Blame SOURCES/0061-curl-7.29.0-CVE-2018-1000122.patch

9d7d3f
From 9f163418fabbe6219ab04cfe9bf81d2f33bd54d7 Mon Sep 17 00:00:00 2001
9d7d3f
From: Richy Kim <richy@fb.com>
9d7d3f
Date: Tue, 20 Dec 2016 05:48:15 -0500
9d7d3f
Subject: [PATCH 01/18] CURLOPT_BUFFERSIZE: support enlarging receive buffer
9d7d3f
9d7d3f
Replace use of fixed macro BUFSIZE to define the size of the receive
9d7d3f
buffer.  Reappropriate CURLOPT_BUFFERSIZE to include enlarging receive
9d7d3f
buffer size.  Upon setting, resize buffer if larger than the current
9d7d3f
default size up to a MAX_BUFSIZE (512KB). This can benefit protocols
9d7d3f
like SFTP.
9d7d3f
9d7d3f
Closes #1222
9d7d3f
9d7d3f
Upstream-commit: 6b7616690e5370c21e3a760321af6bf4edbabfb6
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 docs/libcurl/curl_easy_setopt.3  | 12 ++++++------
9d7d3f
 docs/libcurl/symbols-in-versions |  1 +
9d7d3f
 include/curl/curl.h              |  5 +++++
9d7d3f
 lib/easy.c                       |  6 ++++++
9d7d3f
 lib/file.c                       |  2 +-
9d7d3f
 lib/ftp.c                        |  4 ++--
9d7d3f
 lib/http.c                       |  3 ++-
9d7d3f
 lib/telnet.c                     |  5 +++--
9d7d3f
 lib/url.c                        | 28 +++++++++++++++++++++++-----
9d7d3f
 lib/urldata.h                    |  5 ++++-
9d7d3f
 10 files changed, 53 insertions(+), 18 deletions(-)
9d7d3f
9d7d3f
diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3
9d7d3f
index cbebfba..17b632f 100644
9d7d3f
--- a/docs/libcurl/curl_easy_setopt.3
9d7d3f
+++ b/docs/libcurl/curl_easy_setopt.3
9d7d3f
@@ -938,12 +938,12 @@ to using the share interface instead! See \fICURLOPT_SHARE\fP and
9d7d3f
 .IP CURLOPT_BUFFERSIZE
9d7d3f
 Pass a long specifying your preferred size (in bytes) for the receive buffer
9d7d3f
 in libcurl.  The main point of this would be that the write callback gets
9d7d3f
-called more often and with smaller chunks. This is just treated as a request,
9d7d3f
-not an order. You cannot be guaranteed to actually get the given size. (Added
9d7d3f
-in 7.10)
9d7d3f
-
9d7d3f
-This size is by default set as big as possible (CURL_MAX_WRITE_SIZE), so it
9d7d3f
-only makes sense to use this option if you want it smaller.
9d7d3f
+called more often and with smaller chunks.  Secondly, for some protocols,
9d7d3f
+there's a benefit of having a larger buffer for performance.  This is just
9d7d3f
+treated as a request, not an order. You cannot be guaranteed to actually get
9d7d3f
+the given size.  This buffer size is by default \fICURL_MAX_WRITE_SIZE\fP
9d7d3f
+(16kB). The maximum buffer size allowed to set is \fICURL_MAX_READ_SIZE\fP
9d7d3f
+(512kB).  (Added in 7.10)
9d7d3f
 .IP CURLOPT_PORT
9d7d3f
 Pass a long specifying what remote port number to connect to, instead of the
9d7d3f
 one specified in the URL or the default port for the used protocol.
9d7d3f
diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
9d7d3f
index b0b6232..e2cce4c 100644
9d7d3f
--- a/docs/libcurl/symbols-in-versions
9d7d3f
+++ b/docs/libcurl/symbols-in-versions
9d7d3f
@@ -639,6 +639,7 @@ CURL_LOCK_TYPE_DNS              7.10          -           7.10.2
9d7d3f
 CURL_LOCK_TYPE_NONE             7.10          -           7.10.2
9d7d3f
 CURL_LOCK_TYPE_SSL_SESSION      7.10          -           7.10.2
9d7d3f
 CURL_MAX_HTTP_HEADER            7.19.7
9d7d3f
+CURL_MAX_READ_SIZE              7.53.0
9d7d3f
 CURL_MAX_WRITE_SIZE             7.9.7
9d7d3f
 CURL_NETRC_IGNORED              7.9.8
9d7d3f
 CURL_NETRC_OPTIONAL             7.9.8
9d7d3f
diff --git a/include/curl/curl.h b/include/curl/curl.h
9d7d3f
index 0375a64..8b639fa 100644
9d7d3f
--- a/include/curl/curl.h
9d7d3f
+++ b/include/curl/curl.h
9d7d3f
@@ -170,6 +170,11 @@ typedef int (*curl_progress_callback)(void *clientp,
9d7d3f
                                       double ultotal,
9d7d3f
                                       double ulnow);
9d7d3f
 
9d7d3f
+#ifndef CURL_MAX_READ_SIZE
9d7d3f
+  /* The maximum receive buffer size configurable via CURLOPT_BUFFERSIZE. */
9d7d3f
+#define CURL_MAX_READ_SIZE 524288
9d7d3f
+#endif
9d7d3f
+
9d7d3f
 #ifndef CURL_MAX_WRITE_SIZE
9d7d3f
   /* Tests have proven that 20K is a very bad buffer size for uploads on
9d7d3f
      Windows, while 16K for some odd reason performed a lot better.
9d7d3f
diff --git a/lib/easy.c b/lib/easy.c
9d7d3f
index 0e9ba18..5d4d5ae 100644
9d7d3f
--- a/lib/easy.c
9d7d3f
+++ b/lib/easy.c
9d7d3f
@@ -563,6 +563,11 @@ CURL *curl_easy_duphandle(CURL *incurl)
9d7d3f
    * get setup on-demand in the code, as that would probably decrease
9d7d3f
    * the likeliness of us forgetting to init a buffer here in the future.
9d7d3f
    */
9d7d3f
+  outcurl->set.buffer_size = data->set.buffer_size;
9d7d3f
+  outcurl->state.buffer = malloc(CURL_BUFSIZE(outcurl->set.buffer_size) + 1);
9d7d3f
+  if(!outcurl->state.buffer)
9d7d3f
+    goto fail;
9d7d3f
+
9d7d3f
   outcurl->state.headerbuff = malloc(HEADERSIZE);
9d7d3f
   if(!outcurl->state.headerbuff)
9d7d3f
     goto fail;
9d7d3f
@@ -633,6 +638,7 @@ CURL *curl_easy_duphandle(CURL *incurl)
9d7d3f
   if(outcurl) {
9d7d3f
     curl_slist_free_all(outcurl->change.cookielist);
9d7d3f
     outcurl->change.cookielist = NULL;
9d7d3f
+    Curl_safefree(outcurl->state.buffer);
9d7d3f
     Curl_safefree(outcurl->state.headerbuff);
9d7d3f
     Curl_safefree(outcurl->change.url);
9d7d3f
     Curl_safefree(outcurl->change.referer);
9d7d3f
diff --git a/lib/file.c b/lib/file.c
9d7d3f
index 038bf42..1ad4758 100644
9d7d3f
--- a/lib/file.c
9d7d3f
+++ b/lib/file.c
9d7d3f
@@ -473,7 +473,7 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
9d7d3f
      date. */
9d7d3f
   if(data->set.opt_no_body && data->set.include_header && fstated) {
9d7d3f
     CURLcode result;
9d7d3f
-    snprintf(buf, sizeof(data->state.buffer),
9d7d3f
+    snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
9d7d3f
              "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);
9d7d3f
     result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
9d7d3f
     if(result)
9d7d3f
diff --git a/lib/ftp.c b/lib/ftp.c
9d7d3f
index a9826ce..730b695 100644
9d7d3f
--- a/lib/ftp.c
9d7d3f
+++ b/lib/ftp.c
9d7d3f
@@ -2136,7 +2136,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
9d7d3f
         /* we have a time, reformat it */
9d7d3f
         time_t secs=time(NULL);
9d7d3f
         /* using the good old yacc/bison yuck */
9d7d3f
-        snprintf(buf, sizeof(conn->data->state.buffer),
9d7d3f
+        snprintf(buf, CURL_BUFSIZE(conn->data->set.buffer_size),
9d7d3f
                  "%04d%02d%02d %02d:%02d:%02d GMT",
9d7d3f
                  year, month, day, hour, minute, second);
9d7d3f
         /* now, convert this into a time() value: */
9d7d3f
@@ -2347,7 +2347,7 @@ static CURLcode ftp_state_size_resp(struct connectdata *conn,
9d7d3f
   if(instate == FTP_SIZE) {
9d7d3f
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
9d7d3f
     if(-1 != filesize) {
9d7d3f
-      snprintf(buf, sizeof(data->state.buffer),
9d7d3f
+      snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
9d7d3f
                "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);
9d7d3f
       result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
9d7d3f
       if(result)
9d7d3f
diff --git a/lib/http.c b/lib/http.c
9d7d3f
index 1487fb2..f4368c4 100644
9d7d3f
--- a/lib/http.c
9d7d3f
+++ b/lib/http.c
9d7d3f
@@ -247,7 +247,8 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
9d7d3f
     pwd = conn->passwd;
9d7d3f
   }
9d7d3f
 
9d7d3f
-  snprintf(data->state.buffer, sizeof(data->state.buffer), "%s:%s", user, pwd);
9d7d3f
+  snprintf(data->state.buffer, CURL_BUFSIZE(data->set.buffer_size),
9d7d3f
+           "%s:%s", user, pwd);
9d7d3f
 
9d7d3f
   error = Curl_base64_encode(data,
9d7d3f
                              data->state.buffer, strlen(data->state.buffer),
9d7d3f
diff --git a/lib/telnet.c b/lib/telnet.c
9d7d3f
index 77d8b7b..89452dd 100644
9d7d3f
--- a/lib/telnet.c
9d7d3f
+++ b/lib/telnet.c
9d7d3f
@@ -1421,6 +1421,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
 
9d7d3f
   /* Keep on listening and act on events */
9d7d3f
   while(keepon) {
9d7d3f
+    const size_t buf_size = CURL_BUFSIZE(data->set.buffer_size);
9d7d3f
     waitret = WaitForMultipleObjects(obj_count, objs, FALSE, wait_timeout);
9d7d3f
     switch(waitret) {
9d7d3f
     case WAIT_TIMEOUT:
9d7d3f
@@ -1455,7 +1456,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
           if(!readfile_read)
9d7d3f
             break;
9d7d3f
 
9d7d3f
-          if(!ReadFile(stdin_handle, buf, sizeof(data->state.buffer),
9d7d3f
+          if(!ReadFile(stdin_handle, buf, buf_size,
9d7d3f
                        &readfile_read, NULL)) {
9d7d3f
             keepon = FALSE;
9d7d3f
             code = CURLE_READ_ERROR;
9d7d3f
@@ -1474,7 +1475,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
 
9d7d3f
     case WAIT_OBJECT_0 + 1:
9d7d3f
     {
9d7d3f
-      if(!ReadFile(stdin_handle, buf, sizeof(data->state.buffer),
9d7d3f
+      if(!ReadFile(stdin_handle, buf, buf_size,
9d7d3f
                    &readfile_read, NULL)) {
9d7d3f
         keepon = FALSE;
9d7d3f
         code = CURLE_READ_ERROR;
9d7d3f
diff --git a/lib/url.c b/lib/url.c
9d7d3f
index 89958a7..32e7e2e 100644
9d7d3f
--- a/lib/url.c
9d7d3f
+++ b/lib/url.c
9d7d3f
@@ -441,6 +441,7 @@ CURLcode Curl_close(struct SessionHandle *data)
9d7d3f
   }
9d7d3f
   data->change.url = NULL;
9d7d3f
 
9d7d3f
+  Curl_safefree(data->state.buffer);
9d7d3f
   Curl_safefree(data->state.headerbuff);
9d7d3f
 
9d7d3f
   Curl_flush_cookies(data, 1);
9d7d3f
@@ -612,6 +613,12 @@ CURLcode Curl_open(struct SessionHandle **curl)
9d7d3f
 
9d7d3f
   /* We do some initial setup here, all those fields that can't be just 0 */
9d7d3f
 
9d7d3f
+  data->state.buffer = malloc(BUFSIZE + 1);
9d7d3f
+  if(!data->state.buffer) {
9d7d3f
+    DEBUGF(fprintf(stderr, "Error: malloc of buffer failed\n"));
9d7d3f
+    res = CURLE_OUT_OF_MEMORY;
9d7d3f
+  }
9d7d3f
+
9d7d3f
   data->state.headerbuff = malloc(HEADERSIZE);
9d7d3f
   if(!data->state.headerbuff) {
9d7d3f
     DEBUGF(fprintf(stderr, "Error: malloc of headerbuff failed\n"));
9d7d3f
@@ -642,8 +649,8 @@ CURLcode Curl_open(struct SessionHandle **curl)
9d7d3f
 
9d7d3f
   if(res) {
9d7d3f
     Curl_resolver_cleanup(data->state.resolver);
9d7d3f
-    if(data->state.headerbuff)
9d7d3f
-      free(data->state.headerbuff);
9d7d3f
+    free(data->state.buffer);
9d7d3f
+    free(data->state.headerbuff);
9d7d3f
     Curl_freeset(data);
9d7d3f
     free(data);
9d7d3f
     data = NULL;
9d7d3f
@@ -1960,9 +1967,20 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
9d7d3f
      */
9d7d3f
     data->set.buffer_size = va_arg(param, long);
9d7d3f
 
9d7d3f
-    if((data->set.buffer_size> (BUFSIZE -1 )) ||
9d7d3f
-       (data->set.buffer_size < 1))
9d7d3f
-      data->set.buffer_size = 0; /* huge internal default */
9d7d3f
+    if(data->set.buffer_size > MAX_BUFSIZE)
9d7d3f
+      data->set.buffer_size = MAX_BUFSIZE; /* huge internal default */
9d7d3f
+    else if(data->set.buffer_size < 1)
9d7d3f
+      data->set.buffer_size = BUFSIZE;
9d7d3f
+
9d7d3f
+    /* Resize only if larger than default buffer size. */
9d7d3f
+    if(data->set.buffer_size > BUFSIZE) {
9d7d3f
+      data->state.buffer = realloc(data->state.buffer,
9d7d3f
+                                   data->set.buffer_size + 1);
9d7d3f
+      if(!data->state.buffer) {
9d7d3f
+        DEBUGF(fprintf(stderr, "Error: realloc of buffer failed\n"));
9d7d3f
+        result = CURLE_OUT_OF_MEMORY;
9d7d3f
+      }
9d7d3f
+    }
9d7d3f
 
9d7d3f
     break;
9d7d3f
 
9d7d3f
diff --git a/lib/urldata.h b/lib/urldata.h
9d7d3f
index 7431825..a7807cf 100644
9d7d3f
--- a/lib/urldata.h
9d7d3f
+++ b/lib/urldata.h
9d7d3f
@@ -196,6 +196,9 @@
9d7d3f
 /* Download buffer size, keep it fairly big for speed reasons */
9d7d3f
 #undef BUFSIZE
9d7d3f
 #define BUFSIZE CURL_MAX_WRITE_SIZE
9d7d3f
+#undef MAX_BUFSIZE
9d7d3f
+#define MAX_BUFSIZE CURL_MAX_READ_SIZE
9d7d3f
+#define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
9d7d3f
 
9d7d3f
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
9d7d3f
    of need. */
9d7d3f
@@ -1174,7 +1177,7 @@ struct UrlState {
9d7d3f
   char *headerbuff; /* allocated buffer to store headers in */
9d7d3f
   size_t headersize;   /* size of the allocation */
9d7d3f
 
9d7d3f
-  char buffer[BUFSIZE+1]; /* download buffer */
9d7d3f
+  char *buffer; /* download buffer */
9d7d3f
   char uploadbuffer[BUFSIZE+1]; /* upload buffer */
9d7d3f
   curl_off_t current_speed;  /* the ProgressShow() funcion sets this,
9d7d3f
                                 bytes / second */
9d7d3f
-- 
9d7d3f
2.14.3
9d7d3f
9d7d3f
9d7d3f
From f175a713c964d351012baaf8c78c1b468cc6aba0 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Mon, 24 Apr 2017 15:33:57 +0200
9d7d3f
Subject: [PATCH 02/18] http: use private user:password output buffer
9d7d3f
9d7d3f
Don't clobber the receive buffer.
9d7d3f
9d7d3f
Upstream-commit: 94460878cc634b590a7282e3fe60ceafb62d141a
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/http.c | 32 +++++++++++++++++++-------------
9d7d3f
 1 file changed, 19 insertions(+), 13 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/http.c b/lib/http.c
9d7d3f
index f4368c4..12e7dc3 100644
9d7d3f
--- a/lib/http.c
9d7d3f
+++ b/lib/http.c
9d7d3f
@@ -234,7 +234,8 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
9d7d3f
   char **userp;
9d7d3f
   const char *user;
9d7d3f
   const char *pwd;
9d7d3f
-  CURLcode error;
9d7d3f
+  CURLcode result;
9d7d3f
+  char *out;
9d7d3f
 
9d7d3f
   if(proxy) {
9d7d3f
     userp = &conn->allocptr.proxyuserpwd;
9d7d3f
@@ -247,27 +248,32 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
9d7d3f
     pwd = conn->passwd;
9d7d3f
   }
9d7d3f
 
9d7d3f
-  snprintf(data->state.buffer, CURL_BUFSIZE(data->set.buffer_size),
9d7d3f
-           "%s:%s", user, pwd);
9d7d3f
+  out = aprintf("%s:%s", user, pwd);
9d7d3f
+  if(!out)
9d7d3f
+    return CURLE_OUT_OF_MEMORY;
9d7d3f
 
9d7d3f
-  error = Curl_base64_encode(data,
9d7d3f
-                             data->state.buffer, strlen(data->state.buffer),
9d7d3f
-                             &authorization, &size);
9d7d3f
-  if(error)
9d7d3f
-    return error;
9d7d3f
+  result = Curl_base64_encode(data, out, strlen(out), &authorization, &size);
9d7d3f
+  if(result)
9d7d3f
+    goto fail;
9d7d3f
 
9d7d3f
-  if(!authorization)
9d7d3f
-    return CURLE_REMOTE_ACCESS_DENIED;
9d7d3f
+  if(!authorization) {
9d7d3f
+    result = CURLE_REMOTE_ACCESS_DENIED;
9d7d3f
+    goto fail;
9d7d3f
+  }
9d7d3f
 
9d7d3f
   Curl_safefree(*userp);
9d7d3f
   *userp = aprintf("%sAuthorization: Basic %s\r\n",
9d7d3f
                    proxy?"Proxy-":"",
9d7d3f
                    authorization);
9d7d3f
   free(authorization);
9d7d3f
-  if(!*userp)
9d7d3f
-    return CURLE_OUT_OF_MEMORY;
9d7d3f
+  if(!*userp) {
9d7d3f
+    result = CURLE_OUT_OF_MEMORY;
9d7d3f
+    goto fail;
9d7d3f
+  }
9d7d3f
 
9d7d3f
-  return CURLE_OK;
9d7d3f
+  fail:
9d7d3f
+  free(out);
9d7d3f
+  return result;
9d7d3f
 }
9d7d3f
 
9d7d3f
 /* pickoneauth() selects the most favourable authentication method from the
9d7d3f
-- 
9d7d3f
2.14.3
9d7d3f
9d7d3f
9d7d3f
From 6ff175806c338223a2a9a69f6ae8ae2b91dc2b56 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Mon, 24 Apr 2017 16:05:46 +0200
9d7d3f
Subject: [PATCH 03/18] ftp: use private buffer for temp storage, not receive
9d7d3f
 buffer
9d7d3f
9d7d3f
Upstream-commit: 349789e645a306a6ee467ef90a57f6cc306ca92e
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/ftp.c | 22 ++++++++++++----------
9d7d3f
 1 file changed, 12 insertions(+), 10 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/ftp.c b/lib/ftp.c
9d7d3f
index 730b695..10a21ce 100644
9d7d3f
--- a/lib/ftp.c
9d7d3f
+++ b/lib/ftp.c
9d7d3f
@@ -2130,17 +2130,17 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
9d7d3f
       /* we got a time. Format should be: "YYYYMMDDHHMMSS[.sss]" where the
9d7d3f
          last .sss part is optional and means fractions of a second */
9d7d3f
       int year, month, day, hour, minute, second;
9d7d3f
-      char *buf = data->state.buffer;
9d7d3f
-      if(6 == sscanf(buf+4, "%04d%02d%02d%02d%02d%02d",
9d7d3f
+      if(6 == sscanf(&data->state.buffer[4], "%04d%02d%02d%02d%02d%02d",
9d7d3f
                      &year, &month, &day, &hour, &minute, &second)) {
9d7d3f
         /* we have a time, reformat it */
9d7d3f
+        char timebuf[24];
9d7d3f
         time_t secs=time(NULL);
9d7d3f
-        /* using the good old yacc/bison yuck */
9d7d3f
-        snprintf(buf, CURL_BUFSIZE(conn->data->set.buffer_size),
9d7d3f
+
9d7d3f
+        snprintf(timebuf, sizeof(timebuf),
9d7d3f
                  "%04d%02d%02d %02d:%02d:%02d GMT",
9d7d3f
                  year, month, day, hour, minute, second);
9d7d3f
         /* now, convert this into a time() value: */
9d7d3f
-        data->info.filetime = (long)curl_getdate(buf, &secs;;
9d7d3f
+        data->info.filetime = (long)curl_getdate(timebuf, &secs;;
9d7d3f
       }
9d7d3f
 
9d7d3f
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
9d7d3f
@@ -2151,6 +2151,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
9d7d3f
          ftpc->file &&
9d7d3f
          data->set.get_filetime &&
9d7d3f
          (data->info.filetime>=0) ) {
9d7d3f
+        char headerbuf[128];
9d7d3f
         time_t filetime = (time_t)data->info.filetime;
9d7d3f
         struct tm buffer;
9d7d3f
         const struct tm *tm = &buffer;
9d7d3f
@@ -2160,7 +2161,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
9d7d3f
           return result;
9d7d3f
 
9d7d3f
         /* format: "Tue, 15 Nov 1994 12:45:26" */
9d7d3f
-        snprintf(buf, BUFSIZE-1,
9d7d3f
+        snprintf(headerbuf, sizeof(headerbuf),
9d7d3f
                  "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
9d7d3f
                  Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
9d7d3f
                  tm->tm_mday,
9d7d3f
@@ -2169,7 +2170,7 @@ static CURLcode ftp_state_mdtm_resp(struct connectdata *conn,
9d7d3f
                  tm->tm_hour,
9d7d3f
                  tm->tm_min,
9d7d3f
                  tm->tm_sec);
9d7d3f
-        result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
9d7d3f
+        result = Curl_client_write(conn, CLIENTWRITE_BOTH, headerbuf, 0);
9d7d3f
         if(result)
9d7d3f
           return result;
9d7d3f
       } /* end of a ridiculous amount of conditionals */
9d7d3f
@@ -2347,9 +2348,10 @@ static CURLcode ftp_state_size_resp(struct connectdata *conn,
9d7d3f
   if(instate == FTP_SIZE) {
9d7d3f
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
9d7d3f
     if(-1 != filesize) {
9d7d3f
-      snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
9d7d3f
+      char clbuf[128];
9d7d3f
+      snprintf(clbuf, sizeof(clbuf),
9d7d3f
                "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);
9d7d3f
-      result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
9d7d3f
+      result = Curl_client_write(conn, CLIENTWRITE_BOTH, clbuf, 0);
9d7d3f
       if(result)
9d7d3f
         return result;
9d7d3f
     }
9d7d3f
@@ -2450,7 +2452,6 @@ static CURLcode ftp_state_get_resp(struct connectdata *conn,
9d7d3f
   CURLcode result = CURLE_OK;
9d7d3f
   struct SessionHandle *data = conn->data;
9d7d3f
   struct FTP *ftp = data->state.proto.ftp;
9d7d3f
-  char *buf = data->state.buffer;
9d7d3f
 
9d7d3f
   if((ftpcode == 150) || (ftpcode == 125)) {
9d7d3f
 
9d7d3f
@@ -2494,6 +2495,7 @@ static CURLcode ftp_state_get_resp(struct connectdata *conn,
9d7d3f
        *
9d7d3f
        * Example D above makes this parsing a little tricky */
9d7d3f
       char *bytes;
9d7d3f
+      char *buf = data->state.buffer;
9d7d3f
       bytes=strstr(buf, " bytes");
9d7d3f
       if(bytes--) {
9d7d3f
         long in=(long)(bytes-buf);
9d7d3f
-- 
9d7d3f
2.14.3
9d7d3f
9d7d3f
9d7d3f
From b67324919089fc4f9bb7a38a6a31174883a4bc24 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 00:09:22 +0200
9d7d3f
Subject: [PATCH 04/18] CURLOPT_BUFFERSIZE: 1024 bytes is now the minimum size
9d7d3f
9d7d3f
The buffer is needed to receive FTP, HTTP CONNECT responses etc so
9d7d3f
already at this size things risk breaking and smaller is certainly not
9d7d3f
wise.
9d7d3f
9d7d3f
Upstream-commit: c2ddc12d6086b522703c8b80a72ab791680f1a28
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/url.c     | 15 +++++++++------
9d7d3f
 lib/urldata.h |  1 +
9d7d3f
 2 files changed, 10 insertions(+), 6 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/url.c b/lib/url.c
9d7d3f
index 32e7e2e..f87dca4 100644
9d7d3f
--- a/lib/url.c
9d7d3f
+++ b/lib/url.c
9d7d3f
@@ -1965,15 +1965,17 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
9d7d3f
      * The application kindly asks for a differently sized receive buffer.
9d7d3f
      * If it seems reasonable, we'll use it.
9d7d3f
      */
9d7d3f
-    data->set.buffer_size = va_arg(param, long);
9d7d3f
+    arg = va_arg(param, long);
9d7d3f
 
9d7d3f
-    if(data->set.buffer_size > MAX_BUFSIZE)
9d7d3f
-      data->set.buffer_size = MAX_BUFSIZE; /* huge internal default */
9d7d3f
-    else if(data->set.buffer_size < 1)
9d7d3f
-      data->set.buffer_size = BUFSIZE;
9d7d3f
+    if(arg > MAX_BUFSIZE)
9d7d3f
+      arg = MAX_BUFSIZE; /* huge internal default */
9d7d3f
+    else if(arg < 1)
9d7d3f
+      arg = BUFSIZE;
9d7d3f
+    else if(arg < MIN_BUFSIZE)
9d7d3f
+      arg = BUFSIZE;
9d7d3f
 
9d7d3f
     /* Resize only if larger than default buffer size. */
9d7d3f
-    if(data->set.buffer_size > BUFSIZE) {
9d7d3f
+    if(arg > BUFSIZE) {
9d7d3f
       data->state.buffer = realloc(data->state.buffer,
9d7d3f
                                    data->set.buffer_size + 1);
9d7d3f
       if(!data->state.buffer) {
9d7d3f
@@ -1981,6 +1983,7 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
9d7d3f
         result = CURLE_OUT_OF_MEMORY;
9d7d3f
       }
9d7d3f
     }
9d7d3f
+    data->set.buffer_size = arg;
9d7d3f
 
9d7d3f
     break;
9d7d3f
 
9d7d3f
diff --git a/lib/urldata.h b/lib/urldata.h
9d7d3f
index a7807cf..cd96e8f 100644
9d7d3f
--- a/lib/urldata.h
9d7d3f
+++ b/lib/urldata.h
9d7d3f
@@ -198,6 +198,7 @@
9d7d3f
 #define BUFSIZE CURL_MAX_WRITE_SIZE
9d7d3f
 #undef MAX_BUFSIZE
9d7d3f
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
9d7d3f
+#define MIN_BUFSIZE 1024
9d7d3f
 #define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
9d7d3f
 
9d7d3f
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
9d7d3f
-- 
9d7d3f
2.14.3
9d7d3f
9d7d3f
9d7d3f
From 9798012315c087168c5a4a1dc56eacfe82c69626 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 00:15:28 +0200
9d7d3f
Subject: [PATCH 05/18] file: use private buffer for C-L output
9d7d3f
9d7d3f
... instead of clobbering the download buffer.
9d7d3f
9d7d3f
Upstream-commit: 7c312f84ea930d89c0f0f774b50032c4f9ae30e4
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/file.c | 7 ++++---
9d7d3f
 1 file changed, 4 insertions(+), 3 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/file.c b/lib/file.c
9d7d3f
index 1ad4758..b6bf18e 100644
9d7d3f
--- a/lib/file.c
9d7d3f
+++ b/lib/file.c
9d7d3f
@@ -473,9 +473,10 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
9d7d3f
      date. */
9d7d3f
   if(data->set.opt_no_body && data->set.include_header && fstated) {
9d7d3f
     CURLcode result;
9d7d3f
-    snprintf(buf, CURL_BUFSIZE(data->set.buffer_size),
9d7d3f
+    char header[80];
9d7d3f
+    snprintf(header, sizeof(header),
9d7d3f
              "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);
9d7d3f
-    result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0);
9d7d3f
+    result = Curl_client_write(conn, CLIENTWRITE_BOTH, header, 0);
9d7d3f
     if(result)
9d7d3f
       return result;
9d7d3f
 
9d7d3f
@@ -493,7 +494,7 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
9d7d3f
         return result;
9d7d3f
 
9d7d3f
       /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
9d7d3f
-      snprintf(buf, BUFSIZE-1,
9d7d3f
+      snprintf(header, sizeof(header),
9d7d3f
                "Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
9d7d3f
                Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
9d7d3f
                tm->tm_mday,
9d7d3f
-- 
9d7d3f
2.14.3
9d7d3f
9d7d3f
9d7d3f
From f4868e737e9f8d719cb9897506da2c7f92dfd87d Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 00:16:10 +0200
9d7d3f
Subject: [PATCH 06/18] buffer_size: make sure it always has the correct size
9d7d3f
9d7d3f
Removes the need for CURL_BUFSIZE
9d7d3f
9d7d3f
Upstream-commit: f535f4f5fc6cbdce1aec5a3481cec37369dca468
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/easy.c    | 2 +-
9d7d3f
 lib/telnet.c  | 2 +-
9d7d3f
 lib/url.c     | 2 ++
9d7d3f
 lib/urldata.h | 1 -
9d7d3f
 4 files changed, 4 insertions(+), 3 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/easy.c b/lib/easy.c
9d7d3f
index 5d4d5ae..9cad5f1 100644
9d7d3f
--- a/lib/easy.c
9d7d3f
+++ b/lib/easy.c
9d7d3f
@@ -564,7 +564,7 @@ CURL *curl_easy_duphandle(CURL *incurl)
9d7d3f
    * the likeliness of us forgetting to init a buffer here in the future.
9d7d3f
    */
9d7d3f
   outcurl->set.buffer_size = data->set.buffer_size;
9d7d3f
-  outcurl->state.buffer = malloc(CURL_BUFSIZE(outcurl->set.buffer_size) + 1);
9d7d3f
+  outcurl->state.buffer = malloc(outcurl->set.buffer_size + 1);
9d7d3f
   if(!outcurl->state.buffer)
9d7d3f
     goto fail;
9d7d3f
 
9d7d3f
diff --git a/lib/telnet.c b/lib/telnet.c
9d7d3f
index 89452dd..e43b423 100644
9d7d3f
--- a/lib/telnet.c
9d7d3f
+++ b/lib/telnet.c
9d7d3f
@@ -1421,7 +1421,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
 
9d7d3f
   /* Keep on listening and act on events */
9d7d3f
   while(keepon) {
9d7d3f
-    const size_t buf_size = CURL_BUFSIZE(data->set.buffer_size);
9d7d3f
+    const size_t buf_size = (DWORD)data->set.buffer_size;
9d7d3f
     waitret = WaitForMultipleObjects(obj_count, objs, FALSE, wait_timeout);
9d7d3f
     switch(waitret) {
9d7d3f
     case WAIT_TIMEOUT:
9d7d3f
diff --git a/lib/url.c b/lib/url.c
9d7d3f
index f87dca4..81de7c2 100644
9d7d3f
--- a/lib/url.c
9d7d3f
+++ b/lib/url.c
9d7d3f
@@ -577,6 +577,8 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
9d7d3f
   set->tcp_keepintvl = 60;
9d7d3f
   set->tcp_keepidle = 60;
9d7d3f
 
9d7d3f
+  set->buffer_size = BUFSIZE;
9d7d3f
+
9d7d3f
   return res;
9d7d3f
 }
9d7d3f
 
9d7d3f
diff --git a/lib/urldata.h b/lib/urldata.h
9d7d3f
index cd96e8f..fbe69c2 100644
9d7d3f
--- a/lib/urldata.h
9d7d3f
+++ b/lib/urldata.h
9d7d3f
@@ -199,7 +199,6 @@
9d7d3f
 #undef MAX_BUFSIZE
9d7d3f
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
9d7d3f
 #define MIN_BUFSIZE 1024
9d7d3f
-#define CURL_BUFSIZE(x) ((x)?(x):(BUFSIZE))
9d7d3f
 
9d7d3f
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
9d7d3f
    of need. */
9d7d3f
-- 
9d7d3f
2.14.3
9d7d3f
9d7d3f
9d7d3f
From 43d9e7acc44c9849f85882d2ec18c2a609f90809 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 00:48:56 +0200
9d7d3f
Subject: [PATCH 07/18] http: don't clobber the receive buffer for timecond
9d7d3f
9d7d3f
Upstream-commit: 87eb8d5b30ce2adfe2673cc0b1abf6ca68891cc4
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/http.c | 37 +++++++++++++++++++------------------
9d7d3f
 1 file changed, 19 insertions(+), 18 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/http.c b/lib/http.c
9d7d3f
index 12e7dc3..6ecdda2 100644
9d7d3f
--- a/lib/http.c
9d7d3f
+++ b/lib/http.c
9d7d3f
@@ -1607,9 +1607,10 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
9d7d3f
                                 Curl_send_buffer *req_buffer)
9d7d3f
 {
9d7d3f
   const struct tm *tm;
9d7d3f
-  char *buf = data->state.buffer;
9d7d3f
   CURLcode result = CURLE_OK;
9d7d3f
   struct tm keeptime;
9d7d3f
+  char datestr[80];
9d7d3f
+  const char *condp;
9d7d3f
 
9d7d3f
   result = Curl_gmtime(data->set.timevalue, &keeptime);
9d7d3f
   if(result) {
9d7d3f
@@ -1618,6 +1619,19 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
9d7d3f
   }
9d7d3f
   tm = &keeptime;
9d7d3f
 
9d7d3f
+  switch(data->set.timecondition) {
9d7d3f
+  default:
9d7d3f
+  case CURL_TIMECOND_IFMODSINCE:
9d7d3f
+    condp = "If-Modified-Since";
9d7d3f
+    break;
9d7d3f
+  case CURL_TIMECOND_IFUNMODSINCE:
9d7d3f
+    condp = "If-Unmodified-Since";
9d7d3f
+    break;
9d7d3f
+  case CURL_TIMECOND_LASTMOD:
9d7d3f
+    condp = "Last-Modified";
9d7d3f
+    break;
9d7d3f
+  }
9d7d3f
+
9d7d3f
   /* The If-Modified-Since header family should have their times set in
9d7d3f
    * GMT as RFC2616 defines: "All HTTP date/time stamps MUST be
9d7d3f
    * represented in Greenwich Mean Time (GMT), without exception. For the
9d7d3f
@@ -1626,8 +1640,9 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
9d7d3f
    */
9d7d3f
 
9d7d3f
   /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
9d7d3f
-  snprintf(buf, BUFSIZE-1,
9d7d3f
-           "%s, %02d %s %4d %02d:%02d:%02d GMT",
9d7d3f
+  snprintf(datestr, sizeof(datestr),
9d7d3f
+           "%s: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
9d7d3f
+           condp,
9d7d3f
            Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
9d7d3f
            tm->tm_mday,
9d7d3f
            Curl_month[tm->tm_mon],
9d7d3f
@@ -1636,21 +1651,7 @@ CURLcode Curl_add_timecondition(struct SessionHandle *data,
9d7d3f
            tm->tm_min,
9d7d3f
            tm->tm_sec);
9d7d3f
 
9d7d3f
-  switch(data->set.timecondition) {
9d7d3f
-  case CURL_TIMECOND_IFMODSINCE:
9d7d3f
-  default:
9d7d3f
-    result = Curl_add_bufferf(req_buffer,
9d7d3f
-                              "If-Modified-Since: %s\r\n", buf);
9d7d3f
-    break;
9d7d3f
-  case CURL_TIMECOND_IFUNMODSINCE:
9d7d3f
-    result = Curl_add_bufferf(req_buffer,
9d7d3f
-                              "If-Unmodified-Since: %s\r\n", buf);
9d7d3f
-    break;
9d7d3f
-  case CURL_TIMECOND_LASTMOD:
9d7d3f
-    result = Curl_add_bufferf(req_buffer,
9d7d3f
-                              "Last-Modified: %s\r\n", buf);
9d7d3f
-    break;
9d7d3f
-  }
9d7d3f
+  result = Curl_add_buffer(req_buffer, datestr, strlen(datestr));
9d7d3f
 
9d7d3f
   return result;
9d7d3f
 }
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 91ca8ea3e4e984070ef07dbc1a7258ced3b6982a Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 00:50:04 +0200
9d7d3f
Subject: [PATCH 08/18] pingpong: use the set buffer size
9d7d3f
9d7d3f
Upstream-commit: b8191e975faa7810ed3d858205b0b3f0d297f0b2
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/pingpong.c | 15 +++++++++------
9d7d3f
 1 file changed, 9 insertions(+), 6 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/pingpong.c b/lib/pingpong.c
9d7d3f
index 16b4ad3..c4666fe 100644
9d7d3f
--- a/lib/pingpong.c
9d7d3f
+++ b/lib/pingpong.c
9d7d3f
@@ -309,7 +309,8 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
9d7d3f
 
9d7d3f
   keepon=TRUE;
9d7d3f
 
9d7d3f
-  while((pp->nread_resp
9d7d3f
+  while((pp->nread_resp < (size_t)data->set.buffer_size) &&
9d7d3f
+        (keepon && !result)) {
9d7d3f
 
9d7d3f
     if(pp->cache) {
9d7d3f
       /* we had data in the "cache", copy that instead of doing an actual
9d7d3f
@@ -319,7 +320,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
9d7d3f
        * it would have been populated with something of size int to begin
9d7d3f
        * with, even though its datatype may be larger than an int.
9d7d3f
        */
9d7d3f
-      DEBUGASSERT((ptr+pp->cache_size) <= (buf+BUFSIZE+1));
9d7d3f
+      DEBUGASSERT((ptr+pp->cache_size) <= (buf+data->set.buffer_size+1));
9d7d3f
       memcpy(ptr, pp->cache, pp->cache_size);
9d7d3f
       gotbytes = (ssize_t)pp->cache_size;
9d7d3f
       free(pp->cache);    /* free the cache */
9d7d3f
@@ -332,8 +333,10 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
9d7d3f
       enum protection_level prot = conn->data_prot;
9d7d3f
       conn->data_prot = PROT_CLEAR;
9d7d3f
 #endif
9d7d3f
-      DEBUGASSERT((ptr+BUFSIZE-pp->nread_resp) <= (buf+BUFSIZE+1));
9d7d3f
-      res = Curl_read(conn, sockfd, ptr, BUFSIZE-pp->nread_resp,
9d7d3f
+      DEBUGASSERT((ptr + data->set.buffer_size - pp->nread_resp) <=
9d7d3f
+                  (buf + data->set.buffer_size + 1));
9d7d3f
+      res = Curl_read(conn, sockfd, ptr,
9d7d3f
+                      data->set.buffer_size - pp->nread_resp,
9d7d3f
                       &gotbytes);
9d7d3f
 #if defined(HAVE_KRB4) || defined(HAVE_GSSAPI)
9d7d3f
       DEBUGASSERT(prot  > PROT_NONE && prot < PROT_LAST);
9d7d3f
@@ -430,7 +433,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
9d7d3f
       }
9d7d3f
       else if(keepon) {
9d7d3f
 
9d7d3f
-        if((perline == gotbytes) && (gotbytes > BUFSIZE/2)) {
9d7d3f
+        if((perline == gotbytes) && (gotbytes > data->set.buffer_size/2)) {
9d7d3f
           /* We got an excessive line without newlines and we need to deal
9d7d3f
              with it. We keep the first bytes of the line then we throw
9d7d3f
              away the rest. */
9d7d3f
@@ -442,7 +445,7 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,
9d7d3f
              interested in the first piece */
9d7d3f
           clipamount = 40;
9d7d3f
         }
9d7d3f
-        else if(pp->nread_resp > BUFSIZE/2) {
9d7d3f
+        else if(pp->nread_resp > (size_t)data->set.buffer_size/2) {
9d7d3f
           /* We got a large chunk of data and there's potentially still
9d7d3f
              trailing data to take care of, so we put any such part in the
9d7d3f
              "cache", clear the buffer to make space and restart. */
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 3bc2bc2f1c5e3afd7a7cbd208d97fbb37f2dfc5f Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 00:50:21 +0200
9d7d3f
Subject: [PATCH 09/18] failf: use private buffer, don't clobber receive buffer
9d7d3f
9d7d3f
Upstream-commit: f2fadf490f66ad364f5a6f0356d626dda5f9a82f
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/sendf.c | 15 +++++++--------
9d7d3f
 1 file changed, 7 insertions(+), 8 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/sendf.c b/lib/sendf.c
9d7d3f
index c64d686..403025b 100644
9d7d3f
--- a/lib/sendf.c
9d7d3f
+++ b/lib/sendf.c
9d7d3f
@@ -155,21 +155,20 @@ void Curl_failf(struct SessionHandle *data, const char *fmt, ...)
9d7d3f
 {
9d7d3f
   va_list ap;
9d7d3f
   size_t len;
9d7d3f
+  char error[CURL_ERROR_SIZE + 2];
9d7d3f
   va_start(ap, fmt);
9d7d3f
 
9d7d3f
-  vsnprintf(data->state.buffer, BUFSIZE, fmt, ap);
9d7d3f
+  vsnprintf(error, CURL_ERROR_SIZE, fmt, ap);
9d7d3f
+  len = strlen(error);
9d7d3f
 
9d7d3f
   if(data->set.errorbuffer && !data->state.errorbuf) {
9d7d3f
-    snprintf(data->set.errorbuffer, CURL_ERROR_SIZE, "%s", data->state.buffer);
9d7d3f
+    strcpy(data->set.errorbuffer, error);
9d7d3f
     data->state.errorbuf = TRUE; /* wrote error string */
9d7d3f
   }
9d7d3f
   if(data->set.verbose) {
9d7d3f
-    len = strlen(data->state.buffer);
9d7d3f
-    if(len < BUFSIZE - 1) {
9d7d3f
-      data->state.buffer[len] = '\n';
9d7d3f
-      data->state.buffer[++len] = '\0';
9d7d3f
-    }
9d7d3f
-    Curl_debug(data, CURLINFO_TEXT, data->state.buffer, len, NULL);
9d7d3f
+    error[len] = '\n';
9d7d3f
+    error[++len] = '\0';
9d7d3f
+    Curl_debug(data, CURLINFO_TEXT, error, len, NULL);
9d7d3f
   }
9d7d3f
 
9d7d3f
   va_end(ap);
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 0a1107c2ad898e837f0aa4742c1b17ef186a3243 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 00:50:50 +0200
9d7d3f
Subject: [PATCH 10/18] transfer: fix minor buffer_size mistake
9d7d3f
9d7d3f
Upstream-commit: 40a074f255de90003ab753f5d0ad61b74c62ca9b
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/transfer.c | 3 +--
9d7d3f
 1 file changed, 1 insertion(+), 2 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/transfer.c b/lib/transfer.c
9d7d3f
index dff6838..9b932de 100644
9d7d3f
--- a/lib/transfer.c
9d7d3f
+++ b/lib/transfer.c
9d7d3f
@@ -385,8 +385,7 @@ static CURLcode readwrite_data(struct SessionHandle *data,
9d7d3f
   /* This is where we loop until we have read everything there is to
9d7d3f
      read or we get a CURLE_AGAIN */
9d7d3f
   do {
9d7d3f
-    size_t buffersize = data->set.buffer_size?
9d7d3f
-      data->set.buffer_size : BUFSIZE;
9d7d3f
+    size_t buffersize = data->set.buffer_size;
9d7d3f
     size_t bytestoread = buffersize;
9d7d3f
 
9d7d3f
     if(k->size != -1 && !k->header) {
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 15408839da1b768974650bdf187c749432fdaefa Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 01:03:17 +0200
9d7d3f
Subject: [PATCH 11/18] http-proxy: use a dedicated CONNECT response buffer
9d7d3f
9d7d3f
To make it suitably independent of the receive buffer and its flexible
9d7d3f
size.
9d7d3f
9d7d3f
Upstream-commit: 0cab3a394a190c1cdf900cf2887ccdd6a7f213ef
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/http_proxy.c | 69 +++++++++++++++++++++++++++++++++++-------------
9d7d3f
 lib/url.c        |  1 +
9d7d3f
 lib/urldata.h    |  3 ++-
9d7d3f
 3 files changed, 53 insertions(+), 20 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/http_proxy.c b/lib/http_proxy.c
9d7d3f
index 4ab280f..13fb228 100644
9d7d3f
--- a/lib/http_proxy.c
9d7d3f
+++ b/lib/http_proxy.c
9d7d3f
@@ -83,20 +83,13 @@ CURLcode Curl_proxy_connect(struct connectdata *conn)
9d7d3f
   return CURLE_OK;
9d7d3f
 }
9d7d3f
 
9d7d3f
-/*
9d7d3f
- * Curl_proxyCONNECT() requires that we're connected to a HTTP proxy. This
9d7d3f
- * function will issue the necessary commands to get a seamless tunnel through
9d7d3f
- * this proxy. After that, the socket can be used just as a normal socket.
9d7d3f
- *
9d7d3f
- * 'blocking' set to TRUE means that this function will do the entire CONNECT
9d7d3f
- * + response in a blocking fashion. Should be avoided!
9d7d3f
- */
9d7d3f
+#define CONNECT_BUFFER_SIZE 16384
9d7d3f
 
9d7d3f
-CURLcode Curl_proxyCONNECT(struct connectdata *conn,
9d7d3f
-                           int sockindex,
9d7d3f
-                           const char *hostname,
9d7d3f
-                           unsigned short remote_port,
9d7d3f
-                           bool blocking)
9d7d3f
+CURLcode CONNECT(struct connectdata *conn,
9d7d3f
+                 int sockindex,
9d7d3f
+                 const char *hostname,
9d7d3f
+                 unsigned short remote_port,
9d7d3f
+                 bool blocking)
9d7d3f
 {
9d7d3f
   int subversion=0;
9d7d3f
   struct SessionHandle *data=conn->data;
9d7d3f
@@ -253,14 +246,19 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
9d7d3f
       char *ptr;
9d7d3f
       char *line_start;
9d7d3f
 
9d7d3f
-      ptr=data->state.buffer;
9d7d3f
+      ptr = conn->connect_buffer;
9d7d3f
       line_start = ptr;
9d7d3f
 
9d7d3f
       nread=0;
9d7d3f
       perline=0;
9d7d3f
       keepon=TRUE;
9d7d3f
 
9d7d3f
-      while((nread
9d7d3f
+      while((nread < (size_t)CONNECT_BUFFER_SIZE) && (keepon && !error)) {
9d7d3f
+
9d7d3f
+        if(ptr >= &conn->connect_buffer[CONNECT_BUFFER_SIZE]) {
9d7d3f
+          failf(data, "CONNECT response too large!");
9d7d3f
+          return CURLE_RECV_ERROR;
9d7d3f
+        }
9d7d3f
 
9d7d3f
         check = Curl_timeleft(data, NULL, TRUE);
9d7d3f
         if(check <= 0) {
9d7d3f
@@ -279,8 +277,8 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
9d7d3f
         case 0: /* timeout */
9d7d3f
           break;
9d7d3f
         default:
9d7d3f
-          DEBUGASSERT(ptr+BUFSIZE-nread <= data->state.buffer+BUFSIZE+1);
9d7d3f
-          result = Curl_read(conn, tunnelsocket, ptr, BUFSIZE-nread,
9d7d3f
+          result = Curl_read(conn, tunnelsocket, ptr,
9d7d3f
+                             CONNECT_BUFFER_SIZE - nread,
9d7d3f
                              &gotbytes);
9d7d3f
           if(result==CURLE_AGAIN)
9d7d3f
             continue; /* go loop yourself */
9d7d3f
@@ -313,7 +311,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
9d7d3f
               /* This means we are currently ignoring a response-body */
9d7d3f
 
9d7d3f
               nread = 0; /* make next read start over in the read buffer */
9d7d3f
-              ptr=data->state.buffer;
9d7d3f
+              ptr = conn->connect_buffer;
9d7d3f
               if(cl) {
9d7d3f
                 /* A Content-Length based body: simply count down the counter
9d7d3f
                    and make sure to break out of the loop when we're done! */
9d7d3f
@@ -386,7 +384,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
9d7d3f
                     /* end of response-headers from the proxy */
9d7d3f
                     nread = 0; /* make next read start over in the read
9d7d3f
                                   buffer */
9d7d3f
-                    ptr=data->state.buffer;
9d7d3f
+                    ptr = conn->connect_buffer;
9d7d3f
                     if((407 == k->httpcode) && !data->state.authproblem) {
9d7d3f
                       /* If we get a 407 response code with content length
9d7d3f
                          when we have no auth problem, we must ignore the
9d7d3f
@@ -585,4 +583,37 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
9d7d3f
   data->req.ignorebody = FALSE; /* put it (back) to non-ignore state */
9d7d3f
   return CURLE_OK;
9d7d3f
 }
9d7d3f
+
9d7d3f
+/*
9d7d3f
+ * Curl_proxyCONNECT() requires that we're connected to a HTTP proxy. This
9d7d3f
+ * function will issue the necessary commands to get a seamless tunnel through
9d7d3f
+ * this proxy. After that, the socket can be used just as a normal socket.
9d7d3f
+ *
9d7d3f
+ * 'blocking' set to TRUE means that this function will do the entire CONNECT
9d7d3f
+ * + response in a blocking fashion. Should be avoided!
9d7d3f
+ */
9d7d3f
+
9d7d3f
+CURLcode Curl_proxyCONNECT(struct connectdata *conn,
9d7d3f
+                           int sockindex,
9d7d3f
+                           const char *hostname,
9d7d3f
+                           unsigned short remote_port,
9d7d3f
+                           bool blocking)
9d7d3f
+{
9d7d3f
+  CURLcode result;
9d7d3f
+  if(TUNNEL_INIT == conn->tunnel_state[sockindex]) {
9d7d3f
+    if(!conn->connect_buffer) {
9d7d3f
+      conn->connect_buffer = malloc(CONNECT_BUFFER_SIZE);
9d7d3f
+      if(!conn->connect_buffer)
9d7d3f
+        return CURLE_OUT_OF_MEMORY;
9d7d3f
+    }
9d7d3f
+  }
9d7d3f
+  result = CONNECT(conn, sockindex, hostname, remote_port, blocking);
9d7d3f
+
9d7d3f
+  if(result || (TUNNEL_COMPLETE == conn->tunnel_state[sockindex]))
9d7d3f
+    Curl_safefree(conn->connect_buffer);
9d7d3f
+
9d7d3f
+  return result;
9d7d3f
+}
9d7d3f
+
9d7d3f
+
9d7d3f
 #endif /* CURL_DISABLE_PROXY */
9d7d3f
diff --git a/lib/url.c b/lib/url.c
9d7d3f
index 00fd15d..b86243b 100644
9d7d3f
--- a/lib/url.c
9d7d3f
+++ b/lib/url.c
9d7d3f
@@ -2523,6 +2523,7 @@ static void conn_free(struct connectdata *conn)
9d7d3f
   Curl_safefree(conn->host.rawalloc); /* host name buffer */
9d7d3f
   Curl_safefree(conn->proxy.rawalloc); /* proxy name buffer */
9d7d3f
   Curl_safefree(conn->master_buffer);
9d7d3f
+  Curl_safefree(conn->connect_buffer);
9d7d3f
 
9d7d3f
   Curl_llist_destroy(conn->send_pipe, NULL);
9d7d3f
   Curl_llist_destroy(conn->recv_pipe, NULL);
9d7d3f
diff --git a/lib/urldata.h b/lib/urldata.h
9d7d3f
index fbe69c2..c362c58 100644
9d7d3f
--- a/lib/urldata.h
9d7d3f
+++ b/lib/urldata.h
9d7d3f
@@ -1018,7 +1018,8 @@ struct connectdata {
9d7d3f
     TUNNEL_COMPLETE /* CONNECT response received completely */
9d7d3f
   } tunnel_state[2]; /* two separate ones to allow FTP */
9d7d3f
 
9d7d3f
-   struct connectbundle *bundle; /* The bundle we are member of */
9d7d3f
+  struct connectbundle *bundle; /* The bundle we are member of */
9d7d3f
+  char *connect_buffer; /* for CONNECT business */
9d7d3f
 };
9d7d3f
 
9d7d3f
 /* The end of connectdata. */
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 1122ecc4b522f24d466bcc2e658dd098a32d982f Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 14:37:06 +0200
9d7d3f
Subject: [PATCH 12/18] upload: UPLOAD_BUFSIZE is now for the upload buffer
9d7d3f
9d7d3f
Upstream-commit: 89cf6f38d2f525cbc8537a60061f5f37bb2f35f7
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/file.c     | 2 +-
9d7d3f
 lib/transfer.c | 2 +-
9d7d3f
 lib/urldata.h  | 6 +++++-
9d7d3f
 3 files changed, 7 insertions(+), 3 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/file.c b/lib/file.c
9d7d3f
index 98536cd..2f2e466 100644
9d7d3f
--- a/lib/file.c
9d7d3f
+++ b/lib/file.c
9d7d3f
@@ -364,7 +364,7 @@ static CURLcode file_upload(struct connectdata *conn)
9d7d3f
 
9d7d3f
   while(res == CURLE_OK) {
9d7d3f
     int readcount;
9d7d3f
-    res = Curl_fillreadbuffer(conn, BUFSIZE, &readcount);
9d7d3f
+    res = Curl_fillreadbuffer(conn, (int)data->set.buffer_size, &readcount);
9d7d3f
     if(res)
9d7d3f
       break;
9d7d3f
 
9d7d3f
diff --git a/lib/transfer.c b/lib/transfer.c
9d7d3f
index 9b932de..b707f8a 100644
9d7d3f
--- a/lib/transfer.c
9d7d3f
+++ b/lib/transfer.c
9d7d3f
@@ -835,7 +835,7 @@ static CURLcode readwrite_upload(struct SessionHandle *data,
9d7d3f
             sending_http_headers = FALSE;
9d7d3f
         }
9d7d3f
 
9d7d3f
-        result = Curl_fillreadbuffer(conn, BUFSIZE, &fillcount);
9d7d3f
+        result = Curl_fillreadbuffer(conn, UPLOAD_BUFSIZE, &fillcount);
9d7d3f
         if(result)
9d7d3f
           return result;
9d7d3f
 
9d7d3f
diff --git a/lib/urldata.h b/lib/urldata.h
9d7d3f
index c362c58..afe37c0 100644
9d7d3f
--- a/lib/urldata.h
9d7d3f
+++ b/lib/urldata.h
9d7d3f
@@ -200,6 +200,10 @@
9d7d3f
 #define MAX_BUFSIZE CURL_MAX_READ_SIZE
9d7d3f
 #define MIN_BUFSIZE 1024
9d7d3f
 
9d7d3f
+/* The upload buffer size, should not be smaller than CURL_MAX_WRITE_SIZE, as
9d7d3f
+   it needs to hold a full buffer as could be sent in a write callback */
9d7d3f
+#define UPLOAD_BUFSIZE CURL_MAX_WRITE_SIZE
9d7d3f
+
9d7d3f
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
9d7d3f
    of need. */
9d7d3f
 #define HEADERSIZE 256
9d7d3f
@@ -1179,7 +1183,7 @@ struct UrlState {
9d7d3f
   size_t headersize;   /* size of the allocation */
9d7d3f
 
9d7d3f
   char *buffer; /* download buffer */
9d7d3f
-  char uploadbuffer[BUFSIZE+1]; /* upload buffer */
9d7d3f
+  char uploadbuffer[UPLOAD_BUFSIZE+1]; /* upload buffer */
9d7d3f
   curl_off_t current_speed;  /* the ProgressShow() funcion sets this,
9d7d3f
                                 bytes / second */
9d7d3f
   bool this_is_a_follow; /* this is a followed Location: request */
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 4666a96fce7a2aa8c294cef7aec23e39a3d49673 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 14:37:45 +0200
9d7d3f
Subject: [PATCH 13/18] krb5: use private buffer for temp string, not receive
9d7d3f
 buffer
9d7d3f
9d7d3f
Upstream-commit: c79f4908d461cecaa9976099dcbb8a63b351f19e
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/krb5.c | 14 +++++++++-----
9d7d3f
 1 file changed, 9 insertions(+), 5 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/krb5.c b/lib/krb5.c
9d7d3f
index 1e99c70..e4eb0b0 100644
9d7d3f
--- a/lib/krb5.c
9d7d3f
+++ b/lib/krb5.c
9d7d3f
@@ -174,6 +174,7 @@ krb5_auth(void *app_data, struct connectdata *conn)
9d7d3f
   gss_ctx_id_t *context = app_data;
9d7d3f
   struct gss_channel_bindings_struct chan;
9d7d3f
   size_t base64_sz = 0;
9d7d3f
+  char *stringp;
9d7d3f
 
9d7d3f
   if(getsockname(conn->sock[FIRSTSOCKET],
9d7d3f
                  (struct sockaddr *)LOCAL_ADDR, &l) < 0)
9d7d3f
@@ -205,16 +206,19 @@ krb5_auth(void *app_data, struct connectdata *conn)
9d7d3f
         return -1;
9d7d3f
     }
9d7d3f
 
9d7d3f
-    input_buffer.value = data->state.buffer;
9d7d3f
-    input_buffer.length = snprintf(input_buffer.value, BUFSIZE, "%s@%s",
9d7d3f
-                                   service, host);
9d7d3f
+    stringp = aprintf("%s@%s", service, host);
9d7d3f
+    if(!stringp)
9d7d3f
+      return -2;
9d7d3f
+
9d7d3f
+    input_buffer.value = stringp;
9d7d3f
+    input_buffer.length = strlen(stringp);
9d7d3f
     maj = gss_import_name(&min, &input_buffer, GSS_C_NT_HOSTBASED_SERVICE,
9d7d3f
                           &gssname);
9d7d3f
+    free(stringp);
9d7d3f
     if(maj != GSS_S_COMPLETE) {
9d7d3f
       gss_release_name(&min, &gssname);
9d7d3f
       if(service == srv_host) {
9d7d3f
-        Curl_failf(data, "Error importing service name %s",
9d7d3f
-                   input_buffer.value);
9d7d3f
+        Curl_failf(data, "Error importing service name %s@%s", service, host);
9d7d3f
         return AUTH_ERROR;
9d7d3f
       }
9d7d3f
       service = srv_host;
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 4725e3cbe9af074304a4735b6ac667a154081b99 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 14:38:34 +0200
9d7d3f
Subject: [PATCH 14/18] buffer: use data->set.buffer_size instead of BUFSIZE
9d7d3f
9d7d3f
... to properly use the dynamically set buffer size!
9d7d3f
9d7d3f
Upstream-commit: e40e9d7f0decc799e3ccfe2c418632f8bb52031a
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/file.c     |  4 ++--
9d7d3f
 lib/ftp.c      |  5 +++--
9d7d3f
 lib/http.c     |  7 ++++---
9d7d3f
 lib/sendf.c    |  9 ++++-----
9d7d3f
 lib/smtp.c     |  2 +-
9d7d3f
 lib/ssh.c      |  5 +++--
9d7d3f
 lib/telnet.c   | 10 +++++-----
9d7d3f
 lib/transfer.c |  4 +---
9d7d3f
 8 files changed, 23 insertions(+), 23 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/file.c b/lib/file.c
9d7d3f
index 2f2e466..ddac28f 100644
9d7d3f
--- a/lib/file.c
9d7d3f
+++ b/lib/file.c
9d7d3f
@@ -558,8 +558,8 @@ static CURLcode file_do(struct connectdata *conn, bool *done)
9d7d3f
   while(res == CURLE_OK) {
9d7d3f
     /* Don't fill a whole buffer if we want less than all data */
9d7d3f
     size_t bytestoread =
9d7d3f
-      (expected_size < CURL_OFF_T_C(BUFSIZE) - CURL_OFF_T_C(1)) ?
9d7d3f
-      curlx_sotouz(expected_size) : BUFSIZE - 1;
9d7d3f
+      (expected_size < data->set.buffer_size) ?
9d7d3f
+      curlx_sotouz(expected_size) : (size_t)data->set.buffer_size;
9d7d3f
 
9d7d3f
     nread = read(fd, buf, bytestoread);
9d7d3f
 
9d7d3f
diff --git a/lib/ftp.c b/lib/ftp.c
9d7d3f
index c40d7e4..3a8b4b2 100644
9d7d3f
--- a/lib/ftp.c
9d7d3f
+++ b/lib/ftp.c
9d7d3f
@@ -1646,8 +1646,9 @@ static CURLcode ftp_state_ul_setup(struct connectdata *conn,
9d7d3f
         curl_off_t passed=0;
9d7d3f
         do {
9d7d3f
           size_t readthisamountnow =
9d7d3f
-            (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
9d7d3f
-            BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
9d7d3f
+            (data->state.resume_from - passed > data->set.buffer_size) ?
9d7d3f
+            (size_t)data->set.buffer_size :
9d7d3f
+            curlx_sotouz(data->state.resume_from - passed);
9d7d3f
 
9d7d3f
           size_t actuallyread =
9d7d3f
             conn->fread_func(data->state.buffer, 1, readthisamountnow,
9d7d3f
diff --git a/lib/http.c b/lib/http.c
9d7d3f
index 6ecdda2..665447b 100644
9d7d3f
--- a/lib/http.c
9d7d3f
+++ b/lib/http.c
9d7d3f
@@ -1061,7 +1061,7 @@ CURLcode Curl_add_buffer_send(Curl_send_buffer *in,
9d7d3f
        buffer is using this size.
9d7d3f
     */
9d7d3f
 
9d7d3f
-    sendsize= (size > CURL_MAX_WRITE_SIZE)?CURL_MAX_WRITE_SIZE:size;
9d7d3f
+    sendsize = CURLMIN(size, CURL_MAX_WRITE_SIZE);
9d7d3f
 
9d7d3f
     /* OpenSSL is very picky and we must send the SAME buffer pointer to the
9d7d3f
        library when we attempt to re-send this buffer. Sending the same data
9d7d3f
@@ -2036,8 +2036,9 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
9d7d3f
           curl_off_t passed=0;
9d7d3f
           do {
9d7d3f
             size_t readthisamountnow =
9d7d3f
-              (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
9d7d3f
-              BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
9d7d3f
+              (data->state.resume_from - passed > data->set.buffer_size) ?
9d7d3f
+              (size_t)data->set.buffer_size :
9d7d3f
+              curlx_sotouz(data->state.resume_from - passed);
9d7d3f
 
9d7d3f
             size_t actuallyread =
9d7d3f
               data->set.fread_func(data->state.buffer, 1, readthisamountnow,
9d7d3f
diff --git a/lib/sendf.c b/lib/sendf.c
9d7d3f
index 403025b..fb0e6e8 100644
9d7d3f
--- a/lib/sendf.c
9d7d3f
+++ b/lib/sendf.c
9d7d3f
@@ -528,7 +528,8 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
9d7d3f
   ssize_t nread = 0;
9d7d3f
   size_t bytesfromsocket = 0;
9d7d3f
   char *buffertofill = NULL;
9d7d3f
-  bool pipelining = (conn->data->multi &&
9d7d3f
+  struct SessionHandle *data = conn->data;
9d7d3f
+  bool pipelining = (data->multi &&
9d7d3f
                      Curl_multi_canPipeline(conn->data->multi)) ? TRUE : FALSE;
9d7d3f
 
9d7d3f
   /* Set 'num' to 0 or 1, depending on which socket that has been sent here.
9d7d3f
@@ -554,13 +555,11 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
9d7d3f
     }
9d7d3f
     /* If we come here, it means that there is no data to read from the buffer,
9d7d3f
      * so we read from the socket */
9d7d3f
-    bytesfromsocket = CURLMIN(sizerequested, BUFSIZE * sizeof (char));
9d7d3f
+    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
9d7d3f
     buffertofill = conn->master_buffer;
9d7d3f
   }
9d7d3f
   else {
9d7d3f
-    bytesfromsocket = CURLMIN((long)sizerequested,
9d7d3f
-                              conn->data->set.buffer_size ?
9d7d3f
-                              conn->data->set.buffer_size : BUFSIZE);
9d7d3f
+    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
9d7d3f
     buffertofill = buf;
9d7d3f
   }
9d7d3f
 
9d7d3f
diff --git a/lib/smtp.c b/lib/smtp.c
9d7d3f
index d2d4aeb..ccc2dc7 100644
9d7d3f
--- a/lib/smtp.c
9d7d3f
+++ b/lib/smtp.c
9d7d3f
@@ -1665,7 +1665,7 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, ssize_t nread)
9d7d3f
 
9d7d3f
   /* Do we need to allocate the scatch buffer? */
9d7d3f
   if(!data->state.scratch) {
9d7d3f
-    data->state.scratch = malloc(2 * BUFSIZE);
9d7d3f
+    data->state.scratch = malloc(2 * data->set.buffer_size);
9d7d3f
 
9d7d3f
     if(!data->state.scratch) {
9d7d3f
       failf (data, "Failed to alloc scratch buffer!");
9d7d3f
diff --git a/lib/ssh.c b/lib/ssh.c
9d7d3f
index 589d4a3..169ef1b 100644
9d7d3f
--- a/lib/ssh.c
9d7d3f
+++ b/lib/ssh.c
9d7d3f
@@ -1711,8 +1711,9 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
9d7d3f
             curl_off_t passed=0;
9d7d3f
             do {
9d7d3f
               size_t readthisamountnow =
9d7d3f
-                (data->state.resume_from - passed > CURL_OFF_T_C(BUFSIZE)) ?
9d7d3f
-                BUFSIZE : curlx_sotouz(data->state.resume_from - passed);
9d7d3f
+                (data->state.resume_from - passed > data->set.buffer_size) ?
9d7d3f
+                data->set.buffer_size :
9d7d3f
+                curlx_sotouz(data->state.resume_from - passed);
9d7d3f
 
9d7d3f
               size_t actuallyread =
9d7d3f
                 conn->fread_func(data->state.buffer, 1, readthisamountnow,
9d7d3f
diff --git a/lib/telnet.c b/lib/telnet.c
9d7d3f
index e43b423..4492514 100644
9d7d3f
--- a/lib/telnet.c
9d7d3f
+++ b/lib/telnet.c
9d7d3f
@@ -1429,7 +1429,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
       for(;;) {
9d7d3f
         if(obj_count == 1) {
9d7d3f
           /* read from user-supplied method */
9d7d3f
-          code = (int)conn->fread_func(buf, 1, BUFSIZE - 1, conn->fread_in);
9d7d3f
+          code = (int)conn->fread_func(buf, 1, buf_size, conn->fread_in);
9d7d3f
           if(code == CURL_READFUNC_ABORT) {
9d7d3f
             keepon = FALSE;
9d7d3f
             code = CURLE_READ_ERROR;
9d7d3f
@@ -1502,7 +1502,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
       }
9d7d3f
       if(events.lNetworkEvents & FD_READ) {
9d7d3f
         /* read data from network */
9d7d3f
-        code = Curl_read(conn, sockfd, buf, BUFSIZE - 1, &nread);
9d7d3f
+        code = Curl_read(conn, sockfd, buf, data->set.buffer_size, &nread);
9d7d3f
         /* read would've blocked. Loop again */
9d7d3f
         if(code == CURLE_AGAIN)
9d7d3f
           break;
9d7d3f
@@ -1591,7 +1591,7 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
     default:                    /* read! */
9d7d3f
       if(pfd[0].revents & POLLIN) {
9d7d3f
         /* read data from network */
9d7d3f
-        code = Curl_read(conn, sockfd, buf, BUFSIZE - 1, &nread);
9d7d3f
+        code = Curl_read(conn, sockfd, buf, data->set.buffer_size, &nread);
9d7d3f
         /* read would've blocked. Loop again */
9d7d3f
         if(code == CURLE_AGAIN)
9d7d3f
           break;
9d7d3f
@@ -1627,12 +1627,12 @@ static CURLcode telnet_do(struct connectdata *conn, bool *done)
9d7d3f
       nread = 0;
9d7d3f
       if(poll_cnt == 2) {
9d7d3f
         if(pfd[1].revents & POLLIN) { /* read from in file */
9d7d3f
-          nread = read(pfd[1].fd, buf, BUFSIZE - 1);
9d7d3f
+          nread = read(pfd[1].fd, buf, data->set.buffer_size);
9d7d3f
         }
9d7d3f
       }
9d7d3f
       else {
9d7d3f
         /* read from user-supplied method */
9d7d3f
-        nread = (int)conn->fread_func(buf, 1, BUFSIZE - 1, conn->fread_in);
9d7d3f
+        nread = (int)conn->fread_func(buf, 1, data->set.buffer_size, conn->fread_in);
9d7d3f
         if(nread == CURL_READFUNC_ABORT) {
9d7d3f
           keepon = FALSE;
9d7d3f
           break;
9d7d3f
diff --git a/lib/transfer.c b/lib/transfer.c
9d7d3f
index b707f8a..77f0937 100644
9d7d3f
--- a/lib/transfer.c
9d7d3f
+++ b/lib/transfer.c
9d7d3f
@@ -626,8 +626,6 @@ static CURLcode readwrite_data(struct SessionHandle *data,
9d7d3f
         excess = (size_t)(k->bytecount + nread - k->maxdownload);
9d7d3f
         if(excess > 0 && !k->ignorebody) {
9d7d3f
           if(conn->data->multi && Curl_multi_canPipeline(conn->data->multi)) {
9d7d3f
-            /* The 'excess' amount below can't be more than BUFSIZE which
9d7d3f
-               always will fit in a size_t */
9d7d3f
             infof(data,
9d7d3f
                   "Rewinding stream by : %zu"
9d7d3f
                   " bytes on url %s (size = %" FORMAT_OFF_T
9d7d3f
@@ -880,7 +878,7 @@ static CURLcode readwrite_upload(struct SessionHandle *data,
9d7d3f
 #endif
9d7d3f
          (data->set.crlf))) {
9d7d3f
         if(data->state.scratch == NULL)
9d7d3f
-          data->state.scratch = malloc(2*BUFSIZE);
9d7d3f
+          data->state.scratch = malloc(2 * data->set.buffer_size);
9d7d3f
         if(data->state.scratch == NULL) {
9d7d3f
           failf (data, "Failed to alloc scratch buffer!");
9d7d3f
           return CURLE_OUT_OF_MEMORY;
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From a8725233e1af133dd1d89c89b30ef4396c3f2e5b Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 15:19:19 +0200
9d7d3f
Subject: [PATCH 15/18] sendf: remove use of BUFSIZE from debug data
9d7d3f
 conversions
9d7d3f
9d7d3f
The buffer can have other sizes.
9d7d3f
9d7d3f
Upstream-commit: 7ee52c25f35816968b86d32eaef70ab743a457d4
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/sendf.c | 51 ++++++++++++++++++++++++++-------------------------
9d7d3f
 1 file changed, 26 insertions(+), 25 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/sendf.c b/lib/sendf.c
9d7d3f
index fb0e6e8..bad4683 100644
9d7d3f
--- a/lib/sendf.c
9d7d3f
+++ b/lib/sendf.c
9d7d3f
@@ -584,21 +584,19 @@ static int showit(struct SessionHandle *data, curl_infotype type,
9d7d3f
 {
9d7d3f
   static const char s_infotype[CURLINFO_END][3] = {
9d7d3f
     "* ", "< ", "> ", "{ ", "} ", "{ ", "} " };
9d7d3f
+  int rc = 0;
9d7d3f
 
9d7d3f
 #ifdef CURL_DOES_CONVERSIONS
9d7d3f
-  char buf[BUFSIZE+1];
9d7d3f
+  char *buf = NULL;
9d7d3f
   size_t conv_size = 0;
9d7d3f
 
9d7d3f
   switch(type) {
9d7d3f
   case CURLINFO_HEADER_OUT:
9d7d3f
-    /* assume output headers are ASCII */
9d7d3f
-    /* copy the data into my buffer so the original is unchanged */
9d7d3f
-    if(size > BUFSIZE) {
9d7d3f
-      size = BUFSIZE; /* truncate if necessary */
9d7d3f
-      buf[BUFSIZE] = '\0';
9d7d3f
-    }
9d7d3f
+    buf = Curl_memdup(ptr, size);
9d7d3f
+    if(!buf)
9d7d3f
+      return 1;
9d7d3f
     conv_size = size;
9d7d3f
-    memcpy(buf, ptr, size);
9d7d3f
+
9d7d3f
     /* Special processing is needed for this block if it
9d7d3f
      * contains both headers and data (separated by CRLFCRLF).
9d7d3f
      * We want to convert just the headers, leaving the data as-is.
9d7d3f
@@ -626,26 +624,29 @@ static int showit(struct SessionHandle *data, curl_infotype type,
9d7d3f
 #endif /* CURL_DOES_CONVERSIONS */
9d7d3f
 
9d7d3f
   if(data->set.fdebug)
9d7d3f
-    return (*data->set.fdebug)(data, type, ptr, size,
9d7d3f
-                               data->set.debugdata);
9d7d3f
-
9d7d3f
-  switch(type) {
9d7d3f
-  case CURLINFO_TEXT:
9d7d3f
-  case CURLINFO_HEADER_OUT:
9d7d3f
-  case CURLINFO_HEADER_IN:
9d7d3f
-    fwrite(s_infotype[type], 2, 1, data->set.err);
9d7d3f
-    fwrite(ptr, size, 1, data->set.err);
9d7d3f
+    rc = (*data->set.fdebug)(data, type, ptr, size, data->set.debugdata);
9d7d3f
+  else {
9d7d3f
+    switch(type) {
9d7d3f
+    case CURLINFO_TEXT:
9d7d3f
+    case CURLINFO_HEADER_OUT:
9d7d3f
+    case CURLINFO_HEADER_IN:
9d7d3f
+      fwrite(s_infotype[type], 2, 1, data->set.err);
9d7d3f
+      fwrite(ptr, size, 1, data->set.err);
9d7d3f
 #ifdef CURL_DOES_CONVERSIONS
9d7d3f
-    if(size != conv_size) {
9d7d3f
-      /* we had untranslated data so we need an explicit newline */
9d7d3f
-      fwrite("\n", 1, 1, data->set.err);
9d7d3f
-    }
9d7d3f
+      if(size != conv_size) {
9d7d3f
+        /* we had untranslated data so we need an explicit newline */
9d7d3f
+        fwrite("\n", 1, 1, data->set.err);
9d7d3f
+      }
9d7d3f
 #endif
9d7d3f
-    break;
9d7d3f
-  default: /* nada */
9d7d3f
-    break;
9d7d3f
+      break;
9d7d3f
+    default: /* nada */
9d7d3f
+      break;
9d7d3f
+    }
9d7d3f
   }
9d7d3f
-  return 0;
9d7d3f
+#ifdef CURL_DOES_CONVERSIONS
9d7d3f
+  free(buf);
9d7d3f
+#endif
9d7d3f
+  return rc;
9d7d3f
 }
9d7d3f
 
9d7d3f
 int Curl_debug(struct SessionHandle *data, curl_infotype type,
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From a600c050d0fcaa5bff272f47b9be0a653a4071c6 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 25 Apr 2017 15:31:14 +0200
9d7d3f
Subject: [PATCH 16/18] BUFSIZE: rename to READBUFFER_*, make separate
9d7d3f
 MASTERBUF_SIZE
9d7d3f
9d7d3f
Upstream-commit: e3ed5cb380e615e91d99b09da9f0ead0eaf3e0b5
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/multi.c   |  4 ++--
9d7d3f
 lib/sendf.c   |  2 +-
9d7d3f
 lib/url.c     | 25 ++++++++++++++-----------
9d7d3f
 lib/urldata.h | 10 +++-------
9d7d3f
 4 files changed, 20 insertions(+), 21 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/multi.c b/lib/multi.c
9d7d3f
index 3029fa6..39a0938 100644
9d7d3f
--- a/lib/multi.c
9d7d3f
+++ b/lib/multi.c
9d7d3f
@@ -1452,7 +1452,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
9d7d3f
 
9d7d3f
         /* calculate upload rate-limitation timeout. */
9d7d3f
         buffersize = (int)(data->set.buffer_size ?
9d7d3f
-                           data->set.buffer_size : BUFSIZE);
9d7d3f
+                           data->set.buffer_size : MASTERBUF_SIZE);
9d7d3f
         timeout_ms = Curl_sleep_time(data->set.max_send_speed,
9d7d3f
                                      data->progress.ulspeed, buffersize);
9d7d3f
         Curl_expire(data, timeout_ms);
9d7d3f
@@ -1468,7 +1468,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
9d7d3f
 
9d7d3f
          /* Calculate download rate-limitation timeout. */
9d7d3f
         buffersize = (int)(data->set.buffer_size ?
9d7d3f
-                           data->set.buffer_size : BUFSIZE);
9d7d3f
+                           data->set.buffer_size : MASTERBUF_SIZE);
9d7d3f
         timeout_ms = Curl_sleep_time(data->set.max_recv_speed,
9d7d3f
                                      data->progress.dlspeed, buffersize);
9d7d3f
         Curl_expire(data, timeout_ms);
9d7d3f
diff --git a/lib/sendf.c b/lib/sendf.c
9d7d3f
index bad4683..95d1a51 100644
9d7d3f
--- a/lib/sendf.c
9d7d3f
+++ b/lib/sendf.c
9d7d3f
@@ -555,7 +555,7 @@ CURLcode Curl_read(struct connectdata *conn, /* connection data */
9d7d3f
     }
9d7d3f
     /* If we come here, it means that there is no data to read from the buffer,
9d7d3f
      * so we read from the socket */
9d7d3f
-    bytesfromsocket = CURLMIN(sizerequested, (size_t)data->set.buffer_size);
9d7d3f
+    bytesfromsocket = CURLMIN(sizerequested, MASTERBUF_SIZE);
9d7d3f
     buffertofill = conn->master_buffer;
9d7d3f
   }
9d7d3f
   else {
9d7d3f
diff --git a/lib/url.c b/lib/url.c
9d7d3f
index b86243b..cb3f3c3 100644
9d7d3f
--- a/lib/url.c
9d7d3f
+++ b/lib/url.c
9d7d3f
@@ -242,6 +242,10 @@ static const struct Curl_handler * const protocols[] = {
9d7d3f
   (struct Curl_handler *) NULL
9d7d3f
 };
9d7d3f
 
9d7d3f
+#define READBUFFER_SIZE CURL_MAX_WRITE_SIZE
9d7d3f
+#define READBUFFER_MAX  CURL_MAX_READ_SIZE
9d7d3f
+#define READBUFFER_MIN  1024
9d7d3f
+
9d7d3f
 /*
9d7d3f
  * Dummy handler for undefined protocol schemes.
9d7d3f
  */
9d7d3f
@@ -577,7 +581,7 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
9d7d3f
   set->tcp_keepintvl = 60;
9d7d3f
   set->tcp_keepidle = 60;
9d7d3f
 
9d7d3f
-  set->buffer_size = BUFSIZE;
9d7d3f
+  set->buffer_size = READBUFFER_SIZE;
9d7d3f
 
9d7d3f
   return res;
9d7d3f
 }
9d7d3f
@@ -615,7 +619,7 @@ CURLcode Curl_open(struct SessionHandle **curl)
9d7d3f
 
9d7d3f
   /* We do some initial setup here, all those fields that can't be just 0 */
9d7d3f
 
9d7d3f
-  data->state.buffer = malloc(BUFSIZE + 1);
9d7d3f
+  data->state.buffer = malloc(READBUFFER_SIZE + 1);
9d7d3f
   if(!data->state.buffer) {
9d7d3f
     DEBUGF(fprintf(stderr, "Error: malloc of buffer failed\n"));
9d7d3f
     res = CURLE_OUT_OF_MEMORY;
9d7d3f
@@ -1969,17 +1973,16 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
9d7d3f
      */
9d7d3f
     arg = va_arg(param, long);
9d7d3f
 
9d7d3f
-    if(arg > MAX_BUFSIZE)
9d7d3f
-      arg = MAX_BUFSIZE; /* huge internal default */
9d7d3f
+    if(arg > READBUFFER_MAX)
9d7d3f
+      arg = READBUFFER_MAX; /* huge internal default */
9d7d3f
     else if(arg < 1)
9d7d3f
-      arg = BUFSIZE;
9d7d3f
-    else if(arg < MIN_BUFSIZE)
9d7d3f
-      arg = BUFSIZE;
9d7d3f
+      arg = READBUFFER_SIZE;
9d7d3f
+    else if(arg < READBUFFER_MIN)
9d7d3f
+      arg = READBUFFER_MIN;
9d7d3f
 
9d7d3f
     /* Resize only if larger than default buffer size. */
9d7d3f
-    if(arg > BUFSIZE) {
9d7d3f
-      data->state.buffer = realloc(data->state.buffer,
9d7d3f
-                                   data->set.buffer_size + 1);
9d7d3f
+    if(arg > READBUFFER_SIZE) {
9d7d3f
+      data->state.buffer = realloc(data->state.buffer, arg + 1);
9d7d3f
       if(!data->state.buffer) {
9d7d3f
         DEBUGF(fprintf(stderr, "Error: realloc of buffer failed\n"));
9d7d3f
         result = CURLE_OUT_OF_MEMORY;
9d7d3f
@@ -3537,7 +3540,7 @@ static struct connectdata *allocate_conn(struct SessionHandle *data)
9d7d3f
   if(data->multi && Curl_multi_canPipeline(data->multi) &&
9d7d3f
       !conn->master_buffer) {
9d7d3f
     /* Allocate master_buffer to be used for pipelining */
9d7d3f
-    conn->master_buffer = calloc(BUFSIZE, sizeof (char));
9d7d3f
+    conn->master_buffer = calloc(MASTERBUF_SIZE, sizeof (char));
9d7d3f
     if(!conn->master_buffer)
9d7d3f
       goto error;
9d7d3f
   }
9d7d3f
diff --git a/lib/urldata.h b/lib/urldata.h
9d7d3f
index afe37c0..d10c784 100644
9d7d3f
--- a/lib/urldata.h
9d7d3f
+++ b/lib/urldata.h
9d7d3f
@@ -193,17 +193,13 @@
9d7d3f
 #include <libssh2_sftp.h>
9d7d3f
 #endif /* HAVE_LIBSSH2_H */
9d7d3f
 
9d7d3f
-/* Download buffer size, keep it fairly big for speed reasons */
9d7d3f
-#undef BUFSIZE
9d7d3f
-#define BUFSIZE CURL_MAX_WRITE_SIZE
9d7d3f
-#undef MAX_BUFSIZE
9d7d3f
-#define MAX_BUFSIZE CURL_MAX_READ_SIZE
9d7d3f
-#define MIN_BUFSIZE 1024
9d7d3f
-
9d7d3f
 /* The upload buffer size, should not be smaller than CURL_MAX_WRITE_SIZE, as
9d7d3f
    it needs to hold a full buffer as could be sent in a write callback */
9d7d3f
 #define UPLOAD_BUFSIZE CURL_MAX_WRITE_SIZE
9d7d3f
 
9d7d3f
+/* The "master buffer" is for HTTP pipelining */
9d7d3f
+#define MASTERBUF_SIZE 16384
9d7d3f
+
9d7d3f
 /* Initial size of the buffer to store headers in, it'll be enlarged in case
9d7d3f
    of need. */
9d7d3f
 #define HEADERSIZE 256
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 40c7b1ccca9fcf3b0ce261f098faebd58ed439ac Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Tue, 2 May 2017 08:32:04 +0200
9d7d3f
Subject: [PATCH 17/18] ssh: fix compiler warning from e40e9d7f0de
9d7d3f
9d7d3f
Upstream-commit: eab6732fde094073480af5039b6fb495cbc3fb8a
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/ssh.c | 2 +-
9d7d3f
 1 file changed, 1 insertion(+), 1 deletion(-)
9d7d3f
9d7d3f
diff --git a/lib/ssh.c b/lib/ssh.c
9d7d3f
index 169ef1b..b1f136e 100644
9d7d3f
--- a/lib/ssh.c
9d7d3f
+++ b/lib/ssh.c
9d7d3f
@@ -1712,7 +1712,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
9d7d3f
             do {
9d7d3f
               size_t readthisamountnow =
9d7d3f
                 (data->state.resume_from - passed > data->set.buffer_size) ?
9d7d3f
-                data->set.buffer_size :
9d7d3f
+                (size_t)data->set.buffer_size :
9d7d3f
                 curlx_sotouz(data->state.resume_from - passed);
9d7d3f
 
9d7d3f
               size_t actuallyread =
9d7d3f
-- 
9d7d3f
2.17.2
9d7d3f
9d7d3f
9d7d3f
From 9f3810bae5fad685e848a39750863557e17a0163 Mon Sep 17 00:00:00 2001
9d7d3f
From: Daniel Stenberg <daniel@haxx.se>
9d7d3f
Date: Thu, 8 Mar 2018 10:33:16 +0100
9d7d3f
Subject: [PATCH 18/18] readwrite: make sure excess reads don't go beyond
9d7d3f
 buffer end
9d7d3f
9d7d3f
CVE-2018-1000122
9d7d3f
Bug: https://curl.haxx.se/docs/adv_2018-b047.html
9d7d3f
9d7d3f
Detected by OSS-fuzz
9d7d3f
9d7d3f
Upstream-commit: d52dc4760f6d9ca1937eefa2093058a952465128
9d7d3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9d7d3f
---
9d7d3f
 lib/transfer.c | 9 +++++++--
9d7d3f
 1 file changed, 7 insertions(+), 2 deletions(-)
9d7d3f
9d7d3f
diff --git a/lib/transfer.c b/lib/transfer.c
9d7d3f
index dff6838..7ad6e3c 100644
9d7d3f
--- a/lib/transfer.c
9d7d3f
+++ b/lib/transfer.c
9d7d3f
@@ -735,10 +735,15 @@ static CURLcode readwrite_data(struct SessionHandle *data,
9d7d3f
 
9d7d3f
     } /* if(! header and data to read ) */
9d7d3f
 
9d7d3f
-    if(conn->handler->readwrite &&
9d7d3f
-       (excess > 0 && !conn->bits.stream_was_rewound)) {
9d7d3f
+    if(conn->handler->readwrite && excess && !conn->bits.stream_was_rewound) {
9d7d3f
       /* Parse the excess data */
9d7d3f
       k->str += nread;
9d7d3f
+
9d7d3f
+      if(&k->str[excess] > &k->buf[data->set.buffer_size]) {
9d7d3f
+        /* the excess amount was too excessive(!), make sure
9d7d3f
+           it doesn't read out of buffer */
9d7d3f
+        excess = &k->buf[data->set.buffer_size] - k->str;
9d7d3f
+      }
9d7d3f
       nread = (ssize_t)excess;
9d7d3f
 
9d7d3f
       result = conn->handler->readwrite(data, conn, &nread, &readmore);
9d7d3f
-- 
9d7d3f
2.14.3
9d7d3f