winbuild/MakefileBuild.vc: Fix line endings

The file had mixed line endings.

Signed-off-by: Bernhard Walle <bernhard.walle@posteo.eu>

ldap: Stop using wide char version of ldapp_err2string

Despite ldapp_err2string being documented by MS as returning a
PCHAR (char *), when UNICODE it is mapped to ldap_err2stringW and

ldap: Stop using wide char version of ldapp_err2string

Despite ldapp_err2string being documented by MS as returning a
PCHAR (char *), when UNICODE it is mapped to ldap_err2stringW and
returns PWCHAR (wchar_t *).

We have lots of code that expects ldap_err2string to return char *,
most of it failf used like this:

failf(data, "LDAP local: Some error: %s", ldap_err2string(rc));

Closes https://github.com/curl/curl/pull/4272

show more ...

RELEASE-NOTES: curl 7.66.0

THANKS: from the 7.66.0 release

curl: make sure the parallel transfers do them all

The logic could erroneously break the loop too early before all
transfers had been transferred.

Reported-by: Tom van der Woerd

curl: make sure the parallel transfers do them all

The logic could erroneously break the loop too early before all
transfers had been transferred.

Reported-by: Tom van der Woerdt
Fixes #4316
Closes #4317

show more ...

urlapi: one colon is enough for the strspn() input (typo)

urlapi: verify the IPv6 numerical address

It needs to parse correctly. Otherwise it could be tricked into letting
through a-f using host names that libcurl would then resolve. Like
'

urlapi: verify the IPv6 numerical address

It needs to parse correctly. Otherwise it could be tricked into letting
through a-f using host names that libcurl would then resolve. Like
'[ab.be]'.

Reported-by: Thomas Vegas
Closes #4315

show more ...

openssl: use SSL_CTX_set_<min|max>_proto_version() when available

OpenSSL 1.1.0 adds SSL_CTX_set_<min|max>_proto_version() that we now use
when available. Existing code is preserved for

openssl: use SSL_CTX_set_<min|max>_proto_version() when available

OpenSSL 1.1.0 adds SSL_CTX_set_<min|max>_proto_version() that we now use
when available. Existing code is preserved for older versions of
OpenSSL.

Closes #4304

show more ...

openssl: indent, re-organize and add comments

sspi: fix memory leaks

Closes #4299

travis: disable ngtcp2 builds (again)

Curl_fillreadbuffer: avoid double-free trailer buf on error

Reviewed-by: Jay Satiro
Reported-by: Thomas Vegas

Closes #4307

tool_setopt: handle a libcurl build without netrc support

Reported-by: codesniffer13 on github
Fixes #4302
Closes #4305

security:read_data fix bad realloc()

... that could end up a double-free

CVE-2019-5481
Bug: https://curl.haxx.se/docs/CVE-2019-5481.html

tftp: Alloc maximum blksize, and use default unless OACK is received

Fixes potential buffer overflow from 'recvfrom()', should the server
return an OACK without blksize.

Bug: ht

tftp: Alloc maximum blksize, and use default unless OACK is received

Fixes potential buffer overflow from 'recvfrom()', should the server
return an OACK without blksize.

Bug: https://curl.haxx.se/docs/CVE-2019-5482.html
CVE-2019-5482

show more ...

tftp: return error when packet is too small for options

KNOWN_BUGS/TODO: cleanup and remove outdated issues

RELEASE-NOTES: synced

netrc: free 'home' on error

Follow-up to f9c7ba9096ec2

Coverity CID 1453474

Closes #4291

urldata: avoid 'generic', use dedicated pointers

For the 'proto' union within the connectdata struct.

Closes #4290

cleanup: move functions out of url.c and make them static

Closes #4289

smtp: check for and bail out on too short EHLO response

Otherwise, a three byte response would make the smtp_state_ehlo_resp()
function misbehave.

Credit to OSS-Fuzz
Bug: ht

smtp: check for and bail out on too short EHLO response

Otherwise, a three byte response would make the smtp_state_ehlo_resp()
function misbehave.

Credit to OSS-Fuzz
Bug: https://crbug.com/oss-fuzz/16918

Assisted-by: Max Dymond

Closes #4287

show more ...

smb: init *msg to NULL in smb_send_and_recv()

... it might otherwise return OK from this function leaving that pointer
uninitialized.

Bug: https://crbug.com/oss-fuzz/16907

smb: init *msg to NULL in smb_send_and_recv()

... it might otherwise return OK from this function leaving that pointer
uninitialized.

Bug: https://crbug.com/oss-fuzz/16907

Closes #4286

show more ...

ROADMAP: updated after recent user poll

In rough prio order

THANKS: remove duplicate