Blame SOURCES/0061-curl-7.29.0-CVE-2018-1000122.patch

6311d4
From 9f163418fabbe6219ab04cfe9bf81d2f33bd54d7 Mon Sep 17 00:00:00 2001
6311d4
From: Richy Kim <richy@fb.com>
6311d4
Date: Tue, 20 Dec 2016 05:48:15 -0500
230636
Subject: [PATCH 01/18] CURLOPT_BUFFERSIZE: support enlarging receive buffer
6311d4
6311d4
Replace use of fixed macro BUFSIZE to define the size of the receive
6311d4
buffer.  Reappropriate CURLOPT_BUFFERSIZE to include enlarging receive
6311d4
buffer size.  Upon setting, resize buffer if larger than the current
6311d4
default size up to a MAX_BUFSIZE (512KB). This can benefit protocols
6311d4
like SFTP.
6311d4
6311d4
Closes #1222
6311d4
6311d4
Upstream-commit: 6b7616690e5370c21e3a760321af6bf4edbabfb6
6311d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
6311d4
---
6311d4
 docs/libcurl/curl_easy_setopt.3  | 12 ++++++------
6311d4
 docs/libcurl/symbols-in-versions |  1 +
6311d4
 include/curl/curl.h              |  5 +++++
6311d4
 lib/easy.c                       |  6 ++++++
6311d4
 lib/file.c                       |  2 +-
6311d4
 lib/ftp.c                        |  4 ++--
6311d4
 lib/http.c                       |  3 ++-
6311d4
 lib/telnet.c                     |  5 +++--
6311d4
 lib/url.c                        | 28 +++++++++++++++++++++++-----
6311d4
 lib/urldata.h                    |  5 ++++-
6311d4
 10 files changed, 53 insertions(+), 18 deletions(-)
6311d4
6311d4
diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3
6311d4
index cbebfba..17b632f 100644
6311d4
--- a/docs/libcurl/curl_easy_setopt.3
6311d4
+++ b/docs/libcurl/curl_easy_setopt.3
6311d4
@@ -938,12 +938,12 @@ to using the share interface instead! See \fICURLOPT_SHARE\fP and
6311d4
 .IP CURLOPT_BUFFERSIZE
6311d4
 Pass a long specifying your preferred size (in bytes) for the receive buffer
6311d4
 in libcurl.  The main point of this would be that the write callback gets
6311d4
-called more often and with smaller chunks. This is just treated as a request,
6311d4
-not an order. You cannot be guaranteed to actually get the given size. (Added
6311d4
-in 7.10)
6311d4
-
6311d4
-This size is by default set as big as possible (CURL_MAX_WRITE_SIZE), so it
6311d4
-only makes sense to use this option if you want it smaller.
6311d4
+called more often and with smaller chunks.  Secondly, for some protocols,
6311d4
+there's a benefit of having a larger buffer for performance.  This is just
6311d4
+treated as a request, not an order. You cannot be guaranteed to actually get
6311d4
+the given size.  This buffer size is by default \fICURL_MAX_WRITE_SIZE\fP
6311d4
+(16kB). The maximum buffer size allowed to set is \fICURL_MAX_READ_SIZE\fP
6311d4
+(512kB).  (Added in 7.10)
6311d4
 .IP CURLOPT_PORT
6311d4
 Pass a long specifying what remote port number to connect to, instead of the
6311d4
 one specified in the URL or the default port for the used protocol.
6311d4
diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
6311d4
index b0b6232..e2cce4c 100644
6311d4
--- a/docs/libcurl/symbols-in-versions
6311d4
+++ b/docs/libcurl/symbols-in-versions
6311d4
@@ -639,6 +639,7 @@ CURL_LOCK_TYPE_DNS              7.10          -           7.10.2
6311d4
 CURL_LOCK_TYPE_NONE             7.10          -           7.10.2
6311d4
 CURL_LOCK_TYPE_SSL_SESSION      7.10          -           7.10.2
6311d4
 CURL_MAX_HTTP_HEADER            7.19.7
6311d4
+CURL_MAX_READ_SIZE              7.53.0
6311d4
 CURL_MAX_WRITE_SIZE             7.9.7
6311d4
 CURL_NETRC_IGNORED              7.9.8
6311d4
 CURL_NETRC_OPTIONAL             7.9.8
6311d4
diff --git a/include/curl/curl.h b/include/curl/curl.h
6311d4
index 0375a64..8b639fa 100644
6311d4
--- a/include/curl/curl.h
6311d4
+++ b/include/curl/curl.h
6311d4
@@ -170,6 +170,11 @@ typedef int (*curl_progress_callback)(void *clientp,
6311d4
                                       double ultotal,
6311d4
                                       double ulnow);
6311d4
 
6311d4
+#ifndef CURL_MAX_READ_SIZE
6311d4
+  /* The maximum receive buffer size configurable via CURLOPT_BUFFERSIZE. */
6311d4
+#define CURL_MAX_READ_SIZE 524288
6311d4
+#endif
6311d4
+
6311d4
 #ifndef CURL_MAX_WRITE_SIZE
6311d4
   /* Tests have proven that 20K is a very bad buffer size for uploads on
6311d4
      Windows, while 16K for some odd reason performed a lot better.
6311d4
diff --git a/lib/easy.c b/lib/easy.c
6311d4
index 0e9ba18..5d4d5ae 100644
6311d4
--- a/lib/easy.c
6311d4
+++ b/lib/easy.c
6311d4
@@ -563,6 +563,11 @@ CURL *curl_easy_duphandle(CURL *incurl)
6311d4
    * get setup on-demand in the code, as that would probably decrease
6311d4
    * the likeliness of us forgetting to init a buffer here in the future.
6311d4
    */
6311d4
+  outcurl->set.buffer_size = data->set.buffer_size;
6311d4
+  outcurl->state.buffer = malloc(CURL_BUFSIZE(outcurl->set.buffer_size) + 1);
6311d4
+  if(!outcurl->state.buffer)
6311d4
+    goto fail;
6311d4
+
6311d4
   outcurl->state.headerbuff = malloc(HEADERSIZE);
6311d4
   if(!outcurl->state.headerbuff)
6311d4
     goto fail;
6311d4
@@ -633,6 +638,7 @@ CURL *curl_easy_duphandle(CURL *incurl)
6311d4
   if(outcurl) {
6311d4
     curl_slist_free_all(outcurl->change.cookielist);
6311d4
     outcurl->change.cookielist = NULL;
6311d4
+    Curl_safefree(outcurl->state.buffer);
6311d4
     Curl_safefree(outcurl->state.headerbuff);
6311d4
     Curl_safefree(outcurl->change.url);
6311d4
     Curl_safefree(outcurl->change.referer);
6311d4
diff --git a/lib/file.c b/lib/file.c
6311d4
index 038bf42..1ad4758 100644
6311d4
--- a/lib/file.c
6311d4
+++ b/lib/file.c
6311d4
@@ -473,7 +473,7 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
6311d4
      date. */
6311d4
   if(data->set.opt_no_body && data->set.include_header && fstated) {
6311d4
     CURLcode result;
6311d4
-    snprintf(buf, sizeof(data->state.buffer),
6311d4
+    snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
6311d4
              "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);
6311d4
     result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
6311d4
     if(result)
6311d4
diff --git a/lib/ftp.c b/lib/ftp.c
6311d4
index a9826ce..730b695 100644
6311d4
--- a/lib/ftp.c
6311d4
+++ b/lib/ftp.c
6311d4
@@ -2136,7 +2136,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
6311d4
         /* we have a time, reformat it */
6311d4
         time_t secs=time(NULL);
6311d4
         /* using the good old yacc/bison yuck */
6311d4
-        snprintf(buf, sizeof(conn->data->state.buffer),
6311d4
+        snprintf(buf, CURL_BUFSIZE(conn->data->set.buffer_size),
6311d4
                  "%04d%02d%02d %02d:%02d:%02d GMT",
6311d4
                  year, month, day, hour, minute, second);
6311d4
         /* now, convert this into a time() value: */
6311d4
@@ -2347,7 +2347,7 @@ static CURLcode ftp_state_size_resp(struct connectdata *conn,
6311d4
   if(instate == FTP_SIZE) {
6311d4
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
6311d4
     if(-1 != filesize) {
6311d4
-      snprintf(buf, sizeof(data->state.buffer),
6311d4
+      snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
6311d4
                "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);
6311d4
       result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
6311d4
       if(result)
6311d4
diff --git a/lib/http.c b/lib/http.c
6311d4
index 1487fb2..f4368c4 100644
6311d4
--- a/lib/http.c
6311d4
+++ b/lib/http.c
6311d4
@@ -247,7 +247,8 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
6311d4
     pwd = conn->passwd;
6311d4
   }
6311d4
 
6311d4
-  snprintf(data->state.buffer, sizeof(data->state.buffer), "%s:%s", user, pwd);
6311d4
+  snprintf(data->state.buffer, CURL_BUFSIZE(data->set.buffer_size),
6311d4
+           "%s:%s", user, pwd);
6311d4
 
6311d4
   error = Curl_base64_encode(data,
6311d4
                              data->state.buffer, strlen(data->state.buffer),
6311d4
diff --git a/lib/telnet.c b/lib/telnet.c
6311d4
index 77d8b7b..89452dd 100644
6311d4
--- a/lib/telnet.c
6311d4
+++ b/lib/telnet.c
6311d4
@@ -1421,6 +1421,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
6311d4
 
6311d4
   /* Keep on listening and act on events */
6311d4
   while(keepon) {
6311d4
+    const size_t buf_size = CURL_BUFSIZE(data->set.buffer_size);
6311d4
     waitret = WaitForMultipleObjects(obj_count, objs, FALSE, wait_timeout);
6311d4
     switch(waitret) {
6311d4
     case WAIT_TIMEOUT:
6311d4
@@ -1455,7 +1456,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
6311d4
           if(!readfile_read)
6311d4
             break;
6311d4
 
6311d4
-          if(!ReadFile(stdin_handle, buf, sizeof(data->state.buffer),
6311d4
+          if(!ReadFile(stdin_handle, buf, buf_size,
6311d4
                        &readfile_read, NULL)) {
6311d4
             keepon = FALSE;
6311d4
             code = CURLE_READ_ERROR;
6311d4
@@ -1474,7 +1475,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
6311d4
 
6311d4
     case WAIT_OBJECT_0 + 1:
6311d4
     {
6311d4
-      if(!ReadFile(stdin_handle, buf, sizeof(data->state.buffer),
6311d4
+      if(!ReadFile(stdin_handle, buf, buf_size,
6311d4
                    &readfile_read, NULL)) {
6311d4
         keepon = FALSE;
6311d4
         code = CURLE_READ_ERROR;
6311d4
diff --git a/lib/url.c b/lib/url.c
6311d4
index 89958a7..32e7e2e 100644
6311d4
--- a/lib/url.c
6311d4
+++ b/lib/url.c
6311d4
@@ -441,6 +441,7 @@ CURLcode Curl_close(struct SessionHandle *data)
6311d4
   }
6311d4
   data->change.url = NULL;
6311d4
 
6311d4
+  Curl_safefree(data->state.buffer);
6311d4
   Curl_safefree(data->state.headerbuff);
6311d4
 
6311d4
   Curl_flush_cookies(data, 1);
6311d4
@@ -612,6 +613,12 @@ CURLcode Curl_open(struct SessionHandle **curl)
6311d4
 
6311d4
   /* We do some initial setup here, all those fields that can't be just 0 */
6311d4
 
6311d4
+  data->state.buffer = malloc(BUFSIZE + 1);
6311d4
+  if(!data->state.buffer) {
6311d4
+    DEBUGF(fprintf(stderr, "Error: malloc of buffer failed\n"));
6311d4
+    res = CURLE_OUT_OF_MEMORY;
6311d4
+  }
6311d4
+
6311d4
   data->state.headerbuff = malloc(HEADERSIZE);
6311d4
   if(!data->state.headerbuff) {
6311d4
     DEBUGF(fprintf(stderr, "Error: malloc of headerbuff failed\n"));
6311d4
@@ -642,8 +649,8 @@ CURLcode Curl_open(struct SessionHandle **curl)
6311d4
 
6311d4
   if(res) {
6311d4
     Curl_resolver_cleanup(data->state.resolver);
6311d4
-    if(data->state.headerbuff)
6311d4
-      free(data->state.headerbuff);
6311d4
+    free(data->state.buffer);
6311d4
+    free(data->state.headerbuff);
6311d4
     Curl_freeset(data);
6311d4
     free(data);
6311d4
     data = NULL;
6311d4
@@ -1960,9 +1967,20 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
6311d4
      */
6311d4
     data->set.buffer_size = va_arg(param, long);
6311d4
 
6311d4
-    if((data->set.buffer_size> (BUFSIZE -1 )) ||
6311d4
-       (data->set.buffer_size < 1))
6311d4
-      data->set.buffer_size = 0; /* huge internal default */
6311d4
+    if(data->set.buffer_size > MAX_BUFSIZE)
6311d4
+      data->set.buffer_size = MAX_BUFSIZE; /* huge internal default */
6311d4
+    else if(data->set.buffer_size < 1)
6311d4
+      data->set.buffer_size = BUFSIZE;
6311d4
+
6311d4
+    /* Resize only if larger than default buffer size. */
6311d4
+    if(data->set.buffer_size > BUFSIZE) {
6311d4
+      data->state.buffer = realloc(data->state.buffer,
6311d4
+                                   data->set.buffer_size + 1);
6311d4
+      if(!data->state.buffer) {
6311d4
+        DEBUGF(fprintf(stderr, "Error: realloc of buffer failed\n"));
6311d4
+        result = CURLE_OUT_OF_MEMORY;
6311d4
+      }
6311d4
+    }
6311d4
 
6311d4
     break;
6311d4
 
6311d4
diff --git a/lib/urldata.h b/lib/urldata.h
6311d4
index 7431825..a7807cf 100644
6311d4
--- a/lib/urldata.h
6311d4
+++ b/lib/urldata.h
6311d4
@@ -196,6 +196,9 @@
6311d4
 /* Download buffer size, keep it fairly big for speed reasons */
6311d4
 #undef BUFSIZE
6311d4
 #define BUFSIZE CURL_MAX_WRITE_SIZE
6311d4
+#undef MAX_BUFSIZE
6311d4
+#define MAX_BUFSIZE CURL_MAX_READ_SIZE
6311d4
+#define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
6311d4
 
6311d4
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
6311d4
    of need. */
6311d4
@@ -1174,7 +1177,7 @@ struct UrlState {
6311d4
   char *headerbuff; /* allocated buffer to store headers in */
6311d4
   size_t headersize;   /* size of the allocation */
6311d4
 
6311d4
-  char buffer[BUFSIZE+1]; /* download buffer */
6311d4
+  char *buffer; /* download buffer */
6311d4
   char uploadbuffer[BUFSIZE+1]; /* upload buffer */
6311d4
   curl_off_t current_speed;  /* the ProgressShow() funcion sets this,
6311d4
                                 bytes / second */
6311d4
-- 
6311d4
2.14.3
6311d4
6311d4
6311d4
From f175a713c964d351012baaf8c78c1b468cc6aba0 Mon Sep 17 00:00:00 2001
6311d4
From: Daniel Stenberg <daniel@haxx.se>
6311d4
Date: Mon, 24 Apr 2017 15:33:57 +0200
230636
Subject: [PATCH 02/18] http: use private user:password output buffer
6311d4
6311d4
Don't clobber the receive buffer.
6311d4
6311d4
Upstream-commit: 94460878cc634b590a7282e3fe60ceafb62d141a
6311d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
6311d4
---
6311d4
 lib/http.c | 32 +++++++++++++++++++-------------
6311d4
 1 file changed, 19 insertions(+), 13 deletions(-)
6311d4
6311d4
diff --git a/lib/http.c b/lib/http.c
6311d4
index f4368c4..12e7dc3 100644
6311d4
--- a/lib/http.c
6311d4
+++ b/lib/http.c
6311d4
@@ -234,7 +234,8 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
6311d4
   char **userp;
6311d4
   const char *user;
6311d4
   const char *pwd;
6311d4
-  CURLcode error;
6311d4
+  CURLcode result;
6311d4
+  char *out;
6311d4
 
6311d4
   if(proxy) {
6311d4
     userp = &conn->allocptr.proxyuserpwd;
6311d4
@@ -247,27 +248,32 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
6311d4
     pwd = conn->passwd;
6311d4
   }
6311d4
 
6311d4
-  snprintf(data->state.buffer, CURL_BUFSIZE(data->set.buffer_size),
6311d4
-           "%s:%s", user, pwd);
6311d4
+  out = aprintf("%s:%s", user, pwd);
6311d4
+  if(!out)
6311d4
+    return CURLE_OUT_OF_MEMORY;
6311d4
 
6311d4
-  error = Curl_base64_encode(data,
6311d4
-                             data->state.buffer, strlen(data->state.buffer),
6311d4
-                             &authorization, &size);
6311d4
-  if(error)
6311d4
-    return error;
6311d4
+  result = Curl_base64_encode(data, out, strlen(out), &authorization, &size);
6311d4
+  if(result)
6311d4
+    goto fail;
6311d4
 
6311d4
-  if(!authorization)
6311d4
-    return CURLE_REMOTE_ACCESS_DENIED;
6311d4
+  if(!authorization) {
6311d4
+    result = CURLE_REMOTE_ACCESS_DENIED;
6311d4
+    goto fail;
6311d4
+  }
6311d4
 
6311d4
   Curl_safefree(*userp);
6311d4
   *userp = aprintf("%sAuthorization: Basic %s\r\n",
6311d4
                    proxy?"Proxy-":"",
6311d4
                    authorization);
6311d4
   free(authorization);
6311d4
-  if(!*userp)
6311d4
-    return CURLE_OUT_OF_MEMORY;
6311d4
+  if(!*userp) {
6311d4
+    result = CURLE_OUT_OF_MEMORY;
6311d4
+    goto fail;
6311d4
+  }
6311d4
 
6311d4
-  return CURLE_OK;
6311d4
+  fail:
6311d4
+  free(out);
6311d4
+  return result;
6311d4
 }
6311d4
 
6311d4
 /* pickoneauth() selects the most favourable authentication method from the
6311d4
-- 
6311d4
2.14.3
6311d4
6311d4
6311d4
From 6ff175806c338223a2a9a69f6ae8ae2b91dc2b56 Mon Sep 17 00:00:00 2001
6311d4
From: Daniel Stenberg <daniel@haxx.se>
6311d4
Date: Mon, 24 Apr 2017 16:05:46 +0200
230636
Subject: [PATCH 03/18] ftp: use private buffer for temp storage, not receive
6311d4
 buffer
6311d4
6311d4
Upstream-commit: 349789e645a306a6ee467ef90a57f6cc306ca92e
6311d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
6311d4
---
6311d4
 lib/ftp.c | 22 ++++++++++++----------
6311d4
 1 file changed, 12 insertions(+), 10 deletions(-)
6311d4
6311d4
diff --git a/lib/ftp.c b/lib/ftp.c
6311d4
index 730b695..10a21ce 100644
6311d4
--- a/lib/ftp.c
6311d4
+++ b/lib/ftp.c
6311d4
@@ -2130,17 +2130,17 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
6311d4
       /* we got a time. Format should be: "YYYYMMDDHHMMSS[.sss]" where the
6311d4
          last .sss part is optional and means fractions of a second */
6311d4
       int year, month, day, hour, minute, second;
6311d4
-      char *buf = data->state.buffer;
6311d4
-      if(6 == sscanf(buf+4, "%04d%02d%02d%02d%02d%02d",
6311d4
+      if(6 == sscanf(&data->state.buffer[4], "%04d%02d%02d%02d%02d%02d",
6311d4
                      &year, &month, &day, &hour, &minute, &second)) {
6311d4
         /* we have a time, reformat it */
6311d4
+        char timebuf[24];
6311d4
         time_t secs=time(NULL);
6311d4
-        /* using the good old yacc/bison yuck */
6311d4
-        snprintf(buf, CURL_BUFSIZE(conn->data->set.buffer_size),
6311d4
+
6311d4
+        snprintf(timebuf, sizeof(timebuf),
6311d4
                  "%04d%02d%02d %02d:%02d:%02d GMT",
6311d4
                  year, month, day, hour, minute, second);
6311d4
         /* now, convert this into a time() value: */
6311d4
-        data->info.filetime = (long)curl_getdate(buf, &secs;;
6311d4
+        data->info.filetime = (long)curl_getdate(timebuf, &secs;;
6311d4
       }
6311d4
 
6311d4
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
6311d4
@@ -2151,6 +2151,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
6311d4
          ftpc->file &&
6311d4
          data->set.get_filetime &&
6311d4
          (data->info.filetime>=0) ) {
6311d4
+        char headerbuf[128];
6311d4
         time_t filetime = (time_t)data->info.filetime;
6311d4
         struct tm buffer;
6311d4
         const struct tm *tm = &buffer;
6311d4
@@ -2160,7 +2161,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
6311d4
           return result;
6311d4
 
6311d4
         /* format: "Tue, 15 Nov 1994 12:45:26" */
6311d4
-        snprintf(buf, BUFSIZE-1,
6311d4
+        snprintf(headerbuf, sizeof(headerbuf),
6311d4
                  "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
6311d4
                  Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
6311d4
                  tm->tm_mday,
6311d4
@@ -2169,7 +2170,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
6311d4
                  tm->tm_hour,
6311d4
                  tm->tm_min,
6311d4
                  tm->tm_sec);
6311d4
-        result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
6311d4
+        result = Curl_client_write(conn, CLIENTWRITE_BOTH, headerbuf, 0);
6311d4
         if(result)
6311d4
           return result;
6311d4
       } /* end of a ridiculous amount of conditionals */
6311d4
@@ -2347,9 +2348,10 @@ static CURLcode ftp_state_size_resp(struct connectdata *conn,
6311d4
   if(instate == FTP_SIZE) {
6311d4
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
6311d4
     if(-1 != filesize) {
6311d4
-      snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
6311d4
+      char clbuf[128];
6311d4
+      snprintf(clbuf, sizeof(clbuf),
6311d4
                "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);
6311d4
-      result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
6311d4
+      result = Curl_client_write(conn, CLIENTWRITE_BOTH, clbuf, 0);
6311d4
       if(result)
6311d4
         return result;
6311d4
     }
6311d4
@@ -2450,7 +2452,6 @@ static CURLcode ftp_state_get_resp(struct connectdata *conn,
6311d4
   CURLcode result = CURLE_OK;
6311d4
   struct SessionHandle *data = conn->data;
6311d4
   struct FTP *ftp = data->state.proto.ftp;
6311d4
-  char *buf = data->state.buffer;
6311d4
 
6311d4
   if((ftpcode == 150) || (ftpcode == 125)) {
6311d4
 
6311d4
@@ -2494,6 +2495,7 @@ static CURLcode ftp_state_get_resp(struct connectdata *conn,
6311d4
        *
6311d4
        * Example D above makes this parsing a little tricky */
6311d4
       char *bytes;
6311d4
+      char *buf = data->state.buffer;
6311d4
       bytes=strstr(buf, " bytes");
6311d4
       if(bytes--) {
6311d4
         long in=(long)(bytes-buf);
6311d4
-- 
6311d4
2.14.3
6311d4
6311d4
6311d4
From b67324919089fc4f9bb7a38a6a31174883a4bc24 Mon Sep 17 00:00:00 2001
6311d4
From: Daniel Stenberg <daniel@haxx.se>
6311d4
Date: Tue, 25 Apr 2017 00:09:22 +0200
230636
Subject: [PATCH 04/18] CURLOPT_BUFFERSIZE: 1024 bytes is now the minimum size
6311d4
6311d4
The buffer is needed to receive FTP, HTTP CONNECT responses etc so
6311d4
already at this size things risk breaking and smaller is certainly not
6311d4
wise.
6311d4
6311d4
Upstream-commit: c2ddc12d6086b522703c8b80a72ab791680f1a28
6311d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
6311d4
---
6311d4
 lib/url.c     | 15 +++++++++------
6311d4
 lib/urldata.h |  1 +
6311d4
 2 files changed, 10 insertions(+), 6 deletions(-)
6311d4
6311d4
diff --git a/lib/url.c b/lib/url.c
6311d4
index 32e7e2e..f87dca4 100644
6311d4
--- a/lib/url.c
6311d4
+++ b/lib/url.c
6311d4
@@ -1965,15 +1965,17 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
6311d4
      * The application kindly asks for a differently sized receive buffer.
6311d4
      * If it seems reasonable, we'll use it.
6311d4
      */
6311d4
-    data->set.buffer_size = va_arg(param, long);
6311d4
+    arg = va_arg(param, long);
6311d4
 
6311d4
-    if(data->set.buffer_size > MAX_BUFSIZE)
6311d4
-      data->set.buffer_size = MAX_BUFSIZE; /* huge internal default */
6311d4
-    else if(data->set.buffer_size < 1)
6311d4
-      data->set.buffer_size = BUFSIZE;
6311d4
+    if(arg > MAX_BUFSIZE)
6311d4
+      arg = MAX_BUFSIZE; /* huge internal default */
6311d4
+    else if(arg < 1)
6311d4
+      arg = BUFSIZE;
6311d4
+    else if(arg < MIN_BUFSIZE)
6311d4
+      arg = BUFSIZE;
6311d4
 
6311d4
     /* Resize only if larger than default buffer size. */
6311d4
-    if(data->set.buffer_size > BUFSIZE) {
6311d4
+    if(arg > BUFSIZE) {
6311d4
       data->state.buffer = realloc(data->state.buffer,
6311d4
                                    data->set.buffer_size + 1);
6311d4
       if(!data->state.buffer) {
6311d4
@@ -1981,6 +1983,7 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
6311d4
         result = CURLE_OUT_OF_MEMORY;
6311d4
       }
6311d4
     }
6311d4
+    data->set.buffer_size = arg;
6311d4
 
6311d4
     break;
6311d4
 
6311d4
diff --git a/lib/urldata.h b/lib/urldata.h
6311d4
index a7807cf..cd96e8f 100644
6311d4
--- a/lib/urldata.h
6311d4
+++ b/lib/urldata.h
6311d4
@@ -198,6 +198,7 @@
6311d4
 #define BUFSIZE CURL_MAX_WRITE_SIZE
6311d4
 #undef MAX_BUFSIZE
6311d4
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
6311d4
+#define MIN_BUFSIZE 1024
6311d4
 #define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
6311d4
 
6311d4
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
6311d4
-- 
6311d4
2.14.3
6311d4
6311d4
6311d4
From 9798012315c087168c5a4a1dc56eacfe82c69626 Mon Sep 17 00:00:00 2001
6311d4
From: Daniel Stenberg <daniel@haxx.se>
6311d4
Date: Tue, 25 Apr 2017 00:15:28 +0200
230636
Subject: [PATCH 05/18] file: use private buffer for C-L output
6311d4
6311d4
... instead of clobbering the download buffer.
6311d4
6311d4
Upstream-commit: 7c312f84ea930d89c0f0f774b50032c4f9ae30e4
6311d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
6311d4
---
6311d4
 lib/file.c | 7 ++++---
6311d4
 1 file changed, 4 insertions(+), 3 deletions(-)
6311d4
6311d4
diff --git a/lib/file.c b/lib/file.c
6311d4
index 1ad4758..b6bf18e 100644
6311d4
--- a/lib/file.c
6311d4
+++ b/lib/file.c
6311d4
@@ -473,9 +473,10 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
6311d4
      date. */
6311d4
   if(data->set.opt_no_body && data->set.include_header && fstated) {
6311d4
     CURLcode result;
6311d4
-    snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
6311d4
+    char header[80];
6311d4
+    snprintf(header, sizeof(header),
6311d4
              "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);
6311d4
-    result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
6311d4
+    result = Curl_client_write(conn, CLIENTWRITE_BOTH, header, 0);
6311d4
     if(result)
6311d4
       return result;
6311d4
 
6311d4
@@ -493,7 +494,7 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
6311d4
         return result;
6311d4
 
6311d4
       /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
6311d4
-      snprintf(buf, BUFSIZE-1,
6311d4
+      snprintf(header, sizeof(header),
6311d4
                "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
6311d4
                Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
6311d4
                tm->tm_mday,
6311d4
-- 
6311d4
2.14.3
6311d4
6311d4
6311d4
From f4868e737e9f8d719cb9897506da2c7f92dfd87d Mon Sep 17 00:00:00 2001
6311d4
From: Daniel Stenberg <daniel@haxx.se>
6311d4
Date: Tue, 25 Apr 2017 00:16:10 +0200
230636
Subject: [PATCH 06/18] buffer_size: make sure it always has the correct size
6311d4
6311d4
Removes the need for CURL_BUFSIZE
6311d4
6311d4
Upstream-commit: f535f4f5fc6cbdce1aec5a3481cec37369dca468
6311d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
6311d4
---
6311d4
 lib/easy.c    | 2 +-
6311d4
 lib/telnet.c  | 2 +-
6311d4
 lib/url.c     | 2 ++
6311d4
 lib/urldata.h | 1 -
6311d4
 4 files changed, 4 insertions(+), 3 deletions(-)
6311d4
6311d4
diff --git a/lib/easy.c b/lib/easy.c
6311d4
index 5d4d5ae..9cad5f1 100644
6311d4
--- a/lib/easy.c
6311d4
+++ b/lib/easy.c
6311d4
@@ -564,7 +564,7 @@ CURL *curl_easy_duphandle(CURL *incurl)
6311d4
    * the likeliness of us forgetting to init a buffer here in the future.
6311d4
    */
6311d4
   outcurl->set.buffer_size = data->set.buffer_size;
6311d4
-  outcurl->state.buffer = malloc(CURL_BUFSIZE(outcurl->set.buffer_size) + 1);
6311d4
+  outcurl->state.buffer = malloc(outcurl->set.buffer_size + 1);
6311d4
   if(!outcurl->state.buffer)
6311d4
     goto fail;
6311d4
 
6311d4
diff --git a/lib/telnet.c b/lib/telnet.c
6311d4
index 89452dd..e43b423 100644
6311d4
--- a/lib/telnet.c
6311d4
+++ b/lib/telnet.c
6311d4
@@ -1421,7 +1421,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
6311d4
 
6311d4
   /* Keep on listening and act on events */
6311d4
   while(keepon) {
6311d4
-    const size_t buf_size = CURL_BUFSIZE(data->set.buffer_size);
6311d4
+    const size_t buf_size = (DWORD)data->set.buffer_size;
6311d4
     waitret = WaitForMultipleObjects(obj_count, objs, FALSE, wait_timeout);
6311d4
     switch(waitret) {
6311d4
     case WAIT_TIMEOUT:
6311d4
diff --git a/lib/url.c b/lib/url.c
6311d4
index f87dca4..81de7c2 100644
6311d4
--- a/lib/url.c
6311d4
+++ b/lib/url.c
6311d4
@@ -577,6 +577,8 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
6311d4
   set->tcp_keepintvl = 60;
6311d4
   set->tcp_keepidle = 60;
6311d4
 
6311d4
+  set->buffer_size = BUFSIZE;
6311d4
+
6311d4
   return res;
6311d4
 }
6311d4
 
6311d4
diff --git a/lib/urldata.h b/lib/urldata.h
6311d4
index cd96e8f..fbe69c2 100644
6311d4
--- a/lib/urldata.h
6311d4
+++ b/lib/urldata.h
6311d4
@@ -199,7 +199,6 @@
6311d4
 #undef MAX_BUFSIZE
6311d4
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
6311d4
 #define MIN_BUFSIZE 1024
6311d4
-#define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
6311d4
 
6311d4
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
6311d4
    of need. */
6311d4
-- 
6311d4
2.14.3
6311d4
6311d4
230636
From 43d9e7acc44c9849f85882d2ec18c2a609f90809 Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 00:48:56 +0200
230636
Subject: [PATCH 07/18] http: don't clobber the receive buffer for timecond
230636
230636
Upstream-commit: 87eb8d5b30ce2adfe2673cc0b1abf6ca68891cc4
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/http.c | 37 +++++++++++++++++++------------------
230636
 1 file changed, 19 insertions(+), 18 deletions(-)
230636
230636
diff --git a/lib/http.c b/lib/http.c
230636
index 12e7dc3..6ecdda2 100644
230636
--- a/lib/http.c
230636
+++ b/lib/http.c
230636
@@ -1607,9 +1607,10 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
230636
                                 Curl_send_buffer *req_buffer)
230636
 {
230636
   const struct tm *tm;
230636
-  char *buf = data->state.buffer;
230636
   CURLcode result = CURLE_OK;
230636
   struct tm keeptime;
230636
+  char datestr[80];
230636
+  const char *condp;
230636
 
230636
   result = Curl_gmtime(data->set.timevalue, &keeptime);
230636
   if(result) {
230636
@@ -1618,6 +1619,19 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
230636
   }
230636
   tm = &keeptime;
230636
 
230636
+  switch(data->set.timecondition) {
230636
+  default:
230636
+  case CURL_TIMECOND_IFMODSINCE:
230636
+    condp = "If-Modified-Since";
230636
+    break;
230636
+  case CURL_TIMECOND_IFUNMODSINCE:
230636
+    condp = "If-Unmodified-Since";
230636
+    break;
230636
+  case CURL_TIMECOND_LASTMOD:
230636
+    condp = "Last-Modified";
230636
+    break;
230636
+  }
230636
+
230636
   /* The If-Modified-Since header family should have their times set in
230636
    * GMT as RFC2616 defines: "All HTTP date/time stamps MUST be
230636
    * represented in Greenwich Mean Time (GMT), without exception. For the
230636
@@ -1626,8 +1640,9 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
230636
    */
230636
 
230636
   /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
230636
-  snprintf(buf, BUFSIZE-1,
230636
-           "%s, %02d %s %4d %02d:%02d:%02d GMT",
230636
+  snprintf(datestr, sizeof(datestr),
230636
+           "%s: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
230636
+           condp,
230636
            Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
230636
            tm->tm_mday,
230636
            Curl_month[tm->tm_mon],
230636
@@ -1636,21 +1651,7 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
230636
            tm->tm_min,
230636
            tm->tm_sec);
230636
 
230636
-  switch(data->set.timecondition) {
230636
-  case CURL_TIMECOND_IFMODSINCE:
230636
-  default:
230636
-    result = Curl_add_bufferf(req_buffer,
230636
-                              "If-Modified-Since: %s\r\n", buf);
230636
-    break;
230636
-  case CURL_TIMECOND_IFUNMODSINCE:
230636
-    result = Curl_add_bufferf(req_buffer,
230636
-                              "If-Unmodified-Since: %s\r\n", buf);
230636
-    break;
230636
-  case CURL_TIMECOND_LASTMOD:
230636
-    result = Curl_add_bufferf(req_buffer,
230636
-                              "Last-Modified: %s\r\n", buf);
230636
-    break;
230636
-  }
230636
+  result = Curl_add_buffer(req_buffer, datestr, strlen(datestr));
230636
 
230636
   return result;
230636
 }
230636
-- 
230636
2.17.2
230636
230636
230636
From 91ca8ea3e4e984070ef07dbc1a7258ced3b6982a Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 00:50:04 +0200
230636
Subject: [PATCH 08/18] pingpong: use the set buffer size
230636
230636
Upstream-commit: b8191e975faa7810ed3d858205b0b3f0d297f0b2
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/pingpong.c | 15 +++++++++------
230636
 1 file changed, 9 insertions(+), 6 deletions(-)
230636
230636
diff --git a/lib/pingpong.c b/lib/pingpong.c
230636
index 16b4ad3..c4666fe 100644
230636
--- a/lib/pingpong.c
230636
+++ b/lib/pingpong.c
230636
@@ -309,7 +309,8 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
230636
 
230636
   keepon=TRUE;
230636
 
230636
-  while((pp->nread_resp
230636
+  while((pp->nread_resp < (size_t)data->set.buffer_size) &&
230636
+        (keepon && !result)) {
230636
 
230636
     if(pp->cache) {
230636
       /* we had data in the "cache", copy that instead of doing an actual
230636
@@ -319,7 +320,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
230636
        * it would have been populated with something of size int to begin
230636
        * with, even though its datatype may be larger than an int.
230636
        */
230636
-      DEBUGASSERT((ptr+pp->cache_size) <= (buf+BUFSIZE+1));
230636
+      DEBUGASSERT((ptr+pp->cache_size) <= (buf+data->set.buffer_size+1));
230636
       memcpy(ptr, pp->cache, pp->cache_size);
230636
       gotbytes = (ssize_t)pp->cache_size;
230636
       free(pp->cache);    /* free the cache */
230636
@@ -332,8 +333,10 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
230636
       enum protection_level prot = conn->data_prot;
230636
       conn->data_prot = PROT_CLEAR;
230636
 #endif
230636
-      DEBUGASSERT((ptr+BUFSIZE-pp->nread_resp) <= (buf+BUFSIZE+1));
230636
-      res = Curl_read(conn, sockfd, ptr, BUFSIZE-pp->nread_resp,
230636
+      DEBUGASSERT((ptr + data->set.buffer_size - pp->nread_resp) <=
230636
+                  (buf + data->set.buffer_size + 1));
230636
+      res = Curl_read(conn, sockfd, ptr,
230636
+                      data->set.buffer_size - pp->nread_resp,
230636
                       &gotbytes);
230636
 #if defined(HAVE_KRB4) || defined(HAVE_GSSAPI)
230636
       DEBUGASSERT(prot  > PROT_NONE && prot < PROT_LAST);
230636
@@ -430,7 +433,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
230636
       }
230636
       else if(keepon) {
230636
 
230636
-        if((perline == gotbytes) && (gotbytes > BUFSIZE/2)) {
230636
+        if((perline == gotbytes) && (gotbytes > data->set.buffer_size/2)) {
230636
           /* We got an excessive line without newlines and we need to deal
230636
              with it. We keep the first bytes of the line then we throw
230636
              away the rest. */
230636
@@ -442,7 +445,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
230636
              interested in the first piece */
230636
           clipamount = 40;
230636
         }
230636
-        else if(pp->nread_resp > BUFSIZE/2) {
230636
+        else if(pp->nread_resp > (size_t)data->set.buffer_size/2) {
230636
           /* We got a large chunk of data and there's potentially still
230636
              trailing data to take care of, so we put any such part in the
230636
              "cache", clear the buffer to make space and restart. */
230636
-- 
230636
2.17.2
230636
230636
230636
From 3bc2bc2f1c5e3afd7a7cbd208d97fbb37f2dfc5f Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 00:50:21 +0200
230636
Subject: [PATCH 09/18] failf: use private buffer, don't clobber receive buffer
230636
230636
Upstream-commit: f2fadf490f66ad364f5a6f0356d626dda5f9a82f
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/sendf.c | 15 +++++++--------
230636
 1 file changed, 7 insertions(+), 8 deletions(-)
230636
230636
diff --git a/lib/sendf.c b/lib/sendf.c
230636
index c64d686..403025b 100644
230636
--- a/lib/sendf.c
230636
+++ b/lib/sendf.c
230636
@@ -155,21 +155,20 @@ void Curl_failf(struct SessionHandle *data, const char *fmt, ...)
230636
 {
230636
   va_list ap;
230636
   size_t len;
230636
+  char error[CURL_ERROR_SIZE + 2];
230636
   va_start(ap, fmt);
230636
 
230636
-  vsnprintf(data->state.buffer, BUFSIZE, fmt, ap);
230636
+  vsnprintf(error, CURL_ERROR_SIZE, fmt, ap);
230636
+  len = strlen(error);
230636
 
230636
   if(data->set.errorbuffer && !data->state.errorbuf) {
230636
-    snprintf(data->set.errorbuffer, CURL_ERROR_SIZE, "%s", data->state.buffer);
230636
+    strcpy(data->set.errorbuffer, error);
230636
     data->state.errorbuf = TRUE; /* wrote error string */
230636
   }
230636
   if(data->set.verbose) {
230636
-    len = strlen(data->state.buffer);
230636
-    if(len < BUFSIZE - 1) {
230636
-      data->state.buffer[len] = '\n';
230636
-      data->state.buffer[++len] = '\0';
230636
-    }
230636
-    Curl_debug(data, CURLINFO_TEXT, data->state.buffer, len, NULL);
230636
+    error[len] = '\n';
230636
+    error[++len] = '\0';
230636
+    Curl_debug(data, CURLINFO_TEXT, error, len, NULL);
230636
   }
230636
 
230636
   va_end(ap);
230636
-- 
230636
2.17.2
230636
230636
230636
From 0a1107c2ad898e837f0aa4742c1b17ef186a3243 Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 00:50:50 +0200
230636
Subject: [PATCH 10/18] transfer: fix minor buffer_size mistake
230636
230636
Upstream-commit: 40a074f255de90003ab753f5d0ad61b74c62ca9b
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/transfer.c | 3 +--
230636
 1 file changed, 1 insertion(+), 2 deletions(-)
230636
230636
diff --git a/lib/transfer.c b/lib/transfer.c
230636
index dff6838..9b932de 100644
230636
--- a/lib/transfer.c
230636
+++ b/lib/transfer.c
230636
@@ -385,8 +385,7 @@ static CURLcode readwrite_data(struct SessionHandle *data,
230636
   /* This is where we loop until we have read everything there is to
230636
      read or we get a CURLE_AGAIN */
230636
   do {
230636
-    size_t buffersize = data->set.buffer_size?
230636
-      data->set.buffer_size : BUFSIZE;
230636
+    size_t buffersize = data->set.buffer_size;
230636
     size_t bytestoread = buffersize;
230636
 
230636
     if(k->size != -1 && !k->header) {
230636
-- 
230636
2.17.2
230636
230636
230636
From 15408839da1b768974650bdf187c749432fdaefa Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 01:03:17 +0200
230636
Subject: [PATCH 11/18] http-proxy: use a dedicated CONNECT response buffer
230636
230636
To make it suitably independent of the receive buffer and its flexible
230636
size.
230636
230636
Upstream-commit: 0cab3a394a190c1cdf900cf2887ccdd6a7f213ef
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/http_proxy.c | 69 +++++++++++++++++++++++++++++++++++-------------
230636
 lib/url.c        |  1 +
230636
 lib/urldata.h    |  3 ++-
230636
 3 files changed, 53 insertions(+), 20 deletions(-)
230636
230636
diff --git a/lib/http_proxy.c b/lib/http_proxy.c
230636
index 4ab280f..13fb228 100644
230636
--- a/lib/http_proxy.c
230636
+++ b/lib/http_proxy.c
230636
@@ -83,20 +83,13 @@ CURLcode Curl_proxy_connect(struct connectdata *conn)
230636
   return CURLE_OK;
230636
 }
230636
 
230636
-/*
230636
- * Curl_proxyCONNECT() requires that we're connected to a HTTP proxy. This
230636
- * function will issue the necessary commands to get a seamless tunnel through
230636
- * this proxy. After that, the socket can be used just as a normal socket.
230636
- *
230636
- * 'blocking' set to TRUE means that this function will do the entire CONNECT
230636
- * + response in a blocking fashion. Should be avoided!
230636
- */
230636
+#define CONNECT_BUFFER_SIZE 16384
230636
 
230636
-CURLcode Curl_proxyCONNECT(struct connectdata *conn,
230636
-                           int sockindex,
230636
-                           const char *hostname,
230636
-                           unsigned short remote_port,
230636
-                           bool blocking)
230636
+CURLcode CONNECT(struct connectdata *conn,
230636
+                 int sockindex,
230636
+                 const char *hostname,
230636
+                 unsigned short remote_port,
230636
+                 bool blocking)
230636
 {
230636
   int subversion=0;
230636
   struct SessionHandle *data=conn->data;
230636
@@ -253,14 +246,19 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
230636
       char *ptr;
230636
       char *line_start;
230636
 
230636
-      ptr=data->state.buffer;
230636
+      ptr = conn->connect_buffer;
230636
       line_start = ptr;
230636
 
230636
       nread=0;
230636
       perline=0;
230636
       keepon=TRUE;
230636
 
230636
-      while((nread
230636
+      while((nread < (size_t)CONNECT_BUFFER_SIZE) && (keepon && !error)) {
230636
+
230636
+        if(ptr >= &conn->connect_buffer[CONNECT_BUFFER_SIZE]) {
230636
+          failf(data, "CONNECT response too large!");
230636
+          return CURLE_RECV_ERROR;
230636
+        }
230636
 
230636
         check = Curl_timeleft(data, NULL, TRUE);
230636
         if(check <= 0) {
230636
@@ -279,8 +277,8 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
230636
         case 0: /* timeout */
230636
           break;
230636
         default:
230636
-          DEBUGASSERT(ptr+BUFSIZE-nread <= data->state.buffer+BUFSIZE+1);
230636
-          result = Curl_read(conn, tunnelsocket, ptr, BUFSIZE-nread,
230636
+          result = Curl_read(conn, tunnelsocket, ptr,
230636
+                             CONNECT_BUFFER_SIZE - nread,
230636
                              &gotbytes);
230636
           if(result==CURLE_AGAIN)
230636
             continue; /* go loop yourself */
230636
@@ -313,7 +311,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
230636
               /* This means we are currently ignoring a response-body */
230636
 
230636
               nread = 0; /* make next read start over in the read buffer */
230636
-              ptr=data->state.buffer;
230636
+              ptr = conn->connect_buffer;
230636
               if(cl) {
230636
                 /* A Content-Length based body: simply count down the counter
230636
                    and make sure to break out of the loop when we're done! */
230636
@@ -386,7 +384,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
230636
                     /* end of response-headers from the proxy */
230636
                     nread = 0; /* make next read start over in the read
230636
                                   buffer */
230636
-                    ptr=data->state.buffer;
230636
+                    ptr = conn->connect_buffer;
230636
                     if((407 == k->httpcode) && !data->state.authproblem) {
230636
                       /* If we get a 407 response code with content length
230636
                          when we have no auth problem, we must ignore the
230636
@@ -585,4 +583,37 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
230636
   data->req.ignorebody = FALSE; /* put it (back) to non-ignore state */
230636
   return CURLE_OK;
230636
 }
230636
+
230636
+/*
230636
+ * Curl_proxyCONNECT() requires that we're connected to a HTTP proxy. This
230636
+ * function will issue the necessary commands to get a seamless tunnel through
230636
+ * this proxy. After that, the socket can be used just as a normal socket.
230636
+ *
230636
+ * 'blocking' set to TRUE means that this function will do the entire CONNECT
230636
+ * + response in a blocking fashion. Should be avoided!
230636
+ */
230636
+
230636
+CURLcode Curl_proxyCONNECT(struct connectdata *conn,
230636
+                           int sockindex,
230636
+                           const char *hostname,
230636
+                           unsigned short remote_port,
230636
+                           bool blocking)
230636
+{
230636
+  CURLcode result;
230636
+  if(TUNNEL_INIT == conn->tunnel_state[sockindex]) {
230636
+    if(!conn->connect_buffer) {
230636
+      conn->connect_buffer = malloc(CONNECT_BUFFER_SIZE);
230636
+      if(!conn->connect_buffer)
230636
+        return CURLE_OUT_OF_MEMORY;
230636
+    }
230636
+  }
230636
+  result = CONNECT(conn, sockindex, hostname, remote_port, blocking);
230636
+
230636
+  if(result || (TUNNEL_COMPLETE == conn->tunnel_state[sockindex]))
230636
+    Curl_safefree(conn->connect_buffer);
230636
+
230636
+  return result;
230636
+}
230636
+
230636
+
230636
 #endif /* CURL_DISABLE_PROXY */
230636
diff --git a/lib/url.c b/lib/url.c
230636
index 00fd15d..b86243b 100644
230636
--- a/lib/url.c
230636
+++ b/lib/url.c
230636
@@ -2523,6 +2523,7 @@ static void conn_free(struct connectdata *conn)
230636
   Curl_safefree(conn->host.rawalloc); /* host name buffer */
230636
   Curl_safefree(conn->proxy.rawalloc); /* proxy name buffer */
230636
   Curl_safefree(conn->master_buffer);
230636
+  Curl_safefree(conn->connect_buffer);
230636
 
230636
   Curl_llist_destroy(conn->send_pipe, NULL);
230636
   Curl_llist_destroy(conn->recv_pipe, NULL);
230636
diff --git a/lib/urldata.h b/lib/urldata.h
230636
index fbe69c2..c362c58 100644
230636
--- a/lib/urldata.h
230636
+++ b/lib/urldata.h
230636
@@ -1018,7 +1018,8 @@ struct connectdata {
230636
     TUNNEL_COMPLETE /* CONNECT response received completely */
230636
   } tunnel_state[2]; /* two separate ones to allow FTP */
230636
 
230636
-   struct connectbundle *bundle; /* The bundle we are member of */
230636
+  struct connectbundle *bundle; /* The bundle we are member of */
230636
+  char *connect_buffer; /* for CONNECT business */
230636
 };
230636
 
230636
 /* The end of connectdata. */
230636
-- 
230636
2.17.2
230636
230636
230636
From 1122ecc4b522f24d466bcc2e658dd098a32d982f Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 14:37:06 +0200
230636
Subject: [PATCH 12/18] upload: UPLOAD_BUFSIZE is now for the upload buffer
230636
230636
Upstream-commit: 89cf6f38d2f525cbc8537a60061f5f37bb2f35f7
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/file.c     | 2 +-
230636
 lib/transfer.c | 2 +-
230636
 lib/urldata.h  | 6 +++++-
230636
 3 files changed, 7 insertions(+), 3 deletions(-)
230636
230636
diff --git a/lib/file.c b/lib/file.c
230636
index 98536cd..2f2e466 100644
230636
--- a/lib/file.c
230636
+++ b/lib/file.c
230636
@@ -364,7 +364,7 @@ static CURLcode file_upload(struct connectdata *conn)
230636
 
230636
   while(res == CURLE_OK) {
230636
     int readcount;
230636
-    res = Curl_fillreadbuffer(conn, BUFSIZE, &readcount);
230636
+    res = Curl_fillreadbuffer(conn, (int)data->set.buffer_size, &readcount);
230636
     if(res)
230636
       break;
230636
 
230636
diff --git a/lib/transfer.c b/lib/transfer.c
230636
index 9b932de..b707f8a 100644
230636
--- a/lib/transfer.c
230636
+++ b/lib/transfer.c
230636
@@ -835,7 +835,7 @@ static CURLcode readwrite_upload(struct SessionHandle *data,
230636
             sending_http_headers = FALSE;
230636
         }
230636
 
230636
-        result = Curl_fillreadbuffer(conn, BUFSIZE, &fillcount);
230636
+        result = Curl_fillreadbuffer(conn, UPLOAD_BUFSIZE, &fillcount);
230636
         if(result)
230636
           return result;
230636
 
230636
diff --git a/lib/urldata.h b/lib/urldata.h
230636
index c362c58..afe37c0 100644
230636
--- a/lib/urldata.h
230636
+++ b/lib/urldata.h
230636
@@ -200,6 +200,10 @@
230636
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
230636
 #define MIN_BUFSIZE 1024
230636
 
230636
+/* The upload buffer size, should not be smaller than CURL_MAX_WRITE_SIZE, as
230636
+   it needs to hold a full buffer as could be sent in a write callback */
230636
+#define UPLOAD_BUFSIZE CURL_MAX_WRITE_SIZE
230636
+
230636
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
230636
    of need. */
230636
 #define HEADERSIZE 256
230636
@@ -1179,7 +1183,7 @@ struct UrlState {
230636
   size_t headersize;   /* size of the allocation */
230636
 
230636
   char *buffer; /* download buffer */
230636
-  char uploadbuffer[BUFSIZE+1]; /* upload buffer */
230636
+  char uploadbuffer[UPLOAD_BUFSIZE+1]; /* upload buffer */
230636
   curl_off_t current_speed;  /* the ProgressShow() funcion sets this,
230636
                                 bytes / second */
230636
   bool this_is_a_follow; /* this is a followed Location: request */
230636
-- 
230636
2.17.2
230636
230636
230636
From 4666a96fce7a2aa8c294cef7aec23e39a3d49673 Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 14:37:45 +0200
230636
Subject: [PATCH 13/18] krb5: use private buffer for temp string, not receive
230636
 buffer
230636
230636
Upstream-commit: c79f4908d461cecaa9976099dcbb8a63b351f19e
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/krb5.c | 14 +++++++++-----
230636
 1 file changed, 9 insertions(+), 5 deletions(-)
230636
230636
diff --git a/lib/krb5.c b/lib/krb5.c
230636
index 1e99c70..e4eb0b0 100644
230636
--- a/lib/krb5.c
230636
+++ b/lib/krb5.c
230636
@@ -174,6 +174,7 @@ krb5_auth(void *app_data, struct connectdata *conn)
230636
   gss_ctx_id_t *context = app_data;
230636
   struct gss_channel_bindings_struct chan;
230636
   size_t base64_sz = 0;
230636
+  char *stringp;
230636
 
230636
   if(getsockname(conn->sock[FIRSTSOCKET],
230636
                  (struct sockaddr *)LOCAL_ADDR, &l) < 0)
230636
@@ -205,16 +206,19 @@ krb5_auth(void *app_data, struct connectdata *conn)
230636
         return -1;
230636
     }
230636
 
230636
-    input_buffer.value = data->state.buffer;
230636
-    input_buffer.length = snprintf(input_buffer.value, BUFSIZE, "%s@%s",
230636
-                                   service, host);
230636
+    stringp = aprintf("%s@%s", service, host);
230636
+    if(!stringp)
230636
+      return -2;
230636
+
230636
+    input_buffer.value = stringp;
230636
+    input_buffer.length = strlen(stringp);
230636
     maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE,
230636
                           &gssname);
230636
+    free(stringp);
230636
     if(maj != GSS_S_COMPLETE) {
230636
       gss_release_name(&min, &gssname);
230636
       if(service == srv_host) {
230636
-        Curl_failf(data, "Error importing service name %s",
230636
-                   input_buffer.value);
230636
+        Curl_failf(data, "Error importing service name %s@%s", service, host);
230636
         return AUTH_ERROR;
230636
       }
230636
       service = srv_host;
230636
-- 
230636
2.17.2
230636
230636
230636
From 4725e3cbe9af074304a4735b6ac667a154081b99 Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 14:38:34 +0200
230636
Subject: [PATCH 14/18] buffer: use data->set.buffer_size instead of BUFSIZE
230636
230636
... to properly use the dynamically set buffer size!
230636
230636
Upstream-commit: e40e9d7f0decc799e3ccfe2c418632f8bb52031a
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/file.c     |  4 ++--
230636
 lib/ftp.c      |  5 +++--
230636
 lib/http.c     |  7 ++++---
230636
 lib/sendf.c    |  9 ++++-----
230636
 lib/smtp.c     |  2 +-
230636
 lib/ssh.c      |  5 +++--
230636
 lib/telnet.c   | 10 +++++-----
230636
 lib/transfer.c |  4 +---
230636
 8 files changed, 23 insertions(+), 23 deletions(-)
230636
230636
diff --git a/lib/file.c b/lib/file.c
230636
index 2f2e466..ddac28f 100644
230636
--- a/lib/file.c
230636
+++ b/lib/file.c
230636
@@ -558,8 +558,8 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
230636
   while(res == CURLE_OK) {
230636
     /* Don't fill a whole buffer if we want less than all data */
230636
     size_t bytestoread =
230636
-      (expected_size < CURL_OFF_T_C(BUFSIZE) - CURL_OFF_T_C(1)) ?
230636
-      curlx_sotouz(expected_size) : BUFSIZE - 1;
230636
+      (expected_size < data->set.buffer_size) ?
230636
+      curlx_sotouz(expected_size) : (size_t)data->set.buffer_size;
230636
 
230636
     nread = read(fd, buf, bytestoread);
230636
 
230636
diff --git a/lib/ftp.c b/lib/ftp.c
230636
index c40d7e4..3a8b4b2 100644
230636
--- a/lib/ftp.c
230636
+++ b/lib/ftp.c
230636
@@ -1646,8 +1646,9 @@ static CURLcode ftp_state_ul_setup(struct connectdata *conn,
230636
         curl_off_t passed=0;
230636
         do {
230636
           size_t readthisamountnow =
230636
-            (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
230636
-            BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
230636
+            (data->state.resume_from - passed > data->set.buffer_size) ?
230636
+            (size_t)data->set.buffer_size :
230636
+            curlx_sotouz(data->state.resume_from - passed);
230636
 
230636
           size_t actuallyread =
230636
             conn->fread_func(data->state.buffer, 1, readthisamountnow,
230636
diff --git a/lib/http.c b/lib/http.c
230636
index 6ecdda2..665447b 100644
230636
--- a/lib/http.c
230636
+++ b/lib/http.c
230636
@@ -1061,7 +1061,7 @@ CURLcode Curl_add_buffer_send(Curl_send_buffer *in,
230636
        buffer is using this size.
230636
     */
230636
 
230636
-    sendsize= (size > CURL_MAX_WRITE_SIZE)?CURL_MAX_WRITE_SIZE:size;
230636
+    sendsize = CURLMIN(size, CURL_MAX_WRITE_SIZE);
230636
 
230636
     /* OpenSSL is very picky and we must send the SAME buffer pointer to the
230636
        library when we attempt to re-send this buffer. Sending the same data
230636
@@ -2036,8 +2036,9 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
230636
           curl_off_t passed=0;
230636
           do {
230636
             size_t readthisamountnow =
230636
-              (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
230636
-              BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
230636
+              (data->state.resume_from - passed > data->set.buffer_size) ?
230636
+              (size_t)data->set.buffer_size :
230636
+              curlx_sotouz(data->state.resume_from - passed);
230636
 
230636
             size_t actuallyread =
230636
               data->set.fread_func(data->state.buffer, 1, readthisamountnow,
230636
diff --git a/lib/sendf.c b/lib/sendf.c
230636
index 403025b..fb0e6e8 100644
230636
--- a/lib/sendf.c
230636
+++ b/lib/sendf.c
230636
@@ -528,7 +528,8 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
230636
   ssize_t nread = 0;
230636
   size_t bytesfromsocket = 0;
230636
   char *buffertofill = NULL;
230636
-  bool pipelining = (conn->data->multi &&
230636
+  struct SessionHandle *data = conn->data;
230636
+  bool pipelining = (data->multi &&
230636
                      Curl_multi_canPipeline(conn->data->multi)) ? TRUE : FALSE;
230636
 
230636
   /* Set 'num' to 0 or 1, depending on which socket that has been sent here.
230636
@@ -554,13 +555,11 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
230636
     }
230636
     /* If we come here, it means that there is no data to read from the buffer,
230636
      * so we read from the socket */
230636
-    bytesfromsocket = CURLMIN(sizerequested, BUFSIZE * sizeof (char));
230636
+    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
230636
     buffertofill = conn->master_buffer;
230636
   }
230636
   else {
230636
-    bytesfromsocket = CURLMIN((long)sizerequested,
230636
-                              conn->data->set.buffer_size ?
230636
-                              conn->data->set.buffer_size : BUFSIZE);
230636
+    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
230636
     buffertofill = buf;
230636
   }
230636
 
230636
diff --git a/lib/smtp.c b/lib/smtp.c
230636
index d2d4aeb..ccc2dc7 100644
230636
--- a/lib/smtp.c
230636
+++ b/lib/smtp.c
230636
@@ -1665,7 +1665,7 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, ssize_t nread)
230636
 
230636
   /* Do we need to allocate the scatch buffer? */
230636
   if(!data->state.scratch) {
230636
-    data->state.scratch = malloc(2 * BUFSIZE);
230636
+    data->state.scratch = malloc(2 * data->set.buffer_size);
230636
 
230636
     if(!data->state.scratch) {
230636
       failf (data, "Failed to alloc scratch buffer!");
230636
diff --git a/lib/ssh.c b/lib/ssh.c
230636
index 589d4a3..169ef1b 100644
230636
--- a/lib/ssh.c
230636
+++ b/lib/ssh.c
230636
@@ -1711,8 +1711,9 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
230636
             curl_off_t passed=0;
230636
             do {
230636
               size_t readthisamountnow =
230636
-                (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
230636
-                BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
230636
+                (data->state.resume_from - passed > data->set.buffer_size) ?
230636
+                data->set.buffer_size :
230636
+                curlx_sotouz(data->state.resume_from - passed);
230636
 
230636
               size_t actuallyread =
230636
                 conn->fread_func(data->state.buffer, 1, readthisamountnow,
230636
diff --git a/lib/telnet.c b/lib/telnet.c
230636
index e43b423..4492514 100644
230636
--- a/lib/telnet.c
230636
+++ b/lib/telnet.c
230636
@@ -1429,7 +1429,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
230636
       for(;;) {
230636
         if(obj_count == 1) {
230636
           /* read from user-supplied method */
230636
-          code = (int)conn->fread_func(buf, 1, BUFSIZE - 1, conn->fread_in);
230636
+          code = (int)conn->fread_func(buf, 1, buf_size, conn->fread_in);
230636
           if(code == CURL_READFUNC_ABORT) {
230636
             keepon = FALSE;
230636
             code = CURLE_READ_ERROR;
230636
@@ -1502,7 +1502,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
230636
       }
230636
       if(events.lNetworkEvents & FD_READ) {
230636
         /* read data from network */
230636
-        code = Curl_read(conn, sockfd, buf, BUFSIZE - 1, &nread);
230636
+        code = Curl_read(conn, sockfd, buf, data->set.buffer_size, &nread);
230636
         /* read would've blocked. Loop again */
230636
         if(code == CURLE_AGAIN)
230636
           break;
230636
@@ -1591,7 +1591,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
230636
     default:                    /* read! */
230636
       if(pfd[0].revents & POLLIN) {
230636
         /* read data from network */
230636
-        code = Curl_read(conn, sockfd, buf, BUFSIZE - 1, &nread);
230636
+        code = Curl_read(conn, sockfd, buf, data->set.buffer_size, &nread);
230636
         /* read would've blocked. Loop again */
230636
         if(code == CURLE_AGAIN)
230636
           break;
230636
@@ -1627,12 +1627,12 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
230636
       nread = 0;
230636
       if(poll_cnt == 2) {
230636
         if(pfd[1].revents & POLLIN) { /* read from in file */
230636
-          nread = read(pfd[1].fd, buf, BUFSIZE - 1);
230636
+          nread = read(pfd[1].fd, buf, data->set.buffer_size);
230636
         }
230636
       }
230636
       else {
230636
         /* read from user-supplied method */
230636
-        nread = (int)conn->fread_func(buf, 1, BUFSIZE - 1, conn->fread_in);
230636
+        nread = (int)conn->fread_func(buf, 1, data->set.buffer_size, conn->fread_in);
230636
         if(nread == CURL_READFUNC_ABORT) {
230636
           keepon = FALSE;
230636
           break;
230636
diff --git a/lib/transfer.c b/lib/transfer.c
230636
index b707f8a..77f0937 100644
230636
--- a/lib/transfer.c
230636
+++ b/lib/transfer.c
230636
@@ -626,8 +626,6 @@ static CURLcode readwrite_data(struct SessionHandle *data,
230636
         excess = (size_t)(k->bytecount + nread - k->maxdownload);
230636
         if(excess > 0 && !k->ignorebody) {
230636
           if(conn->data->multi && Curl_multi_canPipeline(conn->data->multi)) {
230636
-            /* The 'excess' amount below can't be more than BUFSIZE which
230636
-               always will fit in a size_t */
230636
             infof(data,
230636
                   "Rewinding stream by : %zu"
230636
                   " bytes on url %s (size = %" FORMAT_OFF_T
230636
@@ -880,7 +878,7 @@ static CURLcode readwrite_upload(struct SessionHandle *data,
230636
 #endif
230636
          (data->set.crlf))) {
230636
         if(data->state.scratch == NULL)
230636
-          data->state.scratch = malloc(2*BUFSIZE);
230636
+          data->state.scratch = malloc(2 * data->set.buffer_size);
230636
         if(data->state.scratch == NULL) {
230636
           failf (data, "Failed to alloc scratch buffer!");
230636
           return CURLE_OUT_OF_MEMORY;
230636
-- 
230636
2.17.2
230636
230636
230636
From a8725233e1af133dd1d89c89b30ef4396c3f2e5b Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 15:19:19 +0200
230636
Subject: [PATCH 15/18] sendf: remove use of BUFSIZE from debug data
230636
 conversions
230636
230636
The buffer can have other sizes.
230636
230636
Upstream-commit: 7ee52c25f35816968b86d32eaef70ab743a457d4
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/sendf.c | 51 ++++++++++++++++++++++++++-------------------------
230636
 1 file changed, 26 insertions(+), 25 deletions(-)
230636
230636
diff --git a/lib/sendf.c b/lib/sendf.c
230636
index fb0e6e8..bad4683 100644
230636
--- a/lib/sendf.c
230636
+++ b/lib/sendf.c
230636
@@ -584,21 +584,19 @@ static int showit(struct SessionHandle *data, curl_infotype type,
230636
 {
230636
   static const char s_infotype[CURLINFO_END][3] = {
230636
     "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
230636
+  int rc = 0;
230636
 
230636
 #ifdef CURL_DOES_CONVERSIONS
230636
-  char buf[BUFSIZE+1];
230636
+  char *buf = NULL;
230636
   size_t conv_size = 0;
230636
 
230636
   switch(type) {
230636
   case CURLINFO_HEADER_OUT:
230636
-    /* assume output headers are ASCII */
230636
-    /* copy the data into my buffer so the original is unchanged */
230636
-    if(size > BUFSIZE) {
230636
-      size = BUFSIZE; /* truncate if necessary */
230636
-      buf[BUFSIZE] = '\0';
230636
-    }
230636
+    buf = Curl_memdup(ptr, size);
230636
+    if(!buf)
230636
+      return 1;
230636
     conv_size = size;
230636
-    memcpy(buf, ptr, size);
230636
+
230636
     /* Special processing is needed for this block if it
230636
      * contains both headers and data (separated by CRLFCRLF).
230636
      * We want to convert just the headers, leaving the data as-is.
230636
@@ -626,26 +624,29 @@ static int showit(struct SessionHandle *data, curl_infotype type,
230636
 #endif /* CURL_DOES_CONVERSIONS */
230636
 
230636
   if(data->set.fdebug)
230636
-    return (*data->set.fdebug)(data, type, ptr, size,
230636
-                               data->set.debugdata);
230636
-
230636
-  switch(type) {
230636
-  case CURLINFO_TEXT:
230636
-  case CURLINFO_HEADER_OUT:
230636
-  case CURLINFO_HEADER_IN:
230636
-    fwrite(s_infotype[type], 2, 1, data->set.err);
230636
-    fwrite(ptr, size, 1, data->set.err);
230636
+    rc = (*data->set.fdebug)(data, type, ptr, size, data->set.debugdata);
230636
+  else {
230636
+    switch(type) {
230636
+    case CURLINFO_TEXT:
230636
+    case CURLINFO_HEADER_OUT:
230636
+    case CURLINFO_HEADER_IN:
230636
+      fwrite(s_infotype[type], 2, 1, data->set.err);
230636
+      fwrite(ptr, size, 1, data->set.err);
230636
 #ifdef CURL_DOES_CONVERSIONS
230636
-    if(size != conv_size) {
230636
-      /* we had untranslated data so we need an explicit newline */
230636
-      fwrite("\n", 1, 1, data->set.err);
230636
-    }
230636
+      if(size != conv_size) {
230636
+        /* we had untranslated data so we need an explicit newline */
230636
+        fwrite("\n", 1, 1, data->set.err);
230636
+      }
230636
 #endif
230636
-    break;
230636
-  default: /* nada */
230636
-    break;
230636
+      break;
230636
+    default: /* nada */
230636
+      break;
230636
+    }
230636
   }
230636
-  return 0;
230636
+#ifdef CURL_DOES_CONVERSIONS
230636
+  free(buf);
230636
+#endif
230636
+  return rc;
230636
 }
230636
 
230636
 int Curl_debug(struct SessionHandle *data, curl_infotype type,
230636
-- 
230636
2.17.2
230636
230636
230636
From a600c050d0fcaa5bff272f47b9be0a653a4071c6 Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 25 Apr 2017 15:31:14 +0200
230636
Subject: [PATCH 16/18] BUFSIZE: rename to READBUFFER_*, make separate
230636
 MASTERBUF_SIZE
230636
230636
Upstream-commit: e3ed5cb380e615e91d99b09da9f0ead0eaf3e0b5
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/multi.c   |  4 ++--
230636
 lib/sendf.c   |  2 +-
230636
 lib/url.c     | 25 ++++++++++++++-----------
230636
 lib/urldata.h | 10 +++-------
230636
 4 files changed, 20 insertions(+), 21 deletions(-)
230636
230636
diff --git a/lib/multi.c b/lib/multi.c
230636
index 3029fa6..39a0938 100644
230636
--- a/lib/multi.c
230636
+++ b/lib/multi.c
230636
@@ -1452,7 +1452,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
230636
 
230636
         /* calculate upload rate-limitation timeout. */
230636
         buffersize = (int)(data->set.buffer_size ?
230636
-                           data->set.buffer_size : BUFSIZE);
230636
+                           data->set.buffer_size : MASTERBUF_SIZE);
230636
         timeout_ms = Curl_sleep_time(data->set.max_send_speed,
230636
                                      data->progress.ulspeed, buffersize);
230636
         Curl_expire(data, timeout_ms);
230636
@@ -1468,7 +1468,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
230636
 
230636
          /* Calculate download rate-limitation timeout. */
230636
         buffersize = (int)(data->set.buffer_size ?
230636
-                           data->set.buffer_size : BUFSIZE);
230636
+                           data->set.buffer_size : MASTERBUF_SIZE);
230636
         timeout_ms = Curl_sleep_time(data->set.max_recv_speed,
230636
                                      data->progress.dlspeed, buffersize);
230636
         Curl_expire(data, timeout_ms);
230636
diff --git a/lib/sendf.c b/lib/sendf.c
230636
index bad4683..95d1a51 100644
230636
--- a/lib/sendf.c
230636
+++ b/lib/sendf.c
230636
@@ -555,7 +555,7 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
230636
     }
230636
     /* If we come here, it means that there is no data to read from the buffer,
230636
      * so we read from the socket */
230636
-    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
230636
+    bytesfromsocket = CURLMIN(sizerequested, MASTERBUF_SIZE);
230636
     buffertofill = conn->master_buffer;
230636
   }
230636
   else {
230636
diff --git a/lib/url.c b/lib/url.c
230636
index b86243b..cb3f3c3 100644
230636
--- a/lib/url.c
230636
+++ b/lib/url.c
230636
@@ -242,6 +242,10 @@ static const struct Curl_handler * const protocols[] = {
230636
   (struct Curl_handler *) NULL
230636
 };
230636
 
230636
+#define READBUFFER_SIZE CURL_MAX_WRITE_SIZE
230636
+#define READBUFFER_MAX  CURL_MAX_READ_SIZE
230636
+#define READBUFFER_MIN  1024
230636
+
230636
 /*
230636
  * Dummy handler for undefined protocol schemes.
230636
  */
230636
@@ -577,7 +581,7 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
230636
   set->tcp_keepintvl = 60;
230636
   set->tcp_keepidle = 60;
230636
 
230636
-  set->buffer_size = BUFSIZE;
230636
+  set->buffer_size = READBUFFER_SIZE;
230636
 
230636
   return res;
230636
 }
230636
@@ -615,7 +619,7 @@ CURLcode Curl_open(struct SessionHandle **curl)
230636
 
230636
   /* We do some initial setup here, all those fields that can't be just 0 */
230636
 
230636
-  data->state.buffer = malloc(BUFSIZE + 1);
230636
+  data->state.buffer = malloc(READBUFFER_SIZE + 1);
230636
   if(!data->state.buffer) {
230636
     DEBUGF(fprintf(stderr, "Error: malloc of buffer failed\n"));
230636
     res = CURLE_OUT_OF_MEMORY;
230636
@@ -1969,17 +1973,16 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
230636
      */
230636
     arg = va_arg(param, long);
230636
 
230636
-    if(arg > MAX_BUFSIZE)
230636
-      arg = MAX_BUFSIZE; /* huge internal default */
230636
+    if(arg > READBUFFER_MAX)
230636
+      arg = READBUFFER_MAX; /* huge internal default */
230636
     else if(arg < 1)
230636
-      arg = BUFSIZE;
230636
-    else if(arg < MIN_BUFSIZE)
230636
-      arg = BUFSIZE;
230636
+      arg = READBUFFER_SIZE;
230636
+    else if(arg < READBUFFER_MIN)
230636
+      arg = READBUFFER_MIN;
230636
 
230636
     /* Resize only if larger than default buffer size. */
230636
-    if(arg > BUFSIZE) {
230636
-      data->state.buffer = realloc(data->state.buffer,
230636
-                                   data->set.buffer_size + 1);
230636
+    if(arg > READBUFFER_SIZE) {
230636
+      data->state.buffer = realloc(data->state.buffer, arg + 1);
230636
       if(!data->state.buffer) {
230636
         DEBUGF(fprintf(stderr, "Error: realloc of buffer failed\n"));
230636
         result = CURLE_OUT_OF_MEMORY;
230636
@@ -3537,7 +3540,7 @@ static struct connectdata *allocate_conn(struct SessionHandle *data)
230636
   if(data->multi && Curl_multi_canPipeline(data->multi) &&
230636
       !conn->master_buffer) {
230636
     /* Allocate master_buffer to be used for pipelining */
230636
-    conn->master_buffer = calloc(BUFSIZE, sizeof (char));
230636
+    conn->master_buffer = calloc(MASTERBUF_SIZE, sizeof (char));
230636
     if(!conn->master_buffer)
230636
       goto error;
230636
   }
230636
diff --git a/lib/urldata.h b/lib/urldata.h
230636
index afe37c0..d10c784 100644
230636
--- a/lib/urldata.h
230636
+++ b/lib/urldata.h
230636
@@ -193,17 +193,13 @@
230636
 #include <libssh2_sftp.h>
230636
 #endif /* HAVE_LIBSSH2_H */
230636
 
230636
-/* Download buffer size, keep it fairly big for speed reasons */
230636
-#undef BUFSIZE
230636
-#define BUFSIZE CURL_MAX_WRITE_SIZE
230636
-#undef MAX_BUFSIZE
230636
-#define MAX_BUFSIZE CURL_MAX_READ_SIZE
230636
-#define MIN_BUFSIZE 1024
230636
-
230636
 /* The upload buffer size, should not be smaller than CURL_MAX_WRITE_SIZE, as
230636
    it needs to hold a full buffer as could be sent in a write callback */
230636
 #define UPLOAD_BUFSIZE CURL_MAX_WRITE_SIZE
230636
 
230636
+/* The "master buffer" is for HTTP pipelining */
230636
+#define MASTERBUF_SIZE 16384
230636
+
230636
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
230636
    of need. */
230636
 #define HEADERSIZE 256
230636
-- 
230636
2.17.2
230636
230636
230636
From 40c7b1ccca9fcf3b0ce261f098faebd58ed439ac Mon Sep 17 00:00:00 2001
230636
From: Daniel Stenberg <daniel@haxx.se>
230636
Date: Tue, 2 May 2017 08:32:04 +0200
230636
Subject: [PATCH 17/18] ssh: fix compiler warning from e40e9d7f0de
230636
230636
Upstream-commit: eab6732fde094073480af5039b6fb495cbc3fb8a
230636
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
230636
---
230636
 lib/ssh.c | 2 +-
230636
 1 file changed, 1 insertion(+), 1 deletion(-)
230636
230636
diff --git a/lib/ssh.c b/lib/ssh.c
230636
index 169ef1b..b1f136e 100644
230636
--- a/lib/ssh.c
230636
+++ b/lib/ssh.c
230636
@@ -1712,7 +1712,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
230636
             do {
230636
               size_t readthisamountnow =
230636
                 (data->state.resume_from - passed > data->set.buffer_size) ?
230636
-                data->set.buffer_size :
230636
+                (size_t)data->set.buffer_size :
230636
                 curlx_sotouz(data->state.resume_from - passed);
230636
 
230636
               size_t actuallyread =
230636
-- 
230636
2.17.2
230636
230636
6311d4
From 9f3810bae5fad685e848a39750863557e17a0163 Mon Sep 17 00:00:00 2001
6311d4
From: Daniel Stenberg <daniel@haxx.se>
6311d4
Date: Thu, 8 Mar 2018 10:33:16 +0100
230636
Subject: [PATCH 18/18] readwrite: make sure excess reads don't go beyond
230636
 buffer end
6311d4
6311d4
CVE-2018-1000122
6311d4
Bug: https://curl.haxx.se/docs/adv_2018-b047.html
6311d4
6311d4
Detected by OSS-fuzz
6311d4
6311d4
Upstream-commit: d52dc4760f6d9ca1937eefa2093058a952465128
6311d4
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
6311d4
---
6311d4
 lib/transfer.c | 9 +++++++--
6311d4
 1 file changed, 7 insertions(+), 2 deletions(-)
6311d4
6311d4
diff --git a/lib/transfer.c b/lib/transfer.c
6311d4
index dff6838..7ad6e3c 100644
6311d4
--- a/lib/transfer.c
6311d4
+++ b/lib/transfer.c
230636
@@ -735,10 +735,15 @@ static CURLcode readwrite_data(struct SessionHandle *data,
6311d4
 
6311d4
     } /* if(! header and data to read ) */
6311d4
 
6311d4
-    if(conn->handler->readwrite &&
6311d4
-       (excess > 0 && !conn->bits.stream_was_rewound)) {
6311d4
+    if(conn->handler->readwrite && excess && !conn->bits.stream_was_rewound) {
6311d4
       /* Parse the excess data */
6311d4
       k->str += nread;
6311d4
+
6311d4
+      if(&k->str[excess] > &k->buf[data->set.buffer_size]) {
6311d4
+        /* the excess amount was too excessive(!), make sure
6311d4
+           it doesn't read out of buffer */
6311d4
+        excess = &k->buf[data->set.buffer_size] - k->str;
6311d4
+      }
6311d4
       nread = (ssize_t)excess;
6311d4
 
6311d4
       result = conn->handler->readwrite(data, conn, &nread, &readmore);
6311d4
-- 
6311d4
2.14.3
6311d4