Commit graph

1591 commits

Author SHA1 Message Date
Viktor Szakats
39dec13ec0
build: always use local inet_pton()/inet_ntop() implementations
Also repurpose existing build-time feature checks into unit test 1961,
to verify.

Prior to this patch these functions were auto-detected with both
autotools and cmake. In case of autotools there was an extra
verification phase ensuring the functions work as expected. This step
required running the function, thus was limited to non-cross-builds. For
cross-builds and CMake it always used the system implementation if
present. On Windows it always used the local implementation, because
availability/use is complicated there.

After this patch all platforms, always use the local implementation,
which is known to be accurate. This makes curl behave more consistently,
and simplifies the build process, a fixes cross-builds and CMake
auto-detection differences.

Also:
- test1960: enable unconditionally.
- checksrc: disallow globally, allowlist in `block_ip.c` example.
- dnsd: verify ntop result for NULL before passing to printf.

Ref: https://github.com/curl/curl/pull/22137#issuecomment-4797440983
Ref: #22137
Ref: 8537a5b0bc #16577

Closes #22170
2026-06-27 01:24:39 +02:00
Viktor Szakats
9f9d2d10d9
lib1587: fix gcc -Wconversion with LibreSSL on Windows, test in CI
By exposing and reusing existing custom type via `vtls/openss.h`.

Also:
- GHA/curl-for-win: test in CI by enabling building tests.
  Cost is 45s per job, so limit it to the gcc job.

Seen with Windows x64 gcc (not tested in CI prior to this patch):
```
tests/libtest/lib1587.c:50:7: error: conversion from 'opt1587' {aka 'long long unsigned int'} to 'long int' may change value [-Werror=conversion]
   50 |       SSL_CTX_set_options(info->internals, opts);
      |       ^~~~~~~~~~~~~~~~~~~
tests/libtest/lib1587.c:59:7: error: conversion from 'opt1587' {aka 'long long unsigned int'} to 'long int' may change value [-Werror=conversion]
   59 |       SSL_set_options(info->internals, opts);
      |       ^~~~~~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/28258372229/job/83727170184?pr=22195#step:3:4884

Ref: da2f05e6f6 #22198
Ref: 6163566461 #22197
Follow-up to 3e40ccb875 #21290
Follow-up to 2db8ae480f #17809 #17801

Closes #22195
2026-06-26 22:44:53 +02:00
Viktor Szakats
84c5dcdb05
tidy-up: syntax and code nits
- cmp-pkg-config.sh: replace `-r -f` with `-rf` to match rest of repo.
- configure.ac: add double quotes for robustness (not a bug).
- curl-openssl.m4: merge nested `if`s.
- CurlTests.c: drop `!= 0`, also to sync with m4.
- CurlTests.c: replace `example.com` with `localhost` in
  `gethostbyname()` feature test code. (compile-only, not a bug)
- GHA/http3-linux: drop literal `true` from bool expression.
- lib650: drop redundant `&`.
- move variable/call to left-hand side of equality checks, where
  missing.
- perl: detach `<`/`>` from filename in `open()`, where missing.
- schannel: apply two nit fixes lost in rebase.
- scripts/verify-release: drop redundant double quotes.
- scripts/verify-release: exit with error code on error.
- synctime: replace magic numbers with `sizeof()`.
- telnet: add missing parentheses to macro value.
- tests/Makefile.am: use single quotes.
- tool_operate: drop redundant `break` after `return` in VMS code.
- unit2413: drop unused NULL pointer + free call.
- unit2413: fix duplicate test case name.
- urlapi: drop redundant parentheses.
- urlapi: drop `CURL_UNCONST()` that became redundant.

Closes #22186
2026-06-26 15:45:24 +02:00
Daniel Stenberg
a6af50c484
multi: forbid curl_easy_pause from within multi socket callback
- there is a risk for a nasty recursive situation

- we avoid certain risks that the pause call changes things so that when
  returning from the callback, the state of some internals is undefined
  and we need to reload which is easy to miss

- we can't think of legitiate use cases for doing this. This is
  basically just the new favorite point for AI and security researchers
  to find hypothetical problems

Closes #22179
2026-06-26 13:43:48 +02:00
Viktor Szakats
397b8f0ec6
tidy-up: docs, comments, typos, whitespace
- GHA/windows: mention `IgnoreStandardErrorWarningFormat=true`
  in comment.
- cmake: fix MIT/GNU GSS order in messages.
- drop some exclamation marks from messages.
- drop redundant ending newlines from messages.
- fold/unfold where possible.
- fix indent, whitespace, typos and other nits.

Closes #22185
2026-06-26 11:36:09 +02:00
Daniel Stenberg
c6c4c6a16d
test 1560: test RFC4291 style IPv6 IPv4-mapped addresses
Closes #22136
2026-06-25 11:03:18 +02:00
Stefan Eissing
f0be417635
multi: xfers_really_alive
Yes, we were counting the "live" transfers before, but were they
*really* alive?

When determining to add the wakeup socket to fdset/waitfds etc, we
should only do that when the multi handle is actually processing
transfers. Other wise, the application could wait on the wakeup socket
forever.

For this, we counted `multi->xfers_alive` (e.g. the "running" number
returned by `curl_multi_perform()`). This was almost correct.

The problem is that added easy handles are counted as "alive" right away
on the addition. But the processing has not started yet. They did not
trigger any DNS resolves or opened any sockets yet.

Add two fields in multi and easy handle:

* `multi->xfers_really_alive`: counts the "alive" transfers that have
  passed `MSTATE_INIT` (at least once)
* `data->state.really_alive`: to track if the transfer has been counted

Add test 2412 to check that adding transfers without perform will not
trigger the wakeup socket to be added.

Fixes #22050
Reported-by: Bryan Henderson
Closes #22066
2026-06-18 10:31:40 +02:00
Viktor Szakats
60381b2046
first.h reflow 2026-06-17 14:37:14 +02:00
Daniel Stenberg
39caaff7b3
libtest: unify on easy_setopt macro
- drop the old test_setopt() which did the same thing
- remove #if 0'ed macros from first.h

These macros now store results in 'result' more aggressively, but I
believe that is generally favorable.

Closes #22057
2026-06-17 12:03:41 +02:00
Viktor Szakats
be8f24323e
perl: open... || -> open... or (cont.)
Also: unfold a few lines, fix a space, add a missing parentheses.

Follow-up to 678e63934c #22036

Closes #22047
2026-06-16 19:11:15 +02:00
Viktor Szakats
678e63934c
perl: || die -> or die
Usage was fifty-fifty between these syntaxes before this patch.

Closes #22036
2026-06-16 00:41:29 +02:00
Viktor Szakats
adb606eae7
curl_formdata: fix to pass long where missing, document CURLFORM_NAMELENGTH
- lib650: pass `long` to `CURLFORM_NAMELENGTH` in test.
  Spotted by Copilot.
  https://github.com/curl/curl/pull/22011#discussion_r3412407235
  Follow-up to 3620e569b3

- lib650: drop an interim variable, and interim casts.
  Follow-up to 60776a0515 #2747

- curl_formdata.md: document `CURLFORM_NAMELENGTH` on man page.

- curl_formdata.md: pass `long` to `CURLFORM_BUFFERLENGTH` on man page.

- formdata: pass `long` to `CURLFORM_CONTENTSLENGTH` in comment.

Closes #22017
2026-06-15 16:57:21 +02:00
Viktor Szakats
8932063828
lib668: do not assume null-terminator in test input data
For correctness. Did not cause an issue, because the null-terminator is
present.

Also:
- change a size type to avoid casts.
- reuse input length value.

Spotted by GitHub Code Quality

Follow-up to 1e4cb333ef #4826

Closes #22027
2026-06-15 15:55:29 +02:00
Viktor Szakats
a6d9783894
libtests: prefer sizeof() over strlen(), fix potential OOB read in 1591
- test1591: fix potential OOB read.
  Spotted by GitHub Code Quality
  Follow-up to f464535bfd #3350

Closes #22011
2026-06-15 11:24:19 +02:00
Viktor Szakats
0ffab25b6c
tidy-up: miscellaneous
- `N byte` -> `N-byte` or `N bytes`.
- INTERNALS.md: language tweaks.
- schannel: language tweak in comment/error message.
- socks_gssapi, socks_sspi: simplify composing an error message.
  (at a cost of 8 extra constant string bytes.)
- m4/curl-compilers.m4: fix typo in link (in comment).
- contrithanks.sh: fix indent, drop stray `;` terminator.
- lib, src, tests: drop/fix a bunch of badwords.
- fix typos in comments.
- fix indent, stray spaces.

Some of these spotted by GitHub Code Quality and Copilot

Closes #22009
2026-06-14 20:10:28 +02:00
Viktor Szakats
fe2df80a5a
socket: use name sockerr for socket error variables
Also:
- add comment explaining a `sockerr = errno` (vs. `SOCKERRNO`)
  assigment.

Closes #21998
2026-06-14 14:17:07 +02:00
Viktor Szakats
7c51a33877
AmigaOS: fix build fallouts, re-add to CI
Fix build issues:
- src: adjust `toolx_ftruncate()`.
- libtests/cli_ftp_upload: make `struct timeval` initialization portable.
- libtests/lib1960: do unconst in local `inet_pton()` macro.
- tests/server/dnsd: make it stub instead of failing the build.
- tests/server: make them link AmiSSL for `SocketBase`.

Also:
- bump AmiSSL to the latest release.
- add download hash checks and toolchain cache.
- sync restored code with local updates made since last year.

It takes 30 seconds per job, 1 minute in total.

Thanks-to: Bebbo
Thanks-to: Darren Banfi
Ref: https://github.com/curl/curl/pull/21989#issuecomment-4691380623
Follow-up to 7a14898264 #17486

Closes #21993
2026-06-12 20:27:44 +02:00
Viktor Szakats
abdfa2baff
lib695, lib757: fix truncated newline in error messages
Closes #21980
2026-06-12 01:33:05 +02:00
Daniel Stenberg
c5b6b744ed
libtests: add and use tutil_throwaway_cb
This is an implementation of a CURLOPT_WRITEFUNCTION callback that just
throws away the content and returns success. Saves us from having to
reimplement it many times in different tests.

Closes #21971
2026-06-11 23:17:05 +02:00
Viktor Szakats
e35ba09f47
tidy-up: add spaces around equal operators where missing
Found via regex search: `=[^~>= ]`

Closes #21975
2026-06-11 19:52:01 +02:00
Viktor Szakats
2a606c68fa
tidy-up: miscellaneous
- GHA/windows: drop redundant double-quotes.
- CMake/PickyWarnings: improve/shorten comment.
- INTERNALS: fix typo in LibreSSL release date.
- drop redundant parentheses from single variables and sole `#if`
  expressions.
- cf-ip-happy: fix missing space from error string.
- telnet: fix parentheses in commented PP code.
- lib1922: fix typo test output text.
- smbserver: unfold lines.
- smbserver: use f-string.
- smbserver: initialize binary string as b``.
- fix typos in comments.

Closes #21972
2026-06-11 19:48:07 +02:00
Viktor Szakats
97aed9c960
tidy-up: drop stray comparisons with literal zero
Drop from:
- strcmp, strcmpi, strncmp, memcmp, lstat, getrlimit, setrlimit, fseek,
  fstat
- autotools detection snippets.
- smooth-gtk-thread: simplify `!var != 0` expression.

Closes #21947
2026-06-10 15:15:54 +02:00
Viktor Szakats
2f3fa479dd
build: enable -Wformat-signedness, fix issues found
Adjust code to avoid `-Wformat-signedness` warnings, while making sure
that enums are always cast to a known type when passing them to `printf`
functions, to support compilers and compiler settings where enums are
not default-size signed ints.

- cast integers printed as hex to `unsigned`. (63 times, 20 of them in
  `mbedtls.c`)
- cast misc enums to `int` for printing. (31 times)
- cast `CURL_LOCK_DATA_*` enums to `int`. (4 times)
- cast `CURL_FORMADD_*` enums to `int`. (13 times)
- cast `CURLSHE_*` enums to `int`. (3 times)
- cast `CURLUE_*` enums to `int`. (33 times)
- cast `CURLMSG_*` enums to `int`. (6 times)
- cast `CURLE_*` enums to `int`. (~380 times)
- unit1675: fix mask.
  Follow-up to 7c34365cce #21879

Ref: #18343 (initial attempt)

Closes #20848
2026-06-10 15:14:08 +02:00
Daniel Stenberg
5c6b488035
digest: flush state on origin or credential change
Verified by test 1686

Closes #21944
2026-06-10 13:20:03 +02:00
A Johnston
084ceb6601
hsts: duplicate live HSTS data in curl_easy_duphandle
Verified by test 1922

Closes #21809
2026-06-09 16:51:47 +02:00
Viktor Szakats
014be82a66
tidy-up: drop redundant == NULL syntax
Where missed by checksrc.

Closes #21935
2026-06-09 14:37:36 +02:00
Viktor Szakats
59213abfb2
tidy-up: drop redundant != NULL syntax
Where missed by checksrc.

Closes #21932
2026-06-09 14:37:36 +02:00
Viktor Szakats
847aac066d
tidy-up: use uppercase TRUE/FALSE where missing
Keep it only in external API calls and C++ code.

Also:
- curlx/fopen: replace with `!!`.

Spotted by GitHub Code Quality in cf-socket.c.

Closes #21925
2026-06-09 12:52:08 +02:00
Viktor Szakats
952b04474c
tidy-up: miscellaneous
- badwords: replace stray synonyms with 'null-terminator'.
- tests/FILEFORMAT.md: tidy up feature descriptions.
- printf: replace stray `%i` masks with `%d` for consistency.
- pytest: add comments for empty excepts to try silencing GitHub CodeQL
  warnings.
- tool1394, unit1675: merge nested `if`s.
- dnscache: fix typo in comment.
- fix whitespace, indent and newlines.

Closes #21921
2026-06-09 11:07:55 +02:00
Daniel Stenberg
04afd16076
urlapi: URL decode hostname before IP address normalization
With this, IPv6 addresses that end with '%25' with no following zone id are
considered invalid.

Extend test 1560 to verify

Reported-by: Hem Parekh
Closes #21918
2026-06-09 08:42:19 +02:00
Viktor Szakats
9c1ebea359
lib1587: drop redundant includes
Closes #21892
2026-06-08 00:42:51 +02:00
Stefan Eissing
fbcf10ab84
progress: fx CURLINFO time reporting
Whack the times reported for a transfer (see
https://curl.se/libcurl/c/curl_easy_getinfo.html#TIMES) into order for
all variations of up-/download, http/ftp etc. Make sure they are
reported in the documented order.

There is still the *possibility* of PRETRANSFER being longer then
POSTTRANSFER, if a server sends a response before an upload is done.
POST is the time the first response byte is received, and PRE is the
time the last byte was sent by curl.

This may happen with more likelihood on HTTP/2 and 3 for a server
rejected upload. But for successful uploads, the answer will almost over
come afterwards.

Undo the previous twists in lib500.c tests, adjust pytest timeline
checks.

Fixes #21828
Reported-by: BazaarAcc32 on github
Closes #21843
2026-06-07 14:39:10 +02:00
Viktor Szakats
d3e9a815c4
tidy-up: miscellaneous
- fix typos.
- badword: add two new words.
- cpp: drop parentheses from standalone `#if` expressions.
- libssh: vertical-align comment block with others.
- clang-format.

Closes #21880
2026-06-05 16:57:38 +02:00
Viktor Szakats
1b8f4dba28
tidy-up: drop stray casts for allocated pointers
Closes #21865
2026-06-05 12:24:01 +02:00
Viktor Szakats
89683e05b9
tidy-up: use test/example domains more
Closes #21849
2026-06-02 15:31:48 +02:00
Daniel Stenberg
9d19b47302
lib1560: verify a few more URL variations
Closes #21842
2026-06-02 11:31:46 +02:00
Viktor Szakats
28341c303d
lib505: tidy up slist pointer use
Bring code closer to `curl_slist_append()` man page and clarify variable
names.

Closes #21835
2026-06-01 23:36:04 +02:00
Viktor Szakats
4e98f6d225
units: drop redundant pointer check and workaround
All users of the `verify_memory()` macro used a fixed-length buffer for
the test output, which then needed a workaround to silence GCC
`-Waddress` warnings.

```
tests/unit/unit1615.c: In function 'test_unit1615':
tests/libtest/unitcheck.h:51:8: error: the address of 'output_buf' will always evaluate as 'true' [-Werror=address]
   51 |     if((dynamic) && memcmp(dynamic, check, len)) {                          \
      |        ^
tests/unit/unit1615.c:114:3: note: in expansion of macro 'verify_memory'
  114 |   verify_memory(output_buf, precomp_hash1, CURL_SHA512_256_DIGEST_LENGTH);
      |   ^~~~~~~~~~~~~
```

Drop redundant address check and the workarounds with it.

Closes #21833
2026-06-01 22:36:40 +02:00
Viktor Szakats
d229055549
tidy-up: miscellaneous
- drop more uses of the word "just". (not enforced here)
- drop some uses of the "will" word.
- "then" -> "than".
- tests/http/testenv/curl.py: fix copy-paste typo in error message.
- pytest: replace `shutdownh` with `shutdown` in test names.
  Spotted by GitHub Code Quality.
- comment typos.
- whitespace and newlines fixes.

Closes #21830
2026-06-01 22:33:57 +02:00
Daniel Stenberg
872c313d76
lib1560: drop unused variable 'url'
Spotted by Copilot

Closes #21821
2026-06-01 09:50:49 +02:00
Daniel Stenberg
1b6724882c
urlapi: accept 0X prefix in IPv4 address as well
Extend test 1560 accordingly

Closes #21820
2026-05-31 23:44:30 +02:00
tiymat
780ccb256e
urlapi: drop base fragment on empty redirect
Extended test 1560 to verify

Fixes #21745
Closes #21763
2026-05-31 23:36:16 +02:00
tiymat
f1959ae962
urlapi: fix an issue parsing file URLs
Fixes #21743
Closes #21764
2026-05-28 08:49:56 +02:00
Viktor Szakats
59320082b0
tidy-up: apply clang-format fixes
To lib, vtls/vauth, vtls/vquic, lib/vtls.

Also:
- unit3400: drop redundant `(void)arg`.
  Follow-up to e78b1b3ecc #21153
- fix comment typos.

Closes #21786
2026-05-28 00:05:47 +02:00
Viktor Szakats
15356f0d36
lib1560: fix to propagate failure from get_nothing()
Also:
- check `curl_url()` for NULL where missing.
- free memory `curl_url_get()` return pointer where missing.
- propagate `curl_url_set()` errors in `clear_url()`, where missing.
- add missing NULL-check before `strcmp()` in `clear_url()`.

Closes #21780
2026-05-27 23:26:20 +02:00
Viktor Szakats
7e1001bcd6
tidy-up: miscellaneous
- H3 proxy: re-sync code with original source `curl_ngtcp2.c` to reduce
  differences, and to apply missed minor fixes. Also apply clang-format.
  Drop redundant `#undef`s, casts, `#endif` comments, includes, drop
  intermediate variables, sync include and macro order.
  Follow-up to e78b1b3ecc #21153
- INSTALL-CMAKE.md: move `CURL_ENABLE_SMB` to the enable section.
- tests/http/env: rename `tcpdmp` to `tcpdump` to match object variable.
- mbedtls: drop incorrect `mbedTLS 4+` comments.
  (features are also supported by 3+, meaning it's always supported.)
- lib1648: rename a variable to match purpose.
- CIPHERS.md: alpha-sort link list.
- replace rare `X''` hex markup with `0x`.
- `IP v4/6` -> `IPv4/6`.
- 'version X.Y' -> 'vX.Y', where sensible.
- 'VX.Y' -> 'vX.Y', where sensible.
- fix indents, casing, newlines, typos.

Closes #21772
2026-05-27 16:53:57 +02:00
tiymat
a8e6f90a69
urlapi: forbid '|' in host
Closes #21762
2026-05-27 09:39:37 +02:00
Daniel Stenberg
862e8a74a8
transfer: clear referer when set to NULL
Verify in test 1649

Closes #21741
2026-05-26 10:04:40 +02:00
Daniel Stenberg
7e350dd147
urlapi: fix redirect handling if CURLU_NO_GUESS_SCHEME is set
Verified by test 1967

Reported-by: Joshua Rogers
Closes #21721
2026-05-22 07:48:20 +02:00
Viktor Szakats
bcd0497c81
tidy-up: use curlx_safefree()
Closes #21700
2026-05-21 01:31:03 +02:00