Christian Grothoff
f10d7c71ab
fix overflow check
2026-07-08 12:09:38 +02:00
Christian Grothoff
b4165ecc09
fix overflow check
2026-07-08 12:07:51 +02:00
Christian Grothoff
df2309b0ed
fix theoretical div by 0
2026-07-08 12:06:19 +02:00
Christian Grothoff
9a1527ff72
fix CLOSE flag test
2026-07-08 12:03:13 +02:00
Christian Grothoff
5abfcc927a
add assertion to prevent underflow
2026-07-08 11:56:37 +02:00
Christian Grothoff
97b4296cc0
fix possible underflow on timeout computation
2026-07-08 11:54:11 +02:00
Christian Grothoff
e5f88887df
size check before allocating
2026-07-08 11:51:55 +02:00
Christian Grothoff
b2752fc496
fix allocation type
2026-07-08 11:49:31 +02:00
Christian Grothoff
de88b6724a
check bound before writing in test
2026-07-08 11:45:28 +02:00
Christian Grothoff
04547cd9c8
use proper guards to avoid (theoretical) off-by-one in pct decoding
2026-07-08 11:42:33 +02:00
Christian Grothoff
2a6420de23
use caseless cmp as per function name and spec
2026-07-08 11:40:26 +02:00
Christian Grothoff
06cd63df36
limit to INT_MAX, not UINT_MAX
2026-07-08 11:37:55 +02:00
Christian Grothoff
83eecbca49
add NULL check
2026-07-08 11:37:01 +02:00
Christian Grothoff
b7dd720a32
fix oversized array
2026-07-08 11:36:24 +02:00
Christian Grothoff
930e236ea3
fix OOM handling
2026-07-08 11:34:32 +02:00
Christian Grothoff
d3c3ea0b8a
fix OOM handling
2026-07-08 11:33:51 +02:00
Christian Grothoff
679fb11892
fix swapped conditions in poll() for upgraded socket
2026-07-08 11:32:58 +02:00
Christian Grothoff
3704914ccd
remove duplicated mutex destroy
2026-07-08 11:31:13 +02:00
Christian Grothoff
d2375954a1
releasing v1.0.5
2026-04-16 10:38:04 +02:00
Evgeny Grin (Karlson2k)
9933d65464
Tighten request header processing to match RFC
...
New implementation:
+ rejects repeated Host: headers
+ handles repeated Content-Length: more carefully
+ handles malformed Content-Length: better
+ handles repeated Transfer-Encoding: headers
+ parses all Cookie: headers instead of just first header
+ handles properly Transfer-Encoding: in HTTP/1.0 requests
2026-04-15 21:35:12 +02:00
Evgeny Grin (Karlson2k)
a7f6ad8f4f
test_mhd_version.c: corrected output
2026-04-14 19:55:27 +02:00
Evgeny Grin (Karlson2k)
a1f9374226
Updated M4 macros
2026-04-14 19:55:27 +02:00
Evgeny Grin (Karlson2k)
a083613d84
Fixed checking headers longer than actually needed
...
The prevents matching header like "Content-Length-Anything:" as
"Content-Length:" header.
2026-04-14 19:39:50 +02:00
Evgeny Grin (Karlson2k)
0d33a88f35
Bump MHD_VERSION to indicate development version
2026-04-14 19:33:13 +02:00
Evgeny Grin (Karlson2k)
4f049186bf
Fixed missing MHD_VERSION bump
2026-04-14 19:32:32 +02:00
Christian Grothoff
d30316fda9
bump version
2026-04-13 11:43:19 +02:00
Christian Grothoff
c345fa6474
enable content-length duplicate check at default discipline level
2026-04-10 11:54:53 +02:00
Christian Grothoff
f07e09b7dc
add code to reject requests with multiple Content-Length HTTP headers being sent by the client; thanks to SYSS.de for reporting
2026-04-07 17:54:42 +02:00
Christian Grothoff
5f207ceede
fix bug in list traversal that could cause ready connections to be skipped if other connections were suspended
2026-04-02 00:18:18 +02:00
Evgeny Grin (Karlson2k)
1e43edd529
Request chunk processing: reject bare CR in chunk extension
2026-03-01 00:23:07 +01:00
Evgeny Grin (Karlson2k)
ff26d02aa0
Request chunk processing: simplified check for overflow
2026-03-01 00:19:22 +01:00
Evgeny Grin (Karlson2k)
ec6e6d2888
Added MHD_OPTION_ALLOW_BIN_ZERO_IN_URI_PATH and MHD_get_connection_URI_path_n()
2026-02-28 23:39:20 +01:00
Evgeny Grin (Karlson2k)
db3d2d32f5
connection.c: improved macro to avoid duplication of error messages macros
2026-02-28 23:34:05 +01:00
Evgeny Grin (Karlson2k)
a868dbc897
Chunks parsing: corrected inverted discipline match
2026-02-27 19:20:23 +01:00
Christian Grothoff
ba8f88fcb4
fix #10483
2025-10-12 11:06:02 +02:00
Christian Grothoff
deae6d4e09
fix indentation
2025-10-12 10:57:21 +02:00
Christian Grothoff
0a112de8ec
add SECURITY.md
2025-09-23 17:54:19 +02:00
Evgeny Grin (Karlson2k)
b03f13f32c
test_get_close_keep_alive: a minimal fix for curl 8.16
...
curl 8.16 is silently dropping second 'Connection: ' header from
requests, making some of the checks in the test unreliable.
See https://bugs.gnunet.org/view.php?id=10403
2025-09-21 16:20:49 +02:00
Evgeny Grin (Karlson2k)
391ee4df3c
test_get_close_keep_alive: improved reports readability
2025-09-21 16:16:19 +02:00
Christian Grothoff
d6444b0ad9
fix #9634 : ensure http header field names are restricted to 'token' character set as per RFC 9110
2025-09-20 12:15:51 +02:00
Christian Grothoff
6f4fd04bed
more DCE
2025-09-20 11:46:04 +02:00
Christian Grothoff
593bac45c2
remove websocket examples
2025-09-16 11:08:31 +02:00
Christian Grothoff
8a163c3f73
fix example FTBFS
2025-09-16 11:05:23 +02:00
Christian Grothoff
f4e2c13c68
fix example FTBFS
2025-09-16 11:04:48 +02:00
Christian Grothoff
ff13abc1c1
remove broken experimental code
2025-09-16 11:00:37 +02:00
Christian Grothoff
1fd9b3779f
fix #10333
2025-09-07 01:09:18 +02:00
Christian Grothoff
0db39f453a
remove pre-1.0 comment
2025-08-31 20:43:26 +02:00
Christian Grothoff
e9aa6dcdc1
fix rvalues ( #9667 )
2025-08-16 15:48:06 +02:00
Christian Grothoff
f2e3bbda41
-bump header version
2025-07-14 17:09:42 +02:00
Christian Grothoff
ebe728629c
fix double-close() bug reported by MC on the mailinglist
2025-07-14 17:06:25 +02:00
Christian Grothoff
Christian Grothoff
Evgeny Grin (Karlson2k)
Evgeny Grin (Karlson2k)