Christian Grothoff
fc353cf059
release v1.0.7
2026-07-27 18:14:11 +02:00
Christian Grothoff
5a73c1ae81
ensure digest authentication hex decoder does not overflow if give hex-encoded userhash is too long (potential out-of-bounds stack write); thanks to A. Ramos for reporting
2026-07-27 18:11:25 +02:00
Christian Grothoff
c13f4c6484
fix parsing of chunk-extension lines that previously failed to skip the \r\n properly; might be abused for HTTP request smuggling; thanks to A. Ramos for reporting
2026-07-27 18:00:30 +02:00
Christian Grothoff
29eaa56b31
fix read-buffer shift back underflow in special conditionas with trailing query arguments without '='; thanks to A. Ramos for reporting
2026-07-27 17:55:00 +02:00
Christian Grothoff
bd49ce930b
fix missing check for MHD_DIGEST_AUTH_ALGO3_INVALID case reported by A. Ramos that could result in an abort
2026-07-27 17:42:50 +02:00
Christian Grothoff
24872e88ff
POT update
2026-07-27 17:42:33 +02:00
Christian Grothoff
0f23455719
update NEWS
2026-07-08 12:48:44 +02:00
Christian Grothoff
6a3d1006b8
bump version to v1.0.6
2026-07-08 12:45:21 +02:00
Christian Grothoff
f2af9bc474
-DCE
2026-07-08 12:20:14 +02:00
Christian Grothoff
592c70648b
-typos
2026-07-08 12:17:59 +02:00
Christian Grothoff
026525d584
match content-type only at beginning of the line
2026-07-08 12:12:58 +02:00
Christian Grothoff
d6fc384fc4
fix overflow check
2026-07-08 12:11:26 +02:00
Christian Grothoff
f10d7c71ab
fix overflow check
2026-07-08 12:09:38 +02:00
Christian Grothoff
b4165ecc09
fix overflow check
2026-07-08 12:07:51 +02:00
Christian Grothoff
df2309b0ed
fix theoretical div by 0
2026-07-08 12:06:19 +02:00
Christian Grothoff
9a1527ff72
fix CLOSE flag test
2026-07-08 12:03:13 +02:00
Christian Grothoff
5abfcc927a
add assertion to prevent underflow
2026-07-08 11:56:37 +02:00
Christian Grothoff
97b4296cc0
fix possible underflow on timeout computation
2026-07-08 11:54:11 +02:00
Christian Grothoff
e5f88887df
size check before allocating
2026-07-08 11:51:55 +02:00
Christian Grothoff
b2752fc496
fix allocation type
2026-07-08 11:49:31 +02:00
Christian Grothoff
de88b6724a
check bound before writing in test
2026-07-08 11:45:28 +02:00
Christian Grothoff
04547cd9c8
use proper guards to avoid (theoretical) off-by-one in pct decoding
2026-07-08 11:42:33 +02:00
Christian Grothoff
2a6420de23
use caseless cmp as per function name and spec
2026-07-08 11:40:26 +02:00
Christian Grothoff
06cd63df36
limit to INT_MAX, not UINT_MAX
2026-07-08 11:37:55 +02:00
Christian Grothoff
83eecbca49
add NULL check
2026-07-08 11:37:01 +02:00
Christian Grothoff
b7dd720a32
fix oversized array
2026-07-08 11:36:24 +02:00
Christian Grothoff
930e236ea3
fix OOM handling
2026-07-08 11:34:32 +02:00
Christian Grothoff
d3c3ea0b8a
fix OOM handling
2026-07-08 11:33:51 +02:00
Christian Grothoff
679fb11892
fix swapped conditions in poll() for upgraded socket
2026-07-08 11:32:58 +02:00
Christian Grothoff
3704914ccd
remove duplicated mutex destroy
2026-07-08 11:31:13 +02:00
Christian Grothoff
d2375954a1
releasing v1.0.5
2026-04-16 10:38:04 +02:00
Evgeny Grin (Karlson2k)
9933d65464
Tighten request header processing to match RFC
...
New implementation:
+ rejects repeated Host: headers
+ handles repeated Content-Length: more carefully
+ handles malformed Content-Length: better
+ handles repeated Transfer-Encoding: headers
+ parses all Cookie: headers instead of just first header
+ handles properly Transfer-Encoding: in HTTP/1.0 requests
2026-04-15 21:35:12 +02:00
Evgeny Grin (Karlson2k)
a7f6ad8f4f
test_mhd_version.c: corrected output
2026-04-14 19:55:27 +02:00
Evgeny Grin (Karlson2k)
a1f9374226
Updated M4 macros
2026-04-14 19:55:27 +02:00
Evgeny Grin (Karlson2k)
a083613d84
Fixed checking headers longer than actually needed
...
The prevents matching header like "Content-Length-Anything:" as
"Content-Length:" header.
2026-04-14 19:39:50 +02:00
Evgeny Grin (Karlson2k)
0d33a88f35
Bump MHD_VERSION to indicate development version
2026-04-14 19:33:13 +02:00
Evgeny Grin (Karlson2k)
4f049186bf
Fixed missing MHD_VERSION bump
2026-04-14 19:32:32 +02:00
Christian Grothoff
d30316fda9
bump version
2026-04-13 11:43:19 +02:00
Christian Grothoff
c345fa6474
enable content-length duplicate check at default discipline level
2026-04-10 11:54:53 +02:00
Christian Grothoff
f07e09b7dc
add code to reject requests with multiple Content-Length HTTP headers being sent by the client; thanks to SYSS.de for reporting
2026-04-07 17:54:42 +02:00
Christian Grothoff
5f207ceede
fix bug in list traversal that could cause ready connections to be skipped if other connections were suspended
2026-04-02 00:18:18 +02:00
Evgeny Grin (Karlson2k)
1e43edd529
Request chunk processing: reject bare CR in chunk extension
2026-03-01 00:23:07 +01:00
Evgeny Grin (Karlson2k)
ff26d02aa0
Request chunk processing: simplified check for overflow
2026-03-01 00:19:22 +01:00
Evgeny Grin (Karlson2k)
ec6e6d2888
Added MHD_OPTION_ALLOW_BIN_ZERO_IN_URI_PATH and MHD_get_connection_URI_path_n()
2026-02-28 23:39:20 +01:00
Evgeny Grin (Karlson2k)
db3d2d32f5
connection.c: improved macro to avoid duplication of error messages macros
2026-02-28 23:34:05 +01:00
Evgeny Grin (Karlson2k)
a868dbc897
Chunks parsing: corrected inverted discipline match
2026-02-27 19:20:23 +01:00
Christian Grothoff
ba8f88fcb4
fix #10483
2025-10-12 11:06:02 +02:00
Christian Grothoff
deae6d4e09
fix indentation
2025-10-12 10:57:21 +02:00
Christian Grothoff
0a112de8ec
add SECURITY.md
2025-09-23 17:54:19 +02:00
Evgeny Grin (Karlson2k)
b03f13f32c
test_get_close_keep_alive: a minimal fix for curl 8.16
...
curl 8.16 is silently dropping second 'Connection: ' header from
requests, making some of the checks in the test unreliable.
See https://bugs.gnunet.org/view.php?id=10403
2025-09-21 16:20:49 +02:00
Christian Grothoff
Christian Grothoff
Evgeny Grin (Karlson2k)
Evgeny Grin (Karlson2k)