Pedro Monreal Gonzalez
1b4d5053ee
* Security fixes:
- [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS
* Changes:
- curl: make --rate accept "number of units"
- curl: make --show-headers the same as --include
- curl: support --dump-header % to direct to stderr
- curl: support embedding a CA bundle and --dump-ca-embed
- curl: support repeated use of the verbose option; -vv etc
- curl: use libuv for parallel transfers with --test-event
- vtls: stop offering alpn http/1.1 for http2-prior-knowledge
* Bugfixes:
- curl: allow 500MB data URL encode strings
- curl: warn on unsupported SSL options
- Curl_rand_bytes to control env override
- curl_sha512_256: fix symbol collisions with nettle library
- dist: fix reproducible build from release tarball
- http2: fix GOAWAY message sent to server
- http2: improve rate limiting of downloads
- INSTALL.md: MultiSSL and QUIC are mutually exclusive
- lib: add eos flag to send methods
- lib: make SSPI global symbols use Curl_ prefix
- lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name
- lib: remove the final strncpy() calls
- lib: remove use of RANDOM_FILE
- Makefile.mk: fixup enabling libidn2
- max-filesize.md: mention zero disables the limit
- mime: avoid inifite loop in client reader
- ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks
- openssl quic: fix memory leak
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/curl?expand=0&rev=376
42 lines
1.1 KiB
Diff
42 lines
1.1 KiB
Diff
Index: curl-8.10.0/lib/getenv.c
|
|
===================================================================
|
|
--- curl-8.10.0.orig/lib/getenv.c
|
|
+++ curl-8.10.0/lib/getenv.c
|
|
@@ -29,6 +29,14 @@
|
|
|
|
#include "memdebug.h"
|
|
|
|
+#ifndef HAVE_SECURE_GETENV
|
|
+# ifdef HAVE___SECURE_GETENV
|
|
+# define secure_getenv __secure_getenv
|
|
+# else
|
|
+# error neither secure_getenv nor __secure_getenv is available
|
|
+# endif
|
|
+#endif
|
|
+
|
|
static char *GetEnv(const char *variable)
|
|
{
|
|
#if defined(_WIN32_WCE) || defined(CURL_WINDOWS_APP) || \
|
|
@@ -69,7 +77,7 @@ static char *GetEnv(const char *variable
|
|
/* else rc is bytes needed, try again */
|
|
}
|
|
#else
|
|
- char *env = getenv(variable);
|
|
+ char *env = secure_getenv(variable);
|
|
return (env && env[0])?strdup(env):NULL;
|
|
#endif
|
|
}
|
|
Index: curl-8.10.0/configure.ac
|
|
===================================================================
|
|
--- curl-8.10.0.orig/configure.ac
|
|
+++ curl-8.10.0/configure.ac
|
|
@@ -5213,6 +5213,8 @@ if test "x$want_curldebug_assumed" = "xy
|
|
ac_configure_args="$ac_configure_args --enable-curldebug"
|
|
fi
|
|
|
|
+AC_CHECK_FUNCS([__secure_getenv secure_getenv])
|
|
+
|
|
AC_CONFIG_FILES([\
|
|
Makefile \
|
|
docs/Makefile \
|