SecTrustEvaluateAsync() is defined in the macOS 10.7 SDK, but it
requires Grand Central Dispatch to be supported by the compiler, and
some third-party macOS compilers do not support Grand Central Dispatch.
SecTrustCopyPublicKey() is not present in macOS 10.6, so this shouldn't
adversely affect anything.
Fixes#8846
Reported-by: Egor Pugin
Closes#8854
Accessing local variables outside of the scope is forbidden and
depending on the compiler can result in the value being
overwritten. Fixed by moving the pwbuf to be in scope.
Closes#8850
Explicitly initialize gss_buffer_desc strings such that a call to
freeing resources will succeed even if no data has been allocated
to it.
Reported-by: Jay Satiro <raysatiro@yahoo.com>
In case gss_display_status() returns an error, avoid trying to add
it to the buffer as the message may well be a NULL pointer.
Originally this fix comes from a discussion in issue #8816.
Closes: #8832
Reviewed-by: Jay Satiro <raysatiro@yahoo.com>
We need to check if the strchr() call returns NULL (due to missing
char) before we use the returned value in arithmetic. There is no
live bug here, but fixing it before it can become for hygiene.
Closes: #8814
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
We have lots of unchecked msnprintf calls, and this particular msnprintf
call isn't more interesting than the others, but this one yields a Coverity
warning so let's implicitly silence it. Going over the other invocations
is probably a worthwhile project, but for now let's keep the static
analyzers happy.
Closes: #8831
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
The check for a dot in the domain must not consider a single trailing
dot to be fine, as then TLD + trailing dot is fine and curl will accept
setting cookies for it.
CVE-2022-27779
Reported-by: Axel Chong
Bug: https://curl.se/docs/CVE-2022-27779.htmlCloses#8820
This function has been unused since the initial commit of the GSKit
backend in 0eba02fd4. The motivation for the code was getting the
whole certificate chain: the only place where the latter is available
is as a callback parameter. Unfortunately it is not possible to pass
a user pointer to this callback, which precludes the possibility to
associate the cert chain with a data/conn structure.
For further information, search for pgsk_cert_validation_callback on:
https://www.ibm.com/docs/api/v1/content/ssw_ibm_i_71/apis/gsk_attribute_set_callback.htm
As the upstream library never added a parameter like that to the API,
we give up the wait and remove the dead code.
Closes: #8782
Reviewed-by: Patrick Monnerat <patrick@monnerat.net>
Print the boolean value as its string representation instead of with
%hhu which isn't a format we typically use.
Closes: #8763
Reviewed-by: Nick Banks <nibanks@microsoft.com>
Hyper now has the ability to preserve header order. This commit adds a
few lines setting the connection options for this feature.
Related to issue #8617Closes#8707
To simplify, and also since the returned name is not the full actual
name used for the check. The port number and zone id is also involved,
so just showing the name is misleading.
Closes#8750
Making it just skip the check unless exactly 32 is too brittle. Even if
the docs says it needs to be exactly 32, it is be safer to make the
comparison fail here instead.
Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1549461Closes#8745
Also move static function safecmp() as non-static Curl_safecmp() since
its purpose is needed at several places.
Bug: https://curl.se/docs/CVE-2022-22576.html
CVE-2022-22576
Closes#8746
