generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

- When downloading compressed content over HTTP and the app as asked libcurl

Browse Source 
to automatically uncompress it with the CURLOPT_ENCODING option, libcurl
  could wrongly provide the callback with more data than what the maximum
  documented amount. An application could thus get tricked into badness if the
  maximum limit was trusted to be enforced by libcurl itself (as it is
  documented).

  This is further detailed and explained in the libcurl security advisory
  20100209 at

    http://curl.haxx.se/docs/adv_20100209.html
This commit is contained in:
Daniel Stenberg
2010-02-09 09:35:48 +00:00
parent d33da42334
commit 06ae8ca5a6
3 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
CHANGES
View File

@@ -6,6 +6,19 @@
Changelog
Daniel Stenberg (9 Feb 2010)
- When downloading compressed content over HTTP and the app as asked libcurl
to automatically uncompress it with the CURLOPT_ENCODING option, libcurl
could wrongly provide the callback with more data than what the maximum
documented amount. An application could thus get tricked into badness if the
maximum limit was trusted to be enforced by libcurl itself (as it is
documented).
This is further detailed and explained in the libcurl security advisory
20100209 at
http://curl.haxx.se/docs/adv_20100209.html
Daniel Fandrich (3 Feb 2010)
- Changed the Watcom makefiles to make them easier to keep in sync with
Makefile.inc since that can't be included directly.