype may be larger than an int.
b7b705
        */
b7b705
-      DEBUGASSERT((ptr+pp->cache_size) <= (buf+BUFSIZE+1));
b7b705
+      DEBUGASSERT((ptr+pp->cache_size) <= (buf+data->set.buffer_size+1));
b7b705
       memcpy(ptr, pp->cache, pp->cache_size);
b7b705
       gotbytes = (ssize_t)pp->cache_size;
b7b705
       free(pp->cache);    /* free the cache */
b7b705
@@ -332,8 +333,10 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
b7b705
       enum protection_level prot = conn->data_prot;
b7b705
       conn->data_prot = PROT_CLEAR;
b7b705
 #endif
b7b705
-      DEBUGASSERT((ptr+BUFSIZE-pp->nread_resp) <= (buf+BUFSIZE+1));
b7b705
-      res = Curl_read(conn, sockfd, ptr, BUFSIZE-pp->nread_resp,
b7b705
+      DEBUGASSERT((ptr + data->set.buffer_size - pp->nread_resp) <=
b7b705
+                  (buf + data->set.buffer_size + 1));
b7b705
+      res = Curl_read(conn, sockfd, ptr,
b7b705
+                      data->set.buffer_size - pp->nread_resp,
b7b705
                       &gotbytes);
b7b705
 #if defined(HAVE_KRB4) || defined(HAVE_GSSAPI)
b7b705
       DEBUGASSERT(prot  > PROT_NONE && prot < PROT_LAST);
b7b705
@@ -430,7 +433,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
b7b705
       }
b7b705
       else if(keepon) {
b7b705
 
b7b705
-        if((perline == gotbytes) && (gotbytes > BUFSIZE/2)) {
b7b705
+        if((perline == gotbytes) && (gotbytes > data->set.buffer_size/2)) {
b7b705
           /* We got an excessive line without newlines and we need to deal
b7b705
              with it. We keep the first bytes of the line then we throw
b7b705
              away the rest. */
b7b705
@@ -442,7 +445,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
b7b705
              interested in the first piece */
b7b705
           clipamount = 40;
b7b705
         }
b7b705
-        else if(pp->nread_resp > BUFSIZE/2) {
b7b705
+        else if(pp->nread_resp > (size_t)data->set.buffer_size/2) {
b7b705
           /* We got a large chunk of data and there's potentially still
b7b705
              trailing data to take care of, so we put any such part in the
b7b705
              "cache", clear the buffer to make space and restart. */
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 3bc2bc2f1c5e3afd7a7cbd208d97fbb37f2dfc5f Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 00:50:21 +0200
b7b705
Subject: [PATCH 09/18] failf: use private buffer, don't clobber receive buffer
b7b705
b7b705
Upstream-commit: f2fadf490f66ad364f5a6f0356d626dda5f9a82f
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/sendf.c | 15 +++++++--------
b7b705
 1 file changed, 7 insertions(+), 8 deletions(-)
b7b705
b7b705
diff --git a/lib/sendf.c b/lib/sendf.c
b7b705
index c64d686..403025b 100644
b7b705
--- a/lib/sendf.c
b7b705
+++ b/lib/sendf.c
b7b705
@@ -155,21 +155,20 @@ void Curl_failf(struct SessionHandle *data, const char *fmt, ...)
b7b705
 {
b7b705
   va_list ap;
b7b705
   size_t len;
b7b705
+  char error[CURL_ERROR_SIZE + 2];
b7b705
   va_start(ap, fmt);
b7b705
 
b7b705
-  vsnprintf(data->state.buffer, BUFSIZE, fmt, ap);
b7b705
+  vsnprintf(error, CURL_ERROR_SIZE, fmt, ap);
b7b705
+  len = strlen(error);
b7b705
 
b7b705
   if(data->set.errorbuffer && !data->state.errorbuf) {
b7b705
-    snprintf(data->set.errorbuffer, CURL_ERROR_SIZE, "%s", data->state.buffer);
b7b705
+    strcpy(data->set.errorbuffer, error);
b7b705
     data->state.errorbuf = TRUE; /* wrote error string */
b7b705
   }
b7b705
   if(data->set.verbose) {
b7b705
-    len = strlen(data->state.buffer);
b7b705
-    if(len < BUFSIZE - 1) {
b7b705
-      data->state.buffer[len] = '\n';
b7b705
-      data->state.buffer[++len] = '\0';
b7b705
-    }
b7b705
-    Curl_debug(data, CURLINFO_TEXT, data->state.buffer, len, NULL);
b7b705
+    error[len] = '\n';
b7b705
+    error[++len] = '\0';
b7b705
+    Curl_debug(data, CURLINFO_TEXT, error, len, NULL);
b7b705
   }
b7b705
 
b7b705
   va_end(ap);
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 0a1107c2ad898e837f0aa4742c1b17ef186a3243 Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 00:50:50 +0200
b7b705
Subject: [PATCH 10/18] transfer: fix minor buffer_size mistake
b7b705
b7b705
Upstream-commit: 40a074f255de90003ab753f5d0ad61b74c62ca9b
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/transfer.c | 3 +--
b7b705
 1 file changed, 1 insertion(+), 2 deletions(-)
b7b705
b7b705
diff --git a/lib/transfer.c b/lib/transfer.c
b7b705
index dff6838..9b932de 100644
b7b705
--- a/lib/transfer.c
b7b705
+++ b/lib/transfer.c
b7b705
@@ -385,8 +385,7 @@ static CURLcode readwrite_data(struct SessionHandle *data,
b7b705
   /* This is where we loop until we have read everything there is to
b7b705
      read or we get a CURLE_AGAIN */
b7b705
   do {
b7b705
-    size_t buffersize = data->set.buffer_size?
b7b705
-      data->set.buffer_size : BUFSIZE;
b7b705
+    size_t buffersize = data->set.buffer_size;
b7b705
     size_t bytestoread = buffersize;
b7b705
 
b7b705
     if(k->size != -1 && !k->header) {
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 15408839da1b768974650bdf187c749432fdaefa Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 01:03:17 +0200
b7b705
Subject: [PATCH 11/18] http-proxy: use a dedicated CONNECT response buffer
b7b705
b7b705
To make it suitably independent of the receive buffer and its flexible
b7b705
size.
b7b705
b7b705
Upstream-commit: 0cab3a394a190c1cdf900cf2887ccdd6a7f213ef
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/http_proxy.c | 69 +++++++++++++++++++++++++++++++++++-------------
b7b705
 lib/url.c        |  1 +
b7b705
 lib/urldata.h    |  3 ++-
b7b705
 3 files changed, 53 insertions(+), 20 deletions(-)
b7b705
b7b705
diff --git a/lib/http_proxy.c b/lib/http_proxy.c
b7b705
index 4ab280f..13fb228 100644
b7b705
--- a/lib/http_proxy.c
b7b705
+++ b/lib/http_proxy.c
b7b705
@@ -83,20 +83,13 @@ CURLcode Curl_proxy_connect(struct connectdata *conn)
b7b705
   return CURLE_OK;
b7b705
 }
b7b705
 
b7b705
-/*
b7b705
- * Curl_proxyCONNECT() requires that we're connected to a HTTP proxy. This
b7b705
- * function will issue the necessary commands to get a seamless tunnel through
b7b705
- * this proxy. After that, the socket can be used just as a normal socket.
b7b705
- *
b7b705
- * 'blocking' set to TRUE means that this function will do the entire CONNECT
b7b705
- * + response in a blocking fashion. Should be avoided!
b7b705
- */
b7b705
+#define CONNECT_BUFFER_SIZE 16384
b7b705
 
b7b705
-CURLcode Curl_proxyCONNECT(struct connectdata *conn,
b7b705
-                           int sockindex,
b7b705
-                           const char *hostname,
b7b705
-                           unsigned short remote_port,
b7b705
-                           bool blocking)
b7b705
+CURLcode CONNECT(struct connectdata *conn,
b7b705
+                 int sockindex,
b7b705
+                 const char *hostname,
b7b705
+                 unsigned short remote_port,
b7b705
+                 bool blocking)
b7b705
 {
b7b705
   int subversion=0;
b7b705
   struct SessionHandle *data=conn->data;
b7b705
@@ -253,14 +246,19 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
b7b705
       char *ptr;
b7b705
       char *line_start;
b7b705
 
b7b705
-      ptr=data->state.buffer;
b7b705
+      ptr = conn->connect_buffer;
b7b705
       line_start = ptr;
b7b705
 
b7b705
       nread=0;
b7b705
       perline=0;
b7b705
       keepon=TRUE;
b7b705
 
b7b705
-      while((nread
b7b705
+      while((nread < (size_t)CONNECT_BUFFER_SIZE) && (keepon && !error)) {
b7b705
+
b7b705
+        if(ptr >= &conn->connect_buffer[CONNECT_BUFFER_SIZE]) {
b7b705
+          failf(data, "CONNECT response too large!");
b7b705
+          return CURLE_RECV_ERROR;
b7b705
+        }
b7b705
 
b7b705
         check = Curl_timeleft(data, NULL, TRUE);
b7b705
         if(check <= 0) {
b7b705
@@ -279,8 +277,8 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
b7b705
         case 0: /* timeout */
b7b705
           break;
b7b705
         default:
b7b705
-          DEBUGASSERT(ptr+BUFSIZE-nread <= data->state.buffer+BUFSIZE+1);
b7b705
-          result = Curl_read(conn, tunnelsocket, ptr, BUFSIZE-nread,
b7b705
+          result = Curl_read(conn, tunnelsocket, ptr,
b7b705
+                             CONNECT_BUFFER_SIZE - nread,
b7b705
                              &gotbytes);
b7b705
           if(result==CURLE_AGAIN)
b7b705
             continue; /* go loop yourself */
b7b705
@@ -313,7 +311,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
b7b705
               /* This means we are currently ignoring a response-body */
b7b705
 
b7b705
               nread = 0; /* make next read start over in the read buffer */
b7b705
-              ptr=data->state.buffer;
b7b705
+              ptr = conn->connect_buffer;
b7b705
               if(cl) {
b7b705
                 /* A Content-Length based body: simply count down the counter
b7b705
                    and make sure to break out of the loop when we're done! */
b7b705
@@ -386,7 +384,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
b7b705
                     /* end of response-headers from the proxy */
b7b705
                     nread = 0; /* make next read start over in the read
b7b705
                                   buffer */
b7b705
-                    ptr=data->state.buffer;
b7b705
+                    ptr = conn->connect_buffer;
b7b705
                     if((407 == k->httpcode) && !data->state.authproblem) {
b7b705
                       /* If we get a 407 response code with content length
b7b705
                          when we have no auth problem, we must ignore the
b7b705
@@ -585,4 +583,37 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
b7b705
   data->req.ignorebody = FALSE; /* put it (back) to non-ignore state */
b7b705
   return CURLE_OK;
b7b705
 }
b7b705
+
b7b705
+/*
b7b705
+ * Curl_proxyCONNECT() requires that we're connected to a HTTP proxy. This
b7b705
+ * function will issue the necessary commands to get a seamless tunnel through
b7b705
+ * this proxy. After that, the socket can be used just as a normal socket.
b7b705
+ *
b7b705
+ * 'blocking' set to TRUE means that this function will do the entire CONNECT
b7b705
+ * + response in a blocking fashion. Should be avoided!
b7b705
+ */
b7b705
+
b7b705
+CURLcode Curl_proxyCONNECT(struct connectdata *conn,
b7b705
+                           int sockindex,
b7b705
+                           const char *hostname,
b7b705
+                           unsigned short remote_port,
b7b705
+                           bool blocking)
b7b705
+{
b7b705
+  CURLcode result;
b7b705
+  if(TUNNEL_INIT == conn->tunnel_state[sockindex]) {
b7b705
+    if(!conn->connect_buffer) {
b7b705
+      conn->connect_buffer = malloc(CONNECT_BUFFER_SIZE);
b7b705
+      if(!conn->connect_buffer)
b7b705
+        return CURLE_OUT_OF_MEMORY;
b7b705
+    }
b7b705
+  }
b7b705
+  result = CONNECT(conn, sockindex, hostname, remote_port, blocking);
b7b705
+
b7b705
+  if(result || (TUNNEL_COMPLETE == conn->tunnel_state[sockindex]))
b7b705
+    Curl_safefree(conn->connect_buffer);
b7b705
+
b7b705
+  return result;
b7b705
+}
b7b705
+
b7b705
+
b7b705
 #endif /* CURL_DISABLE_PROXY */
b7b705
diff --git a/lib/url.c b/lib/url.c
b7b705
index 00fd15d..b86243b 100644
b7b705
--- a/lib/url.c
b7b705
+++ b/lib/url.c
b7b705
@@ -2523,6 +2523,7 @@ static void conn_free(struct connectdata *conn)
b7b705
   Curl_safefree(conn->host.rawalloc); /* host name buffer */
b7b705
   Curl_safefree(conn->proxy.rawalloc); /* proxy name buffer */
b7b705
   Curl_safefree(conn->master_buffer);
b7b705
+  Curl_safefree(conn->connect_buffer);
b7b705
 
b7b705
   Curl_llist_destroy(conn->send_pipe, NULL);
b7b705
   Curl_llist_destroy(conn->recv_pipe, NULL);
b7b705
diff --git a/lib/urldata.h b/lib/urldata.h
b7b705
index fbe69c2..c362c58 100644
b7b705
--- a/lib/urldata.h
b7b705
+++ b/lib/urldata.h
b7b705
@@ -1018,7 +1018,8 @@ struct connectdata {
b7b705
     TUNNEL_COMPLETE /* CONNECT response received completely */
b7b705
   } tunnel_state[2]; /* two separate ones to allow FTP */
b7b705
 
b7b705
-   struct connectbundle *bundle; /* The bundle we are member of */
b7b705
+  struct connectbundle *bundle; /* The bundle we are member of */
b7b705
+  char *connect_buffer; /* for CONNECT business */
b7b705
 };
b7b705
 
b7b705
 /* The end of connectdata. */
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 1122ecc4b522f24d466bcc2e658dd098a32d982f Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 14:37:06 +0200
b7b705
Subject: [PATCH 12/18] upload: UPLOAD_BUFSIZE is now for the upload buffer
b7b705
b7b705
Upstream-commit: 89cf6f38d2f525cbc8537a60061f5f37bb2f35f7
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/file.c     | 2 +-
b7b705
 lib/transfer.c | 2 +-
b7b705
 lib/urldata.h  | 6 +++++-
b7b705
 3 files changed, 7 insertions(+), 3 deletions(-)
b7b705
b7b705
diff --git a/lib/file.c b/lib/file.c
b7b705
index 98536cd..2f2e466 100644
b7b705
--- a/lib/file.c
b7b705
+++ b/lib/file.c
b7b705
@@ -364,7 +364,7 @@ static CURLcode file_upload(struct connectdata *conn)
b7b705
 
b7b705
   while(res == CURLE_OK) {
b7b705
     int readcount;
b7b705
-    res = Curl_fillreadbuffer(conn, BUFSIZE, &readcount);
b7b705
+    res = Curl_fillreadbuffer(conn, (int)data->set.buffer_size, &readcount);
b7b705
     if(res)
b7b705
       break;
b7b705
 
b7b705
diff --git a/lib/transfer.c b/lib/transfer.c
b7b705
index 9b932de..b707f8a 100644
b7b705
--- a/lib/transfer.c
b7b705
+++ b/lib/transfer.c
b7b705
@@ -835,7 +835,7 @@ static CURLcode readwrite_upload(struct SessionHandle *data,
b7b705
             sending_http_headers = FALSE;
b7b705
         }
b7b705
 
b7b705
-        result = Curl_fillreadbuffer(conn, BUFSIZE, &fillcount);
b7b705
+        result = Curl_fillreadbuffer(conn, UPLOAD_BUFSIZE, &fillcount);
b7b705
         if(result)
b7b705
           return result;
b7b705
 
b7b705
diff --git a/lib/urldata.h b/lib/urldata.h
b7b705
index c362c58..afe37c0 100644
b7b705
--- a/lib/urldata.h
b7b705
+++ b/lib/urldata.h
b7b705
@@ -200,6 +200,10 @@
b7b705
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
b7b705
 #define MIN_BUFSIZE 1024
b7b705
 
b7b705
+/* The upload buffer size, should not be smaller than CURL_MAX_WRITE_SIZE, as
b7b705
+   it needs to hold a full buffer as could be sent in a write callback */
b7b705
+#define UPLOAD_BUFSIZE CURL_MAX_WRITE_SIZE
b7b705
+
b7b705
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
b7b705
    of need. */
b7b705
 #define HEADERSIZE 256
b7b705
@@ -1179,7 +1183,7 @@ struct UrlState {
b7b705
   size_t headersize;   /* size of the allocation */
b7b705
 
b7b705
   char *buffer; /* download buffer */
b7b705
-  char uploadbuffer[BUFSIZE+1]; /* upload buffer */
b7b705
+  char uploadbuffer[UPLOAD_BUFSIZE+1]; /* upload buffer */
b7b705
   curl_off_t current_speed;  /* the ProgressShow() funcion sets this,
b7b705
                                 bytes / second */
b7b705
   bool this_is_a_follow; /* this is a followed Location: request */
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 4666a96fce7a2aa8c294cef7aec23e39a3d49673 Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 14:37:45 +0200
b7b705
Subject: [PATCH 13/18] krb5: use private buffer for temp string, not receive
b7b705
 buffer
b7b705
b7b705
Upstream-commit: c79f4908d461cecaa9976099dcbb8a63b351f19e
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/krb5.c | 14 +++++++++-----
b7b705
 1 file changed, 9 insertions(+), 5 deletions(-)
b7b705
b7b705
diff --git a/lib/krb5.c b/lib/krb5.c
b7b705
index 1e99c70..e4eb0b0 100644
b7b705
--- a/lib/krb5.c
b7b705
+++ b/lib/krb5.c
b7b705
@@ -174,6 +174,7 @@ krb5_auth(void *app_data, struct connectdata *conn)
b7b705
   gss_ctx_id_t *context = app_data;
b7b705
   struct gss_channel_bindings_struct chan;
b7b705
   size_t base64_sz = 0;
b7b705
+  char *stringp;
b7b705
 
b7b705
   if(getsockname(conn->sock[FIRSTSOCKET],
b7b705
                  (struct sockaddr *)LOCAL_ADDR, &l) < 0)
b7b705
@@ -205,16 +206,19 @@ krb5_auth(void *app_data, struct connectdata *conn)
b7b705
         return -1;
b7b705
     }
b7b705
 
b7b705
-    input_buffer.value = data->state.buffer;
b7b705
-    input_buffer.length = snprintf(input_buffer.value, BUFSIZE, "%s@%s",
b7b705
-                                   service, host);
b7b705
+    stringp = aprintf("%s@%s", service, host);
b7b705
+    if(!stringp)
b7b705
+      return -2;
b7b705
+
b7b705
+    input_buffer.value = stringp;
b7b705
+    input_buffer.length = strlen(stringp);
b7b705
     maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE,
b7b705
                           &gssname);
b7b705
+    free(stringp);
b7b705
     if(maj != GSS_S_COMPLETE) {
b7b705
       gss_release_name(&min, &gssname);
b7b705
       if(service == srv_host) {
b7b705
-        Curl_failf(data, "Error importing service name %s",
b7b705
-                   input_buffer.value);
b7b705
+        Curl_failf(data, "Error importing service name %s@%s", service, host);
b7b705
         return AUTH_ERROR;
b7b705
       }
b7b705
       service = srv_host;
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 4725e3cbe9af074304a4735b6ac667a154081b99 Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 14:38:34 +0200
b7b705
Subject: [PATCH 14/18] buffer: use data->set.buffer_size instead of BUFSIZE
b7b705
b7b705
... to properly use the dynamically set buffer size!
b7b705
b7b705
Upstream-commit: e40e9d7f0decc799e3ccfe2c418632f8bb52031a
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/file.c     |  4 ++--
b7b705
 lib/ftp.c      |  5 +++--
b7b705
 lib/http.c     |  7 ++++---
b7b705
 lib/sendf.c    |  9 ++++-----
b7b705
 lib/smtp.c     |  2 +-
b7b705
 lib/ssh.c      |  5 +++--
b7b705
 lib/telnet.c   | 10 +++++-----
b7b705
 lib/transfer.c |  4 +---
b7b705
 8 files changed, 23 insertions(+), 23 deletions(-)
b7b705
b7b705
diff --git a/lib/file.c b/lib/file.c
b7b705
index 2f2e466..ddac28f 100644
b7b705
--- a/lib/file.c
b7b705
+++ b/lib/file.c
b7b705
@@ -558,8 +558,8 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
b7b705
   while(res == CURLE_OK) {
b7b705
     /* Don't fill a whole buffer if we want less than all data */
b7b705
     size_t bytestoread =
b7b705
-      (expected_size < CURL_OFF_T_C(BUFSIZE) - CURL_OFF_T_C(1)) ?
b7b705
-      curlx_sotouz(expected_size) : BUFSIZE - 1;
b7b705
+      (expected_size < data->set.buffer_size) ?
b7b705
+      curlx_sotouz(expected_size) : (size_t)data->set.buffer_size;
b7b705
 
b7b705
     nread = read(fd, buf, bytestoread);
b7b705
 
b7b705
diff --git a/lib/ftp.c b/lib/ftp.c
b7b705
index c40d7e4..3a8b4b2 100644
b7b705
--- a/lib/ftp.c
b7b705
+++ b/lib/ftp.c
b7b705
@@ -1646,8 +1646,9 @@ static CURLcode ftp_state_ul_setup(struct connectdata *conn,
b7b705
         curl_off_t passed=0;
b7b705
         do {
b7b705
           size_t readthisamountnow =
b7b705
-            (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
b7b705
-            BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
b7b705
+            (data->state.resume_from - passed > data->set.buffer_size) ?
b7b705
+            (size_t)data->set.buffer_size :
b7b705
+            curlx_sotouz(data->state.resume_from - passed);
b7b705
 
b7b705
           size_t actuallyread =
b7b705
             conn->fread_func(data->state.buffer, 1, readthisamountnow,
b7b705
diff --git a/lib/http.c b/lib/http.c
b7b705
index 6ecdda2..665447b 100644
b7b705
--- a/lib/http.c
b7b705
+++ b/lib/http.c
b7b705
@@ -1061,7 +1061,7 @@ CURLcode Curl_add_buffer_send(Curl_send_buffer *in,
b7b705
        buffer is using this size.
b7b705
     */
b7b705
 
b7b705
-    sendsize= (size > CURL_MAX_WRITE_SIZE)?CURL_MAX_WRITE_SIZE:size;
b7b705
+    sendsize = CURLMIN(size, CURL_MAX_WRITE_SIZE);
b7b705
 
b7b705
     /* OpenSSL is very picky and we must send the SAME buffer pointer to the
b7b705
        library when we attempt to re-send this buffer. Sending the same data
b7b705
@@ -2036,8 +2036,9 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
b7b705
           curl_off_t passed=0;
b7b705
           do {
b7b705
             size_t readthisamountnow =
b7b705
-              (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
b7b705
-              BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
b7b705
+              (data->state.resume_from - passed > data->set.buffer_size) ?
b7b705
+              (size_t)data->set.buffer_size :
b7b705
+              curlx_sotouz(data->state.resume_from - passed);
b7b705
 
b7b705
             size_t actuallyread =
b7b705
               data->set.fread_func(data->state.buffer, 1, readthisamountnow,
b7b705
diff --git a/lib/sendf.c b/lib/sendf.c
b7b705
index 403025b..fb0e6e8 100644
b7b705
--- a/lib/sendf.c
b7b705
+++ b/lib/sendf.c
b7b705
@@ -528,7 +528,8 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
b7b705
   ssize_t nread = 0;
b7b705
   size_t bytesfromsocket = 0;
b7b705
   char *buffertofill = NULL;
b7b705
-  bool pipelining = (conn->data->multi &&
b7b705
+  struct SessionHandle *data = conn->data;
b7b705
+  bool pipelining = (data->multi &&
b7b705
                      Curl_multi_canPipeline(conn->data->multi)) ? TRUE : FALSE;
b7b705
 
b7b705
   /* Set 'num' to 0 or 1, depending on which socket that has been sent here.
b7b705
@@ -554,13 +555,11 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
b7b705
     }
b7b705
     /* If we come here, it means that there is no data to read from the buffer,
b7b705
      * so we read from the socket */
b7b705
-    bytesfromsocket = CURLMIN(sizerequested, BUFSIZE * sizeof (char));
b7b705
+    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
b7b705
     buffertofill = conn->master_buffer;
b7b705
   }
b7b705
   else {
b7b705
-    bytesfromsocket = CURLMIN((long)sizerequested,
b7b705
-                              conn->data->set.buffer_size ?
b7b705
-                              conn->data->set.buffer_size : BUFSIZE);
b7b705
+    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
b7b705
     buffertofill = buf;
b7b705
   }
b7b705
 
b7b705
diff --git a/lib/smtp.c b/lib/smtp.c
b7b705
index d2d4aeb..ccc2dc7 100644
b7b705
--- a/lib/smtp.c
b7b705
+++ b/lib/smtp.c
b7b705
@@ -1665,7 +1665,7 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, ssize_t nread)
b7b705
 
b7b705
   /* Do we need to allocate the scatch buffer? */
b7b705
   if(!data->state.scratch) {
b7b705
-    data->state.scratch = malloc(2 * BUFSIZE);
b7b705
+    data->state.scratch = malloc(2 * data->set.buffer_size);
b7b705
 
b7b705
     if(!data->state.scratch) {
b7b705
       failf (data, "Failed to alloc scratch buffer!");
b7b705
diff --git a/lib/ssh.c b/lib/ssh.c
b7b705
index 589d4a3..169ef1b 100644
b7b705
--- a/lib/ssh.c
b7b705
+++ b/lib/ssh.c
b7b705
@@ -1711,8 +1711,9 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
b7b705
             curl_off_t passed=0;
b7b705
             do {
b7b705
               size_t readthisamountnow =
b7b705
-                (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
b7b705
-                BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
b7b705
+                (data->state.resume_from - passed > data->set.buffer_size) ?
b7b705
+                data->set.buffer_size :
b7b705
+                curlx_sotouz(data->state.resume_from - passed);
b7b705
 
b7b705
               size_t actuallyread =
b7b705
                 conn->fread_func(data->state.buffer, 1, readthisamountnow,
b7b705
diff --git a/lib/telnet.c b/lib/telnet.c
b7b705
index e43b423..4492514 100644
b7b705
--- a/lib/telnet.c
b7b705
+++ b/lib/telnet.c
b7b705
@@ -1429,7 +1429,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
b7b705
       for(;;) {
b7b705
         if(obj_count == 1) {
b7b705
           /* read from user-supplied method */
b7b705
-          code = (int)conn->fread_func(buf, 1, BUFSIZE - 1, conn->fread_in);
b7b705
+          code = (int)conn->fread_func(buf, 1, buf_size, conn->fread_in);
b7b705
           if(code == CURL_READFUNC_ABORT) {
b7b705
             keepon = FALSE;
b7b705
             code = CURLE_READ_ERROR;
b7b705
@@ -1502,7 +1502,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
b7b705
       }
b7b705
       if(events.lNetworkEvents & FD_READ) {
b7b705
         /* read data from network */
b7b705
-        code = Curl_read(conn, sockfd, buf, BUFSIZE - 1, &nread);
b7b705
+        code = Curl_read(conn, sockfd, buf, data->set.buffer_size, &nread);
b7b705
         /* read would've blocked. Loop again */
b7b705
         if(code == CURLE_AGAIN)
b7b705
           break;
b7b705
@@ -1591,7 +1591,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
b7b705
     default:                    /* read! */
b7b705
       if(pfd[0].revents & POLLIN) {
b7b705
         /* read data from network */
b7b705
-        code = Curl_read(conn, sockfd, buf, BUFSIZE - 1, &nread);
b7b705
+        code = Curl_read(conn, sockfd, buf, data->set.buffer_size, &nread);
b7b705
         /* read would've blocked. Loop again */
b7b705
         if(code == CURLE_AGAIN)
b7b705
           break;
b7b705
@@ -1627,12 +1627,12 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
b7b705
       nread = 0;
b7b705
       if(poll_cnt == 2) {
b7b705
         if(pfd[1].revents & POLLIN) { /* read from in file */
b7b705
-          nread = read(pfd[1].fd, buf, BUFSIZE - 1);
b7b705
+          nread = read(pfd[1].fd, buf, data->set.buffer_size);
b7b705
         }
b7b705
       }
b7b705
       else {
b7b705
         /* read from user-supplied method */
b7b705
-        nread = (int)conn->fread_func(buf, 1, BUFSIZE - 1, conn->fread_in);
b7b705
+        nread = (int)conn->fread_func(buf, 1, data->set.buffer_size, conn->fread_in);
b7b705
         if(nread == CURL_READFUNC_ABORT) {
b7b705
           keepon = FALSE;
b7b705
           break;
b7b705
diff --git a/lib/transfer.c b/lib/transfer.c
b7b705
index b707f8a..77f0937 100644
b7b705
--- a/lib/transfer.c
b7b705
+++ b/lib/transfer.c
b7b705
@@ -626,8 +626,6 @@ static CURLcode readwrite_data(struct SessionHandle *data,
b7b705
         excess = (size_t)(k->bytecount + nread - k->maxdownload);
b7b705
         if(excess > 0 && !k->ignorebody) {
b7b705
           if(conn->data->multi && Curl_multi_canPipeline(conn->data->multi)) {
b7b705
-            /* The 'excess' amount below can't be more than BUFSIZE which
b7b705
-               always will fit in a size_t */
b7b705
             infof(data,
b7b705
                   "Rewinding stream by : %zu"
b7b705
                   " bytes on url %s (size = %" FORMAT_OFF_T
b7b705
@@ -880,7 +878,7 @@ static CURLcode readwrite_upload(struct SessionHandle *data,
b7b705
 #endif
b7b705
          (data->set.crlf))) {
b7b705
         if(data->state.scratch == NULL)
b7b705
-          data->state.scratch = malloc(2*BUFSIZE);
b7b705
+          data->state.scratch = malloc(2 * data->set.buffer_size);
b7b705
         if(data->state.scratch == NULL) {
b7b705
           failf (data, "Failed to alloc scratch buffer!");
b7b705
           return CURLE_OUT_OF_MEMORY;
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From a8725233e1af133dd1d89c89b30ef4396c3f2e5b Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 15:19:19 +0200
b7b705
Subject: [PATCH 15/18] sendf: remove use of BUFSIZE from debug data
b7b705
 conversions
b7b705
b7b705
The buffer can have other sizes.
b7b705
b7b705
Upstream-commit: 7ee52c25f35816968b86d32eaef70ab743a457d4
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/sendf.c | 51 ++++++++++++++++++++++++++-------------------------
b7b705
 1 file changed, 26 insertions(+), 25 deletions(-)
b7b705
b7b705
diff --git a/lib/sendf.c b/lib/sendf.c
b7b705
index fb0e6e8..bad4683 100644
b7b705
--- a/lib/sendf.c
b7b705
+++ b/lib/sendf.c
b7b705
@@ -584,21 +584,19 @@ static int showit(struct SessionHandle *data, curl_infotype type,
b7b705
 {
b7b705
   static const char s_infotype[CURLINFO_END][3] = {
b7b705
     "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
b7b705
+  int rc = 0;
b7b705
 
b7b705
 #ifdef CURL_DOES_CONVERSIONS
b7b705
-  char buf[BUFSIZE+1];
b7b705
+  char *buf = NULL;
b7b705
   size_t conv_size = 0;
b7b705
 
b7b705
   switch(type) {
b7b705
   case CURLINFO_HEADER_OUT:
b7b705
-    /* assume output headers are ASCII */
b7b705
-    /* copy the data into my buffer so the original is unchanged */
b7b705
-    if(size > BUFSIZE) {
b7b705
-      size = BUFSIZE; /* truncate if necessary */
b7b705
-      buf[BUFSIZE] = '\0';
b7b705
-    }
b7b705
+    buf = Curl_memdup(ptr, size);
b7b705
+    if(!buf)
b7b705
+      return 1;
b7b705
     conv_size = size;
b7b705
-    memcpy(buf, ptr, size);
b7b705
+
b7b705
     /* Special processing is needed for this block if it
b7b705
      * contains both headers and data (separated by CRLFCRLF).
b7b705
      * We want to convert just the headers, leaving the data as-is.
b7b705
@@ -626,26 +624,29 @@ static int showit(struct SessionHandle *data, curl_infotype type,
b7b705
 #endif /* CURL_DOES_CONVERSIONS */
b7b705
 
b7b705
   if(data->set.fdebug)
b7b705
-    return (*data->set.fdebug)(data, type, ptr, size,
b7b705
-                               data->set.debugdata);
b7b705
-
b7b705
-  switch(type) {
b7b705
-  case CURLINFO_TEXT:
b7b705
-  case CURLINFO_HEADER_OUT:
b7b705
-  case CURLINFO_HEADER_IN:
b7b705
-    fwrite(s_infotype[type], 2, 1, data->set.err);
b7b705
-    fwrite(ptr, size, 1, data->set.err);
b7b705
+    rc = (*data->set.fdebug)(data, type, ptr, size, data->set.debugdata);
b7b705
+  else {
b7b705
+    switch(type) {
b7b705
+    case CURLINFO_TEXT:
b7b705
+    case CURLINFO_HEADER_OUT:
b7b705
+    case CURLINFO_HEADER_IN:
b7b705
+      fwrite(s_infotype[type], 2, 1, data->set.err);
b7b705
+      fwrite(ptr, size, 1, data->set.err);
b7b705
 #ifdef CURL_DOES_CONVERSIONS
b7b705
-    if(size != conv_size) {
b7b705
-      /* we had untranslated data so we need an explicit newline */
b7b705
-      fwrite("\n", 1, 1, data->set.err);
b7b705
-    }
b7b705
+      if(size != conv_size) {
b7b705
+        /* we had untranslated data so we need an explicit newline */
b7b705
+        fwrite("\n", 1, 1, data->set.err);
b7b705
+      }
b7b705
 #endif
b7b705
-    break;
b7b705
-  default: /* nada */
b7b705
-    break;
b7b705
+      break;
b7b705
+    default: /* nada */
b7b705
+      break;
b7b705
+    }
b7b705
   }
b7b705
-  return 0;
b7b705
+#ifdef CURL_DOES_CONVERSIONS
b7b705
+  free(buf);
b7b705
+#endif
b7b705
+  return rc;
b7b705
 }
b7b705
 
b7b705
 int Curl_debug(struct SessionHandle *data, curl_infotype type,
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From a600c050d0fcaa5bff272f47b9be0a653a4071c6 Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 25 Apr 2017 15:31:14 +0200
b7b705
Subject: [PATCH 16/18] BUFSIZE: rename to READBUFFER_*, make separate
b7b705
 MASTERBUF_SIZE
b7b705
b7b705
Upstream-commit: e3ed5cb380e615e91d99b09da9f0ead0eaf3e0b5
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/multi.c   |  4 ++--
b7b705
 lib/sendf.c   |  2 +-
b7b705
 lib/url.c     | 25 ++++++++++++++-----------
b7b705
 lib/urldata.h | 10 +++-------
b7b705
 4 files changed, 20 insertions(+), 21 deletions(-)
b7b705
b7b705
diff --git a/lib/multi.c b/lib/multi.c
b7b705
index 3029fa6..39a0938 100644
b7b705
--- a/lib/multi.c
b7b705
+++ b/lib/multi.c
b7b705
@@ -1452,7 +1452,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
b7b705
 
b7b705
         /* calculate upload rate-limitation timeout. */
b7b705
         buffersize = (int)(data->set.buffer_size ?
b7b705
-                           data->set.buffer_size : BUFSIZE);
b7b705
+                           data->set.buffer_size : MASTERBUF_SIZE);
b7b705
         timeout_ms = Curl_sleep_time(data->set.max_send_speed,
b7b705
                                      data->progress.ulspeed, buffersize);
b7b705
         Curl_expire(data, timeout_ms);
b7b705
@@ -1468,7 +1468,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
b7b705
 
b7b705
          /* Calculate download rate-limitation timeout. */
b7b705
         buffersize = (int)(data->set.buffer_size ?
b7b705
-                           data->set.buffer_size : BUFSIZE);
b7b705
+                           data->set.buffer_size : MASTERBUF_SIZE);
b7b705
         timeout_ms = Curl_sleep_time(data->set.max_recv_speed,
b7b705
                                      data->progress.dlspeed, buffersize);
b7b705
         Curl_expire(data, timeout_ms);
b7b705
diff --git a/lib/sendf.c b/lib/sendf.c
b7b705
index bad4683..95d1a51 100644
b7b705
--- a/lib/sendf.c
b7b705
+++ b/lib/sendf.c
b7b705
@@ -555,7 +555,7 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
b7b705
     }
b7b705
     /* If we come here, it means that there is no data to read from the buffer,
b7b705
      * so we read from the socket */
b7b705
-    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
b7b705
+    bytesfromsocket = CURLMIN(sizerequested, MASTERBUF_SIZE);
b7b705
     buffertofill = conn->master_buffer;
b7b705
   }
b7b705
   else {
b7b705
diff --git a/lib/url.c b/lib/url.c
b7b705
index b86243b..cb3f3c3 100644
b7b705
--- a/lib/url.c
b7b705
+++ b/lib/url.c
b7b705
@@ -242,6 +242,10 @@ static const struct Curl_handler * const protocols[] = {
b7b705
   (struct Curl_handler *) NULL
b7b705
 };
b7b705
 
b7b705
+#define READBUFFER_SIZE CURL_MAX_WRITE_SIZE
b7b705
+#define READBUFFER_MAX  CURL_MAX_READ_SIZE
b7b705
+#define READBUFFER_MIN  1024
b7b705
+
b7b705
 /*
b7b705
  * Dummy handler for undefined protocol schemes.
b7b705
  */
b7b705
@@ -577,7 +581,7 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
b7b705
   set->tcp_keepintvl = 60;
b7b705
   set->tcp_keepidle = 60;
b7b705
 
b7b705
-  set->buffer_size = BUFSIZE;
b7b705
+  set->buffer_size = READBUFFER_SIZE;
b7b705
 
b7b705
   return res;
b7b705
 }
b7b705
@@ -615,7 +619,7 @@ CURLcode Curl_open(struct SessionHandle **curl)
b7b705
 
b7b705
   /* We do some initial setup here, all those fields that can't be just 0 */
b7b705
 
b7b705
-  data->state.buffer = malloc(BUFSIZE + 1);
b7b705
+  data->state.buffer = malloc(READBUFFER_SIZE + 1);
b7b705
   if(!data->state.buffer) {
b7b705
     DEBUGF(fprintf(stderr, "Error: malloc of buffer failed\n"));
b7b705
     res = CURLE_OUT_OF_MEMORY;
b7b705
@@ -1969,17 +1973,16 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
b7b705
      */
b7b705
     arg = va_arg(param, long);
b7b705
 
b7b705
-    if(arg > MAX_BUFSIZE)
b7b705
-      arg = MAX_BUFSIZE; /* huge internal default */
b7b705
+    if(arg > READBUFFER_MAX)
b7b705
+      arg = READBUFFER_MAX; /* huge internal default */
b7b705
     else if(arg < 1)
b7b705
-      arg = BUFSIZE;
b7b705
-    else if(arg < MIN_BUFSIZE)
b7b705
-      arg = BUFSIZE;
b7b705
+      arg = READBUFFER_SIZE;
b7b705
+    else if(arg < READBUFFER_MIN)
b7b705
+      arg = READBUFFER_MIN;
b7b705
 
b7b705
     /* Resize only if larger than default buffer size. */
b7b705
-    if(arg > BUFSIZE) {
b7b705
-      data->state.buffer = realloc(data->state.buffer,
b7b705
-                                   data->set.buffer_size + 1);
b7b705
+    if(arg > READBUFFER_SIZE) {
b7b705
+      data->state.buffer = realloc(data->state.buffer, arg + 1);
b7b705
       if(!data->state.buffer) {
b7b705
         DEBUGF(fprintf(stderr, "Error: realloc of buffer failed\n"));
b7b705
         result = CURLE_OUT_OF_MEMORY;
b7b705
@@ -3537,7 +3540,7 @@ static struct connectdata *allocate_conn(struct SessionHandle *data)
b7b705
   if(data->multi && Curl_multi_canPipeline(data->multi) &&
b7b705
       !conn->master_buffer) {
b7b705
     /* Allocate master_buffer to be used for pipelining */
b7b705
-    conn->master_buffer = calloc(BUFSIZE, sizeof (char));
b7b705
+    conn->master_buffer = calloc(MASTERBUF_SIZE, sizeof (char));
b7b705
     if(!conn->master_buffer)
b7b705
       goto error;
b7b705
   }
b7b705
diff --git a/lib/urldata.h b/lib/urldata.h
b7b705
index afe37c0..d10c784 100644
b7b705
--- a/lib/urldata.h
b7b705
+++ b/lib/urldata.h
b7b705
@@ -193,17 +193,13 @@
b7b705
 #include <libssh2_sftp.h>
b7b705
 #endif /* HAVE_LIBSSH2_H */
b7b705
 
b7b705
-/* Download buffer size, keep it fairly big for speed reasons */
b7b705
-#undef BUFSIZE
b7b705
-#define BUFSIZE CURL_MAX_WRITE_SIZE
b7b705
-#undef MAX_BUFSIZE
b7b705
-#define MAX_BUFSIZE CURL_MAX_READ_SIZE
b7b705
-#define MIN_BUFSIZE 1024
b7b705
-
b7b705
 /* The upload buffer size, should not be smaller than CURL_MAX_WRITE_SIZE, as
b7b705
    it needs to hold a full buffer as could be sent in a write callback */
b7b705
 #define UPLOAD_BUFSIZE CURL_MAX_WRITE_SIZE
b7b705
 
b7b705
+/* The "master buffer" is for HTTP pipelining */
b7b705
+#define MASTERBUF_SIZE 16384
b7b705
+
b7b705
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
b7b705
    of need. */
b7b705
 #define HEADERSIZE 256
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
b7b705
From 40c7b1ccca9fcf3b0ce261f098faebd58ed439ac Mon Sep 17 00:00:00 2001
b7b705
From: Daniel Stenberg <daniel@haxx.se>
b7b705
Date: Tue, 2 May 2017 08:32:04 +0200
b7b705
Subject: [PATCH 17/18] ssh: fix compiler warning from e40e9d7f0de
b7b705
b7b705
Upstream-commit: eab6732fde094073480af5039b6fb495cbc3fb8a
b7b705
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
b7b705
---
b7b705
 lib/ssh.c | 2 +-
b7b705
 1 file changed, 1 insertion(+), 1 deletion(-)
b7b705
b7b705
diff --git a/lib/ssh.c b/lib/ssh.c
b7b705
index 169ef1b..b1f136e 100644
b7b705
--- a/lib/ssh.c
b7b705
+++ b/lib/ssh.c
b7b705
@@ -1712,7 +1712,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
b7b705
             do {
b7b705
               size_t readthisamountnow =
b7b705
                 (data->state.resume_from - passed > data->set.buffer_size) ?
b7b705
-                data->set.buffer_size :
b7b705
+                (size_t)data->set.buffer_size :
b7b705
                 curlx_sotouz(data->state.resume_from - passed);
b7b705
 
b7b705
               size_t actuallyread =
b7b705
-- 
b7b705
2.17.2
b7b705
b7b705
f0f8d7
From 9f3810bae5fad685e848a39750863557e17a0163 Mon Sep 17 00:00:00 2001
f0f8d7
From: Daniel Stenberg <daniel@haxx.se>
f0f8d7
Date: Thu, 8 Mar 2018 10:33:16 +0100
b7b705
Subject: [PATCH 18/18] readwrite: make sure excess reads don't go beyond
b7b705
 buffer end
f0f8d7
f0f8d7
CVE-2018-1000122
f0f8d7
Bug: https://curl.haxx.se/docs/adv_2018-b047.html
f0f8d7
f0f8d7
Detected by OSS-fuzz
f0f8d7
f0f8d7
Upstream-commit: d52dc4760f6d9ca1937eefa2093058a952465128
f0f8d7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f0f8d7
---
f0f8d7
 lib/transfer.c | 9 +++++++--
f0f8d7
 1 file changed, 7 insertions(+), 2 deletions(-)
f0f8d7
f0f8d7
diff --git a/lib/transfer.c b/lib/transfer.c
f0f8d7
index dff6838..7ad6e3c 100644
f0f8d7
--- a/lib/transfer.c
f0f8d7
+++ b/lib/transfer.c
b7b705
@@ -735,10 +735,15 @@ static CURLcode readwrite_data(struct SessionHandle *data,
f0f8d7
 
f0f8d7
     } /* if(! header and data to read ) */
f0f8d7
 
f0f8d7
-    if(conn->handler->readwrite &&
f0f8d7
-       (excess > 0 && !conn->bits.stream_was_rewound)) {
f0f8d7
+    if(conn->handler->readwrite && excess && !conn->bits.stream_was_rewound) {
f0f8d7
       /* Parse the excess data */
f0f8d7
       k->str += nread;
f0f8d7
+
f0f8d7
+      if(&k->str[excess] > &k->buf[data->set.buffer_size]) {
f0f8d7
+        /* the excess amount was too excessive(!), make sure
f0f8d7
+           it doesn't read out of buffer */
f0f8d7
+        excess = &k->buf[data->set.buffer_size] - k->str;
f0f8d7
+      }
f0f8d7
       nread = (ssize_t)excess;
f0f8d7
 
f0f8d7
       result = conn->handler->readwrite(data, conn, &nread, &readmore);
f0f8d7
-- 
f0f8d7
2.14.3
f0f8d7