Commit graph

363 commits

Author SHA1 Message Date
Viktor Szakats
2bb3643bc1
sws: fix potential OOB write
Found by Codex Security

Follow-up to 0aaebf62ec

Closes #20988
2026-03-19 12:02:10 +01:00
Viktor Szakats
ccba492024
tidy-up: miscellaneous
Closes #20851
2026-03-09 11:35:19 +01:00
Daniel Stenberg
1495489c41
docs: drop basically
Another filler word

Closes #20835
2026-03-07 10:58:36 +01:00
Viktor Szakats
d38bf7949d
tests/server: fix to clear the complete srvr_sockaddr_union_t variable
Reported by clang-tidy (seen on Linux with v18, v19, v20, not on macOS):
```
tests/server/dnsd.c:552:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/dnsd.c:556:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/rtspd.c:1183:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/rtspd.c:1187:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/sws.c:2235:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/sws.c:2239:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/tftpd.c:1188:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/tftpd.c:1192:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/util.c:860:21: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/util.c:864:21: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
```
Ref: https://github.com/curl/curl/actions/runs/22424827575/job/64930560425?pr=20725

Cherry-picked from #20725

Closes #20730
2026-02-26 04:19:18 +01:00
Viktor Szakats
65262be0ab
clang-tidy: enable readability-math-missing-parentheses, adjust code
No functional changes.

Also:
- md4, md5: drop redundant parentheses from macro values.

Closes #20691
2026-02-23 18:57:40 +01:00
Daniel Stenberg
510fdad64d
sws: prevent "connection monitor" to say disconnect twice 2026-02-07 22:16:53 +01:00
Viktor Szakats
85de995208
tidy-up: move literals to right-side of if expressions (where missing)
Closes #20535
2026-02-07 16:41:51 +01:00
Viktor Szakats
9630593650
build: use more const
Mostly with `char *` types.

Also:
- mime, x509asn1, tool_operate, lib3207: drop redundant casts.
- examples/smooth-gtk-thread: add missing variable declaration.
- reduce variable scopes.
- tests/server: move `data_to_hex()` to its only user: `sws`.

Closes #20489
2026-02-02 12:32:49 +01:00
Viktor Szakats
4e5908306a
build: constify memchr()/strchr()/etc result variables (cont.)
Assisted-by: Rudi Heitbaum
Fixes #20420
Follow-up to 7dc60bdb90 #20425
Follow-up to 0e2507a3c6 #20421

Closes #20428
2026-01-25 14:20:37 +01:00
Viktor Szakats
0e2507a3c6
build: constify memchr()/strchr()/etc result variables
And a few variables around.

There remain cases where the accepted pointer is const, yet the returned
pointer is written to.

Partly addressing (glibc 2.43):
```
* For ISO C23, the functions bsearch, memchr, strchr, strpbrk, strrchr,
  strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr that return
  pointers into their input arrays now have definitions as macros that
  return a pointer to a const-qualified type when the input argument is
  a pointer to a const-qualified type.
```
Ref: https://lists.gnu.org/archive/html/info-gnu/2026-01/msg00005.html

Reported-by: Rudi Heitbaum
Ref: #20420

Closes #20421
2026-01-25 12:21:54 +01:00
Viktor Szakats
0431cbe71a
build: globally suppress DJGPP warnings in FD_SET()
Replacing the many local `#pragma` used before this patch,
reducing the number of `__DJGPP__` guards from 58 to 13.

Closes #20299
2026-01-13 23:17:10 +01:00
Viktor Szakats
60f9d3dd7b
build: omit forward declarations
- drop redundant forward declarations.
- reorder local functions to not need forward declarations.
- tftpd: merge two `ifdef` blocks.

Closes #20297
2026-01-13 21:15:36 +01:00
Viktor Szakats
b10b7c1fce
tests/server: fix initialization on Windows Vista+
Make sure to call `curlx_now_init()` before the first call to
`curlx_now()`.

Before this patch the first `curlx_now()` used the non-Vista code path
calling `GetTickCount()` on Vista+. This is harmless, but the upcoming
PR #18009 is going to drop the non-Vista code path, causing a division
by zero at startup in test servers, without this fix.

Bug: https://github.com/curl/curl/pull/18009#issuecomment-3652154307

Closes #19973
2025-12-15 02:14:28 +01:00
Viktor Szakats
f97e62ff14
sws: fix binding to unix socket on Windows
Windows 10.17063+ (having unix socket support) fails to set for unix
sockets the `SO_REUSEADDR` option, with error 10045 (`WSAEOPNOTSUPP`),
and also fails to set `SO_KEEPALIVE` with error 10042 (`WSAENOPROTOOPT`).

Fix by not enabling these socket options on Windows for unix sockets.

Also:
- fixing test 1435, 1436 to run in CI.
- fixing the `socksd` test server for test 1467, 1468, 1470. But, also
  disable these for now due to another Windows issue: #19825

Ref: https://stackoverflow.com/questions/68791319/unix-domain-socket-bind-failed-in-windows/68794755#68794755
Ref: #19810
Closes #19812
2025-12-04 22:49:03 +01:00
Viktor Szakats
0476e4fc65
tidy-up: one more round of formatting nits
Closes #19835
2025-12-04 19:30:59 +01:00
Viktor Szakats
d73efc62c1
tests: fix formatting nits
Also:
- lib1948: fix checksrc error TYPEDEFSTRUCT.
  (detected after formatting)

Closes #19754
2025-11-28 23:15:35 +01:00
Viktor Szakats
ee97c2a96a
tests/server: use curlx file open/close functions
Replace:
- `open()` with `curlx_open()` (1 call).
- `fopen()` with `curlx_fopen()`.
- `fclose()` with `curlx_fclose()`.

To centralize interacting with the CRT in preparation for using "safe"
alternatives on Windows. This also adds long-filename and Unicode
support for these operations on Windows.

Keep using `open()` in the signal handler to avoid any issues with
calling code not allowed in signal handlers.

Cherry-picked from #19643
Closes #19679
2025-11-25 01:46:06 +01:00
Viktor Szakats
a87383828e
badwords: fix issues found in tests
There remain some false positives, hits in test data, and `dir` use,
around 100 issues in total.

There is no plan to enforce badwords on tests.

Also:
- badwords.txt: let a few `manpage[s]` occurrences through
  (in Perl code).

Closes #19541
2025-11-17 13:30:35 +01:00
Daniel Stenberg
f2a75a14dd
sws: repair --port, and accept any port
Also for mqttd and sockfilt. The < 1025 check was not serving any
purpose.

Follow-up to bb1391f943
2025-11-13 17:20:41 +01:00
Viktor Szakats
bb1391f943
tests/server: replace atoi() and atol() with curlx_str_number()
Closes #19510
2025-11-13 14:09:03 +01:00
Daniel Stenberg
1e90a63a49
sws: pass in socket reference to allow function to close it
The function service_connection() now passes in a reference to the
socket instead of by value since the sub function http_connect() might
close it and set *infdp = CURL_SOCKET_BAD. This would previously not be
detected when service_connection() returned and potentially cause a
double close of the socket.

Reported-by: Joshua Rogers

Closes #19031
2025-10-12 15:35:14 +02:00
Viktor Szakats
34ad78da89
curlx: move Curl_strerror, use in src and tests, ban strerror globally
Also:
- tests/server: replace local `sstrerror()` with `curlx_strerror()`.
- tests/server: show the error code next to the string, where missing.
- curlx: use `curl_msnprintf()` when building for src and tests.
  (units was already using it.)
- lib: drop unused includes found along the way.
- curlx_strerror(): avoid compiler warning (and another similar one):
  ```
  In file included from servers.c:14:
  ../../lib/../../lib/curlx/strerr.c: In function ‘curlx_strerror’:
  ../../lib/../../lib/curlx/strerr.c:328:32: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |                                ^
  ../../lib/../../lib/curlx/strerr.c:47:18: note: ‘snprintf’ output 1 or more bytes (assuming 2) into a destination of size 1
     47 | #define SNPRINTF snprintf
        |                  ^
  ../../lib/../../lib/curlx/strerr.c:328:7: note: in expansion of macro ‘SNPRINTF’
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |       ^~~~~~~~
  ```

Follow-up to 45438c8d6f #18823

Closes #18840
2025-10-06 09:44:23 +02:00
Viktor Szakats
eaf66f18b7
tests/server: replace banned functions with curlx_str_hex
Replace an `strtol()` and `strtoul()` call, both used in hex mode, with
`curlx_str_hex()`.

Follow-up to 45438c8d6f #18823

Closes #18837
2025-10-06 09:44:22 +02:00
Viktor Szakats
45438c8d6f
checksrc: reduce directory-specific exceptions
By making them defaults, then fixing and/or reshuffling remaining
exceptions as necessary.

- checksrc: ban by default: `snprintf`, `vsnprintf`, `sscanf`, `strtol`.
- examples: replace `strtol` with `atoi` to avoid a checksrc exception.
- tests/libtest: replace `strtol` with `atol`.
- tests/server: replace most `strtol` with `atol`.
- tests/server: replace most `strtoul` with `atol`/`atoi`.
- tests/server: drop no longer used `util_ultous`.
- fix typo in checksrc rules: `vsnprint` -> `vsnprintf`.
- update local exceptions.

Also:
- examples: ban curl printf functions. They're discouraged in user code.
- examples: replace curl printf with system printf.
  Add `snprintf` workaround for <VS2015.
- examples/synctime: fix `-Wfloat-equal`.
- examples/synctime: exclude for non-Windows and non-UWP Windows.
- examples/synctime: build by default.

Closes #18823
2025-10-04 00:48:58 +02:00
Viktor Szakats
ea752b575c
sws: fix checking sscanf() return value
Closes #18565
2025-09-16 13:34:51 +02:00
Viktor Szakats
06c12cc08b
build: disable TCP_NODELAY for emscripten
In WebAssembly, using `TCP_NODELAY` fails with:
```
* Could not set TCP_NODELAY: Protocol not available
```

Add a new feature macro in `curl_setup.h` telling whether `TCP_NODELAY`
is known to be supported at runtime, when defined at compile-time.

Keep `TCP_NODELAY` guards at their current positions to ensure the
necessary headers (e.g. `netinet/tcp.h` and `netinet/in.h`) define it.

Reported-by: Jeroen Ooms
Fixes #17974
Closes #18155
2025-08-05 00:34:24 +02:00
Viktor Szakats
3bdef96aba
servers: convert two macros to scoped static const strings
Closes #18067
2025-07-29 02:04:52 +02:00
Viktor Szakats
89771d19d5
tidy-up: prefer ifdef/ifndef for single checks
Closes #18018
2025-07-27 22:35:17 +02:00
Viktor Szakats
b2bccdc257
tidy-up: move literal to the right side of comparisons
Closes #17876
2025-07-27 22:35:17 +02:00
Viktor Szakats
4d977fe552
tidy-up: more whitespace/indent, comments
Also a couple of minor formatting updates in the root `CMakeLists.txt`.
One swap to `#ifdef`.

Closes #17929
2025-07-25 11:47:51 +02:00
Viktor Szakats
8ae93a95f8
curl_fnmatch, servers: drop local macros in favour of sizeof()
Closes #17898
2025-07-21 16:14:14 +02:00
Viktor Szakats
bb50dee510
tests/server: de-dupe/merge three sockdaemon() clones into one
Also: tidy up `if()` expressions here and there.

Follow-up to f4f25505df #15000

Closes #17719
2025-06-23 17:02:43 +02:00
Viktor Szakats
6a0cd4feb7
tests: make individual test sources compile cleanly
Tidy up headers and includes to ensure all individual test source
compile cleanly (but not link). To allow running clang-tidy (and
possibly other static analyzers) on them. It also improves readability
and allows to verify them locally, without the bundle logic.

clang-tidy ignores #included C files, so it's blind to bundle C files
the include these tests. The current workaround of embedding has
a couple of downsides:. meaningless filenames and line numbers,
missing issues, messing up self header paths. Thus, running it on
individual sources would be beneficial.

Also:
- de-duplicate includes.
- untangle some includes.
- formatting/indentation fixes.
- merge `getpart.h` into `first.h`.

Ref: https://github.com/curl/curl/pull/17680#issuecomment-2991730158

Closes #17703
2025-06-22 15:58:15 +02:00
Viktor Szakats
e29f11f2d6
tests/server: drop memdebug.h
It's no longer used in any build configuration.

Follow-up to fffec3d7e9 #17629

Closes #17700
2025-06-22 09:00:53 +02:00
Viktor Szakats
916f241f2f
lib: make CURLX_SET_BINMODE() and use it
Use it from libtests' `first.c` and thus also from units, and tunits.

Also:
- cmake: drop stray `curltool` lib dependency for units.
- units: stop depending on `src` headers.
- tests/server: drop depending on `src` headers.
  (the remaining one listed in the comments, `tool_xattr.h`, was not
  actually used from servers.)
- tests/server: drop duplicate curlx headers.
  (Except `warnless.h`, which is tricky on Windows.)

Closes #17672
2025-06-19 15:57:37 +02:00
Viktor Szakats
35d0c047ce
lib: make curlx_wait_ms() and use it
Move function to curlx/, change all callers.

Also:
- src: replace local implementation.
- tests/client: replace local ad-hoc sleep code.
- tests/libtest: replace local `wait_ms()` implementation.
- lib1531: replace local ad-hoc sleep code.
- tests/server: replace local, simplified copy.
- tests/server: formatting, drop some unused headers.

Closes #17641
2025-06-19 15:57:37 +02:00
Viktor Szakats
9fc05357ef
tests/server: make all global vars/funcs static
Also merge `util.h` into `util.c`.

Closes #17671
2025-06-19 13:28:45 +02:00
Viktor Szakats
2c27a67daa
tests: always make bundles, adapt build and tests
Make test bundles the default. Drop non-bundle build mode.
Also do all the optimizations and tidy-ups this allows, simpler builds,
less bundle exceptions, streamlined build mechanics.

Also rework the init/deinit macro magic for unit tests. The new method
allows using unique init/deinit function names, and calling them with
arguments. This is in turn makes it possible to reduce the use of global
variables.

Note this drop existing build options `-DCURL_TEST_BUNDLES=` from cmake
and `--enable-test-bundles` / `--disable-test-bundles` from autotools.

Also:
- rename test entry functions to have unique names: `test_<testname>`
  This removes the last exception that was handled in the generator.
- fix `make dist` to not miss test sources with test bundles enabled.
- sync and merge `tests/mk-bundle.pl` into `scripts/mk-unity.pl`.
- mk-unity.pl: add `--embed` option and use it when `CURL_CLANG_TIDY=ON`
  to ensure that `clang-tidy` does not miss external test C sources.
  (because `clang-tidy` ignores code that's #included.)
- tests/unit: drop no-op setup/stop functions.
- tests: reduce symbol scopes, global macros, other fixes and tidy-ups.
- tool1621: fix to run, also fix it to pass.
- sockfilt: fix Windows compiler warning in certain unity include order,
  by explicitly including `warnless.h`.

Follow-up to 6897aeb105 #17468

Closes #17590
2025-06-14 21:08:23 +02:00
Daniel Stenberg
47896d4b59
tests/server: stop using libcurl string comparisons
Further untangle the test server code from curl code. While the string
comparison functions are available in the libcurl API, the tests servers
don't link with libcurl. Use native functions instead.

Closes #17328
2025-05-13 10:28:19 +02:00
Daniel Stenberg
8b33704511
tests/server: stop using libcurl's printf functions
Since the test servers are not built with libcurl the *printf code
needed to get built separately, and they are not in the curlx
collection.

snprintf() is provided in all modern systems these days.

Move curlx functions from lib/strerror.c to lib/curlx/winapi.c

Assisted-by: Viktor Szakats

Closes #17294
2025-05-12 22:45:37 +02:00
Daniel Stenberg
1ef5bef055
tests/server: remove TEST use, include <memdebug.h>
- The TEST define is never set
- memdebug.h is not in the local dir, using angle bracket include

Closes #17323
2025-05-12 13:20:54 +02:00
Daniel Stenberg
a129859367
lib: drop curlx_getpid, use fake pid in SMB
It was not a function properly exposed in the curlx set. SMB cannot
possibly need to send a real pid, now sends a made up number.

The only real users of this function are test servers, so move the logic
over there.

Closes #17298
2025-05-09 10:01:30 +02:00
Daniel Stenberg
255aac56f9
curlx: move into to curlx/
Move curlx_ functions into its own subdir.

The idea is to use the curlx_ prefix proper on these functions, and use
these same function names both in tool, lib and test suite source code.
Stop the previous special #define setup for curlx_ names.

The printf defines are now done for the library alone. Tests no longer
use the printf defines. The tool code sets its own defines. The printf
functions are not curlx, they are publicly available.

The strcase defines are not curlx_ functions and should not be used by
tool or server code.

dynbuf, warnless, base64, strparse, timeval, timediff are now proper
curlx functions.

When libcurl is built statically, the functions from the library can be
used as-is. The key is then that the functions must work as-is, without
having to be recompiled for use in tool/tests. This avoids symbol
collisions - when libcurl is built statically, we use those functions
directly when building the tool/tests. When libcurl is shared, we
build/link them separately for the tool/tests.

Assisted-by: Jay Satiro

Closes #17253
2025-05-07 11:01:15 +02:00
Viktor Szakats
9465327084
cmake: fix clang-tidy builds to verify tests, fix fallouts
- cmake: disable test bundles for clang-tidy builds.
  clang-tidy ignores #included .c sources, and incompatible with unity
  and bundles. It caused clang-tidy ignoring all test sources. It also
  means this is the first time tests sources are checked with
  clang-tidy. (autotools doesn't run it on tests.)

- cmake: update description for `CURL_TEST_BUNDLES` option.

- fix tests using special `CURLE_*` enums that were missing from
  `curl/curl.h`. Add them as reserved codes.

- fix about ~50 other issues detected by clang-tidy: unchecked results,
  NULL derefs, memory leaks, casts to enums, unused assigments,
  uninitialized `errno` uses, unchecked `open`, indent, and more.

- drop unnecessary casts (lib1533, lib3207).

- suppress a few impossible cases with detailed `NOLINT`s.

- lib/escape.c: drop `NOLINT` no longer necessary.
  Follow-up to 72abf7c13a #13862 (possibly)

- extend two existing `NOLINT` comments with details.

Follow-up to fabfa8e402 #15825

Closes #16756
2025-03-24 10:14:58 +01:00
Viktor Szakats
43b2884655
tests/server: give global path variable a more descriptive name
Use a more descriptive global variable name in server code, also
to avoid colliding with this name used elsewhere in libcurl.

This isn't causing an issue at this time, but makes the code prone
to `-Wshadow` warnings in unity mode, if the global variable is
compiled first. This specific variable could collide with the `path`
argument of the `curlx_win32_stat()` function.

Closes #16719
2025-03-14 12:04:39 +01:00
Viktor Szakats
51d8213579
core: stop redefining E* macros on Windows, map EACCES, related fixes
Before this patch, standard `E*` errno codes were redefined on Windows,
onto matching winsock2 `WSA*` error codes, which have different values.
This broke uses where using the `E*` value in non-socket context, or
other places expecting a POSIX `errno`, e.g. file I/O, threads, IDN or
interfacing with dependencies.

Fix it by introducing a curl-specific `SOCKE*` set of macros that map to
`WSA*` on Windows and standard POSIX codes on other platforms. Then
verify and update the code to use `SOCKE*` or `E*` macro depending on
context.

- Add `SOCKE*` macros that map to either winsock2 or POSIX error codes.
  And use them with `SOCKERRNO` or in contexts requiring
  platform-dependent socket error codes.

  This fixes `E*` uses which were supposed be POSIX values, not `WSA*`
  socket errors, on Windows:
  - lib/curl_multibyte.c
  - lib/curl_threads.c
  - lib/idn.c
  - lib/vtls/gtls.c
  - lib/vtls/rustls.c
  - src/tool_cb_wrt.c
  - src/tool_dirhie.c

- Ban `E*` codes having a `SOCKE*` mapping, via checksrc.
  Authored-by: Daniel Stenberg

- Add exceptions for `E*` codes used in file I/O, or other contexts
  requiring POSIX error codes.

Also:
- ftp: fix missing `SOCKEACCES` mapping for Windows.
- add `SOCKENOMEM` for `Curl_getaddrinfo()` via `asyn-thread.c`.
- tests/server/sockfilt: fix to set `SOCKERRNO` in local `select()`
  override on Windows.
- lib/inet_ntop: fix to return `WSAEINVAL` on Windows, where `ENOSPC` is
  used on other platforms. To simulate Windows' built-in `inet_ntop()`,
  as tested on a Win10 machine.
  Note:
  - WINE returns `STATUS_INVALID_PARAMETER` = `0xC000000D`.
  - Microsoft documentation says it returns `WSA_INVALID_PARAMETER`
    (= `ERROR_INVALID_PARAMETER`) 87:
    https://learn.microsoft.com/windows/win32/api/ws2tcpip/nf-ws2tcpip-inet_ntop#return-value
- lib/inet_ntop: drop redundant `CURL_SETERRNO(ENOSPC)`.
  `inet_ntop4()` already sets it before returning `NULL`.
- replace stray `WSAEWOULDBLOCK` with `USE_WINSOCK` macro to detect
  winsock2.
- move existing `SOCKE*` mappings from `tests/server` to
  `curl_setup_once.h`.
- add missing `EINTR`, `EINVAL` constants for WinCE.

Follow-up to abf80aae38 #16612
Follow-up to d69425ed7d #16615
Bug: https://github.com/curl/curl/pull/16553#issuecomment-2704679377

Closes #16621
2025-03-13 00:03:25 +01:00
Viktor Szakats
ee73d553ed
build: replace Curl_ prefix with curlx_ for functions used in servers
Closes #16689
2025-03-13 00:03:15 +01:00
Viktor Szakats
29ed1f9834
tests/server: use curlx_str_numblanks() to avoid errno
Replacing `strtoul()` calls and glue code.

Closes #16671
2025-03-11 16:06:33 +01:00
Viktor Szakats
bad5e71331
tidy-up: whitespace, tests/server Makefile.inc, timeval in VS project
- VS projects: drop unused `timediff`.
  (used by curltool library, but this build method doesn't build that.)
- tests/server/sws: reflow an `if` for greppability.
- tests/server/Makefile.inc: indent, format
- tests/server/Makefile.inc: merge `USEFUL` and `UTIL` lists.

Closes #16651
2025-03-10 14:19:49 +01:00
Viktor Szakats
5681628e2d
tests/server: sync wait_ms() with the libcurl implementation
It contains a series of bugfixes and updates applied to libcurl's
`Curl_wait_ms()` over the years, but missed from the copy in
`tests/server/util.c`:
- d65321f939,
  52e822173a,
  5912da253b
- 4a8f459837
- 1ad49feb71

It fixes `wait_ms()` to check for, and return `SOCKERRNO`. Fixing error
handling on Windows.

Also:
- tests/server: change callers to check `SOCKERRNO`.
- `wait_ms()`: fix to check for the correct error code on Windows.
  Pending for `Curl_wait_ms()`: #16621.
- `Curl_wait_ms()`: tidy-up `Sleep()` argument cast (nit).
- lib/curl_trc: drop an unused header.

Closes #16627
2025-03-09 12:04:30 +01:00