Compare commits

...

3 Commits

Author SHA1 Message Date
Viktor Szakats
b4834a7d6d
examples: prefer return over exit() (cont.)
Some of these calls were not in callbacks. These examples may leak
handles.

Also fix some whitespace.

Follow-up to 08c7c937dc #16507
Closes #16524
2025-03-01 02:09:02 +01:00
Viktor Szakats
5693342ec2
winbuild: reduce command-line length by dropping whitespace
Keep the `@for %%i in [...]` lines within limits by stripping whitespace
from the input `.c` source lists read from `Makefile.inc`. To avoid this
error after adding a new `.c` source:
```
configuration name: libcurl-vc14-x64-release-dll-ssl-dll-ipv6-sspi
NMAKE : fatal error U1095: expanded command line 'for %i in (altsvc.obj            amigaos.obj
           asyn-ares.obj         asyn-thread.obj       base64.obj            bufq.obj
              bufref.obj            cf-h1-proxy.obj       cf-h2-proxy.obj       cf-haproxy.obj [...]
  vssh/wolfssh.obj) do @echo ..\builds\libcurl-vc14-x64-release-dll-ssl-dll-ipv6-sspi-obj-lib/%i \
                   ' too long
Stop.
Command exited with code 2
```
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/51605338/job/dqg6qtebtscb279g#L44

Reported-by: Stefan Eissing
Bug: https://github.com/curl/curl/pull/16508#issuecomment-2690443409
Fixes #16521
Closes #16528
2025-03-01 02:04:42 +01:00
Dan Fandrich
c693cc02b0 docs: vulnerabilities in debug code are not eligible for a bounty
This is code that is off by default and is therefore treated as a
regular bug.

Ref: #16526
Closes #16527
2025-02-28 14:21:46 -08:00
6 changed files with 38 additions and 31 deletions

View File

@ -247,11 +247,11 @@ local system or network, the bar is raised. If a local user wrongfully has
elevated rights on your system enough to attack curl, they can probably elevated rights on your system enough to attack curl, they can probably
already do much worse harm and the problem is not really in curl. already do much worse harm and the problem is not really in curl.
## Experiments ## Debug & Experiments
Vulnerabilities in features which are off by default (in the build) and Vulnerabilities in features which are off by default (in the build) and
documented as experimental, are not eligible for a reward and we do not documented as experimental, or exist only in debug mode, are not eligible for a
consider them security problems. reward and we do not consider them security problems.
## URL inconsistencies ## URL inconsistencies

View File

@ -422,18 +422,18 @@ static int init_fifo(GlobalInfo *g)
if((st.st_mode & S_IFMT) == S_IFREG) { if((st.st_mode & S_IFMT) == S_IFREG) {
errno = EEXIST; errno = EEXIST;
perror("lstat"); perror("lstat");
exit(1); return 1;
} }
} }
unlink(fifo); unlink(fifo);
if(mkfifo(fifo, 0600) == -1) { if(mkfifo(fifo, 0600) == -1) {
perror("mkfifo"); perror("mkfifo");
exit(1); return 1;
} }
sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0); sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
if(sockfd == -1) { if(sockfd == -1) {
perror("open"); perror("open");
exit(1); return 1;
} }
g->fifofd = sockfd; g->fifofd = sockfd;
@ -478,13 +478,13 @@ int main(int argc, char **argv)
g.epfd = epoll_create1(EPOLL_CLOEXEC); g.epfd = epoll_create1(EPOLL_CLOEXEC);
if(g.epfd == -1) { if(g.epfd == -1) {
perror("epoll_create1 failed"); perror("epoll_create1 failed");
exit(1); return 1;
} }
g.tfd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK | TFD_CLOEXEC); g.tfd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK | TFD_CLOEXEC);
if(g.tfd == -1) { if(g.tfd == -1) {
perror("timerfd_create failed"); perror("timerfd_create failed");
exit(1); return 1;
} }
memset(&its, 0, sizeof(struct itimerspec)); memset(&its, 0, sizeof(struct itimerspec));
@ -496,7 +496,8 @@ int main(int argc, char **argv)
ev.data.fd = g.tfd; ev.data.fd = g.tfd;
epoll_ctl(g.epfd, EPOLL_CTL_ADD, g.tfd, &ev); epoll_ctl(g.epfd, EPOLL_CTL_ADD, g.tfd, &ev);
init_fifo(&g); if(init_fifo(&g))
return 1;
g.multi = curl_multi_init(); g.multi = curl_multi_init();
/* setup the generic multi interface options we want */ /* setup the generic multi interface options we want */
@ -521,7 +522,7 @@ int main(int argc, char **argv)
} }
else { else {
perror("epoll_wait"); perror("epoll_wait");
exit(1); return 1;
} }
} }

View File

@ -406,18 +406,18 @@ static int init_fifo(GlobalInfo *g)
if((st.st_mode & S_IFMT) == S_IFREG) { if((st.st_mode & S_IFMT) == S_IFREG) {
errno = EEXIST; errno = EEXIST;
perror("lstat"); perror("lstat");
exit(1); return 1;
} }
} }
unlink(fifo); unlink(fifo);
if(mkfifo(fifo, 0600) == -1) { if(mkfifo(fifo, 0600) == -1) {
perror("mkfifo"); perror("mkfifo");
exit(1); return 1;
} }
sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0); sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
if(sockfd == -1) { if(sockfd == -1) {
perror("open"); perror("open");
exit(1); return 1;
} }
g->input = fdopen(sockfd, "r"); g->input = fdopen(sockfd, "r");
@ -436,7 +436,8 @@ int main(int argc, char **argv)
memset(&g, 0, sizeof(GlobalInfo)); memset(&g, 0, sizeof(GlobalInfo));
g.loop = ev_default_loop(0); g.loop = ev_default_loop(0);
init_fifo(&g); if(init_fifo(&g))
return 1;
g.multi = curl_multi_init(); g.multi = curl_multi_init();
ev_timer_init(&g.timer_event, timer_cb, 0., 0.); ev_timer_init(&g.timer_event, timer_cb, 0., 0.);

View File

@ -392,21 +392,21 @@ int init_fifo(void)
if((st.st_mode & S_IFMT) == S_IFREG) { if((st.st_mode & S_IFMT) == S_IFREG) {
errno = EEXIST; errno = EEXIST;
perror("lstat"); perror("lstat");
exit(1); return CURL_SOCKET_BAD;
} }
} }
unlink(fifo); unlink(fifo);
if(mkfifo(fifo, 0600) == -1) { if(mkfifo(fifo, 0600) == -1) {
perror("mkfifo"); perror("mkfifo");
exit(1); return CURL_SOCKET_BAD;
} }
socket = open(fifo, O_RDWR | O_NONBLOCK, 0); socket = open(fifo, O_RDWR | O_NONBLOCK, 0);
if(socket == -1) { if(socket == CURL_SOCKET_BAD) {
perror("open"); perror("open");
exit(1); return socket;
} }
MSG_OUT("Now, pipe some URL's into > %s\n", fifo); MSG_OUT("Now, pipe some URL's into > %s\n", fifo);
@ -421,6 +421,8 @@ int main(void)
GIOChannel* ch; GIOChannel* ch;
fd = init_fifo(); fd = init_fifo();
if(fd == CURL_SOCKET_BAD)
return 1;
ch = g_io_channel_unix_new(fd); ch = g_io_channel_unix_new(fd);
g_io_add_watch(ch, G_IO_IN, fifo_cb, g); g_io_add_watch(ch, G_IO_IN, fifo_cb, g);
gmain = g_main_loop_new(NULL, FALSE); gmain = g_main_loop_new(NULL, FALSE);

View File

@ -403,18 +403,18 @@ static int init_fifo(GlobalInfo *g)
if((st.st_mode & S_IFMT) == S_IFREG) { if((st.st_mode & S_IFMT) == S_IFREG) {
errno = EEXIST; errno = EEXIST;
perror("lstat"); perror("lstat");
exit(1); return 1;
} }
} }
unlink(fifo); unlink(fifo);
if(mkfifo (fifo, 0600) == -1) { if(mkfifo (fifo, 0600) == -1) {
perror("mkfifo"); perror("mkfifo");
exit(1); return 1;
} }
sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0); sockfd = open(fifo, O_RDWR | O_NONBLOCK, 0);
if(sockfd == -1) { if(sockfd == -1) {
perror("open"); perror("open");
exit(1); return 1;
} }
g->input = fdopen(sockfd, "r"); g->input = fdopen(sockfd, "r");
@ -440,7 +440,8 @@ int main(int argc, char **argv)
memset(&g, 0, sizeof(GlobalInfo)); memset(&g, 0, sizeof(GlobalInfo));
g.evbase = event_base_new(); g.evbase = event_base_new();
init_fifo(&g); if(init_fifo(&g))
return 1;
g.multi = curl_multi_init(); g.multi = curl_multi_init();
evtimer_assign(&g.timer_event, g.evbase, timer_cb, &g); evtimer_assign(&g.timer_event, g.evbase, timer_cb, &g);

View File

@ -58,9 +58,11 @@ CFGSET=true
!ENDIF !ENDIF
!INCLUDE "../lib/Makefile.inc" !INCLUDE "../lib/Makefile.inc"
CSOURCES=$(CSOURCES: = )
LIBCURL_OBJS=$(CSOURCES:.c=.obj) LIBCURL_OBJS=$(CSOURCES:.c=.obj)
!INCLUDE "../src/Makefile.inc" !INCLUDE "../src/Makefile.inc"
CURL_CFILES=$(CURL_CFILES: = )
CURL_OBJS=$(CURL_CFILES:.c=.obj) CURL_OBJS=$(CURL_CFILES:.c=.obj)