Commit graph

36705 commits

Author SHA1 Message Date
Viktor Szakats
1021c52c92
REUSE: add copyright header to two files
`.mailmap` supports comments and empty lines since at least 2.31.0:
https://git-scm.com/docs/gitmailmap/2.31.0

Closes #19339
2025-11-03 16:08:52 +01:00
Viktor Szakats
254e04b702
ftpserver.pl: fix newlines in 227/229 replies, adjust tests
The test FTP server returned LF newlines for 227/229 replies, instead of
the CRLF used for the rest.

Test data added later were explicitly made to expect an LF in these
response lines.

After this patch the FTP server returns CRLF newlines, allowing
to delete this special case in test data.

Follow-up to 3bfff57e1f
Follow-up to a7937ed49c

Closes #19330
2025-11-03 12:19:03 +01:00
Viktor Szakats
aaf9522a2c
test696: decouple from test556 data
Test 696 and 556 share the same libtest code. Make sure to issue
the `GET` request to the correct runtime test number instead of using
the hard-wired "556".

It makes the `sws` test server read the response string from `test696`
`<data>` section, instead of reading it from `test556`. To avoid this
hidden interaction between test data.

AFAICS there is no other similar hard-coded string in reused libtests.

Ref: https://github.com/curl/curl/pull/19313#issuecomment-3477448933
Follow-up to be82a3605a #16003
Closes #19329
2025-11-03 12:19:03 +01:00
Daniel Stenberg
c1e3a760ba
imap: avoid integer overflow
Follow-up to e64c28e243

Spotted by OSS-Fuzz

Closes #19332
2025-11-03 08:54:51 +01:00
Daniel Stenberg
3060495830
RELEASE-NOTES: synced 2025-11-02 23:09:54 +01:00
x2018
c898da26c6
http_aws_sigv4: check the return value of curl_maprintf()
Closes #9328
2025-11-02 23:04:24 +01:00
Viktor Szakats
2ffa8307b5
GHA/dependabot: tidy-ups 2025-11-02 17:45:50 +01:00
dependabot[bot]
7203498c6a
GHA: bump the pip-dependencies group across 2 directories with 3 updates
Closes #19321
2025-11-02 17:10:39 +01:00
Viktor Szakats
428faf6d47
GHA/dependabot: fix update group names 2025-11-02 17:10:00 +01:00
Viktor Szakats
986ef77833
runtests: fix Perl warning after recent patch
```
Use of uninitialized value $hash{"crlf"} in string eq at tests/runtests.pl line 1406.
```

Follow-up to 6cf3d7b1b1 #19318
Closes #19327
2025-11-02 13:09:16 +01:00
Viktor Szakats
6cf3d7b1b1
tests: avoid more hard-coded CRLFs in protocol sections
- fix regex to not catch CR (from CRLF), in `PORT`, `EPRT`
  commands, allowing to use `crlf="yes"` more.
- add `crlf="headers"` mode for `protocol` sections.
  To call `subnewlines()` without its force option.
  This is the mode used in `data` sections when `crlf="yes"`.
  (This confusion may be subject to a future commit.)
- subnewlines: apply CRLF to `HEAD` and `CONNECT` HTTP requests.
- subnewlines: apply CRLF to RTSP requests.
- delete remaining empty `protocol` sections.

Reducing the number of `tests/data/test*`:
- CRLF newlines from 11325 to 10295. (119984 lines total)
- files with mixed newlines from 707 to 656. (1890 files total)

Follow-up to 4d2a05d3fe #19284

Closes #19318
2025-11-01 23:52:55 +01:00
x2018
e2a12fcbdb
vtls: properly handle SSL shutdown timeout
Closes #19323
2025-11-01 23:28:40 +01:00
x2018
f6bbc2b3be
doh: cleanup resources on error paths
Closes #19310
2025-11-01 23:14:33 +01:00
Daniel Stenberg
8d0bfe74fb
httpsrr: send HTTPS query to the right target
When the target host is on a different port than 443, the name
"_[port]._https.[name]" shall be used.

Fixes #19301
Reported-by: Gunni on github
Closes #19324
2025-11-01 23:13:30 +01:00
Viktor Szakats
6a97bc2c97
tests/data: delete stray CRLFs in markup lines
Closes #19317
2025-11-01 04:36:09 +01:00
Viktor Szakats
cf4a62725d
CI: two display name tweaks
- use `AM`/`CM` where missing.
  In GHA/linux-old and AppVeyor CI.
  To denote autotools and CMake, and to align with rest of the jobs.

- rename `Old Linux` to `Linux Old` to align with the rest of Linux
  jobs on GitHub web views sorted by name.

Closes #19316
2025-11-01 02:24:17 +01:00
Viktor Szakats
2e408aa5cc
tests: replace standalone significant tabs with macro
Follow-up to d29f14b9cf #19300

Closes #19315
2025-10-31 23:44:21 +01:00
Viktor Szakats
d2f0a0e796
tests/libtest: consistent variable naming for easy/multi/share handles
Follow-up to 928363f28c #19299

Closes #19311
2025-10-31 23:44:21 +01:00
Stefan Eissing
c35a87d776
scorecard: more params for upload tests
Add --upload-parallel=n for controlling upload parallelism. Make upload
processing similar to download processing.

Closes #19302
2025-10-31 23:27:59 +01:00
x2018
27f55383fb
schannel: properly close the certfile on error
Closes #19304
2025-10-31 23:27:06 +01:00
Daniel Stenberg
d4d7139e70
openssl: combine all the x509-store flags
... intead of overwriting the previous ones in ossl_populate_x509_store()

Pointed out by ZeroPath

Closes #19306
2025-10-31 23:24:38 +01:00
Stefan Eissing
b4630ed8fa
sectrust: fix verifystatus via sectrust
When openssl does not verify the certificate, but apple sectrust
does, we also pass it the ocsp stapled response when configured and
available.

When openssl does not verify the cert chain, it will also not be able
to verify the ocsp stapling. Do not call it if sectrust is the
verifier of the cert chain.

Fixes #19307
Reported-by: Harry Sintonen
Closes #19308
2025-10-31 23:10:35 +01:00
Daniel Stenberg
d646d5a130
openssl: fix the ocsp len arg to Curl_vtls_apple_verify
If it has no data, pass in a zero.

Fixes #19303
Reported-by: Harry Sintonen
Closes #19305
2025-10-31 23:09:05 +01:00
Viktor Szakats
9c0b239ec1
spelling: fix new finds by typos-cli 1.39.0
Closes #19312
2025-10-31 21:31:32 +01:00
Viktor Szakats
70f240b2ed
tests/libtest/cli*: fix init/deinit, leaks, and more
- add global init and deinit where missing.
- check global init success.
- improve cleaning up on error codepaths.
- drop `CLI_ERR()` macro, that could quit.
  Also make error messages tell the reason.

Closes #19309
2025-10-31 20:56:05 +01:00
Viktor Szakats
d29f14b9cf
tests: replace significant invisible spaces with macros
To make them explicit, visible, avoid being accidentally trimmed.
Also prevents Git warnings, e.g. on `git am`.

Also:
- runtests: add support for `%spc%` and `%tab%` macros.
- test59: delete non-significant line-ending space.
- spacecheck.pl: drop line-ending whitespace exception for tests.

Closes #19300
2025-10-31 17:15:33 +01:00
Daniel Stenberg
928363f28c
examples: consistent variable naming across examples
- 'CURL *' handles are called 'curl'
- 'CURLM *' handles are called 'multi'
- write callbacks are called 'write_cb'
- read callbacs are called 'read_cb'
- CURLcode variables are called 'res'

It makes the examples look and feel more consistent. It allows for
easier copy and pasting between examples.

Closes #19299
2025-10-31 16:44:57 +01:00
Daniel Stenberg
0313223853
RELEASE-NOTES: synced 2025-10-31 16:28:13 +01:00
Viktor Szakats
c887a3f2f2
BINDINGS.md: point flaky URL to archive.org
To avoid linkcheck CI fails. It was failing regularly in the last months.
2025-10-31 16:21:41 +01:00
Stefan Eissing
1e85cb4b7b
scp/sftp: fix disconnect
When a SCP/SFTP connection calls the protocol handler disconnect, it
required the connections *and* the easy handles SSH meta data to be
present. When the disconnect is called with an admin handle, the easy
meta data is not present, which prevented the shutdown to run.

The easy meta data is however not necessary to run the shutdown state
machine. Calling it with a NULL `sshp` is fine. To avoid any mixups,
check `sshp` in state operations that need it.

Fixes #19293
Reported-by: And-yW on github
Closes #19295
2025-10-31 15:56:58 +01:00
Viktor Szakats
26e3f00469
test446, 1034, 1160: set US-ASCII encoding in XML header
To match the ASCII-7 requirement for curl test data files.

Follow-up to 9243ed59b3 #17329
Follow-up to 87ba80a6df

Closes #19297
2025-10-31 15:01:08 +01:00
Viktor Szakats
2147de554d
test429: use %repeat[]%
Follow-up to eb22e37060 #19281
Follow-up to 55d4767876 #19279

Closes #19296
2025-10-31 15:01:08 +01:00
Viktor Szakats
4d2a05d3fe
tests: use crlf=yes attribute more
To make special newlines more explicit and visible.
Mostly in `<protocol>` sections, some in `<data*>` and `<upload>`.

Reducing the number of `tests/data/test*`:
- CRLF newlines from 21535 to 11337.
- files with mixed newlines from 1335 to 707.

Also delete empty `<protocol>` sections.

Closes #19284
2025-10-31 15:01:08 +01:00
Viktor Szakats
869143b194
examples: fix more potential resource leaks, and more
Also:
- delete dead code.
- sync `http2-download.c` and `http2-upload.c` sources.
- simplessl: fix constant expression.
- simplessl: avoid `expression is constant` VS2010 warning, drop pragma.
- replace large stack buffers with dynamic allocation.
- http2-download: fix to fill transfer number.

Some of these were pointed out by TIOBE scanner via Coverity 2025.3.0.

Closes #19292
2025-10-31 13:35:53 +01:00
Viktor Szakats
4b85e489a4
examples/http2-serverpush: fix file handle leaks
Also:
- tests/libtest/cli_h2_serverpush: re-sync formatting.

Previously fixed in tests based on a local clang-tidy v20 report.

Pointed out by TIOBE scanner via Coverity 2025.3.0.
Follow-up to 83a8818cfe #17706

Closes #19291
2025-10-31 13:14:12 +01:00
Viktor Szakats
5bf9445315
ftp: fix leaking internal buffer newhost on error
Pointed out by TIOBE scanner via Coverity 2025.3.0.

Closes #19290
2025-10-31 13:14:09 +01:00
Viktor Szakats
d2e8acfaa6
test1100: fix missing <protocol> section
To make it actually run. Also fix the NTLM expected result, also syncing
it with other tests.

Follow-up to e6b21d422e #6037

Closes #19288
2025-10-31 13:14:06 +01:00
Daniel Stenberg
1afc4bb768
tool/var: explain how the null termination byte is there
Closes #19287
2025-10-30 20:22:37 +01:00
Viktor Szakats
eb22e37060
tests: use %repeat[] to make tests smaller (cont.)
tests: 46, 265, 304, 316, 397, 443, 551, 552, 559, 651, 742, 775, 1003,
1005, 1006, 1008, 1062, 1070, 1086, 1112, 1151, 1160, 1178, 1192, 1193,
1205, 1237, 3207.

Total `test*` size reduction: 2,395,537 -> 2,165,631 bytes.

Follow-up to 55d4767876 #19279

Closes #19281
2025-10-30 16:52:26 +01:00
renovate[bot]
a83eae4d53
GHA: update libressl/portable to v4.2.1
Closes #19283
2025-10-30 16:21:52 +01:00
Daniel Stenberg
c5de083bcc
base64: make base64_encode() error on too long input
The maximum size is set to 16MB.

It should not possible to call this function with this large input, but
this is a precaution to catch mistakes and replaces the earlier check on
architectures with small size_t.

Closes #19280
2025-10-30 15:41:28 +01:00
Daniel Stenberg
80258309b2
lib: reduce memcpy calls
socks_gssapi: the malloc + memcpy was superflous and can be skipped

cleartext: avoid malloc + three memcpy with aprintf()

digest_sspi: use memdup0 instead of malloc + memcpy

vtls: use memdup0 instead of malloc + memcpy

Closes #19282
2025-10-30 15:40:21 +01:00
x2018
fbc4d59151
conncache: prevent integer overflow in maxconnects calculation
Closes #19271
2025-10-30 10:38:32 +01:00
Daniel Stenberg
c1f1b66d78
pop3: check for CAPA responses case insensitively
Reported by ZeroPath

Closes #19278
2025-10-30 10:34:08 +01:00
Daniel Stenberg
55d4767876
tests: use %repeat[] to make tests smaller
Avoid putting huge chunks of repeated texts in test cases.

test3206, test1060, test1061 and test22

Closes #19279
2025-10-30 09:48:41 +01:00
TheBitBrine
e64c28e243
imap: fix custom FETCH commands to handle literal responses
Custom IMAP commands using -X (e.g. 'FETCH 123 BODY[1]') were only
returning the first line of responses containing literals, instead of
the full multi-line body data.

The issue was that custom commands route through imap_perform_list()
and imap_state_listsearch_resp(), which didn't detect or handle IMAP
literal syntax {size}.

This commit adds literal detection to imap_state_listsearch_resp():
- Detects literal syntax {size} in untagged responses
- Writes the response header line containing the literal marker
- Handles any literal body data already in the pingpong buffer
- Sets up transfer layer to read remaining literal data from socket
- Configures maxdownload and transfer size to include header + body
- Initializes pp->overflow to 0 when no buffered data present
- Modifies imap_done() to transition to FETCH_FINAL for custom
  commands that set up downloads

Test 841 and 3206 verify.

Fixes #18847
Reported-by: BohwaZ
Bug: https://github.com/curl/curl/issues/18847
Closes #19246
2025-10-30 08:48:28 +01:00
Viktor Szakats
25aee8648a
http: fix -Wunused-variable in !alt-svc !proxy !ws builds
```
lib/http.c:2783:23: error: unused variable 'conn' [-Werror,-Wunused-variable]
 2783 |   struct connectdata *conn = data->conn;
      |                       ^~~~
1 error generated.
```

Closes #19276
2025-10-29 16:17:35 +01:00
Viktor Szakats
7973cb0b3e
http: fix -Wunreachable-code in !websockets !unity builds
Also requires non-unity build. Possibly more non-default options are
necessary to reproduce. Seen with llvm/clang.

```
lib/http.c:1856:15: error: code will never be executed [-Werror,-Wunreachable-code]
 1856 |     httpreq = HTTPREQ_GET;
      |               ^~~~~~~~~~~
1 error generated.
```

Closes #19275
2025-10-29 16:17:34 +01:00
Stefan Eissing
446dae5bfe
ngtcp2: overwrite rate-limits defaults
In pytests test_08 with the Caddy server, the new rate-limiting in
ngtcp2 did close the connection because it found "too many" stream data
packet repeats.

It is unclear if this is some Caddy issue or if the ngtcp2 implementaton
is wrong. Or if curl can do anything here.

Reported as https://github.com/ngtcp2/ngtcp2/issues/1850

This PR overwrites the ratelimit defaults in ngtcp2 with ten times
increased values. This makes the errors disappear on macOS.

Enable test_08_04/05 in CI again to see if there are any issues
to be found there. (We had those disabled before having parallel
pytests.)

Closes #19274
2025-10-29 13:34:27 +01:00
Daniel Stenberg
a97f9d41cc
openldap/ldap; check for binary attribute case insensitively
This bug was found with ZeroPath

Fixes #19240
Reported-by: Joshua Rogers
Closes #19273
2025-10-29 10:03:35 +01:00