Commit graph

13605 commits

Author SHA1 Message Date
Daniel Stenberg
693cd16793
http_proxy: a blank CURLOPT_USERAGENT should not be used in CONNECT
Extended test 80 to verify this.

Reported-by: Stefan Eissing
Fixes #12680
Closes #12681
2024-01-11 08:49:21 +01:00
Daniel Stenberg
dd0f680fc0
sectransp: do verify_cert without memdup for blobs
Since the information is then already stored in memory, this can avoid
an extra set of malloc + free calls.

Closes #12679
2024-01-10 23:22:52 +01:00
Daniel Stenberg
24ae4a07f3
hsts: remove assert for zero length domain
A zero length domain can happen if the HSTS parser is given invalid
input data which is not unheard of and is done by the fuzzer.

Follow-up from cfe7902111

Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65661

Closes #12676
2024-01-10 13:58:14 +01:00
Daniel Stenberg
a9e128d569
headers: make sure the trailing newline is not stored
extended test1940 to verify blank header fields too

Bug: https://curl.se/mail/lib-2024-01/0019.html
Reported-by: Dmitry Karpov
Closes #12675
2024-01-10 13:57:08 +01:00
Stefan Eissing
48d86999af
multi: pollset adjust, init with FIRSTSOCKET during connect
- `conn->sockfd` is set by `Curl_setup_transfer()`, but that
  is called *after* the connection has been established
- use `conn->sock[FIRSTSOCKET]` instead

Follow-up to a0f94800d5
Closes #12664
2024-01-09 17:41:13 +01:00
Daniel Stenberg
ac4dbc9cb5
setopt: use memdup0 when cloning COPYPOSTFIELDS
Closes #12651
2024-01-09 09:23:15 +01:00
Daniel Stenberg
2959f45b7d
telnet: use dynbuf instad of malloc for escape buffer
Previously, send_telnet_data() would malloc + free a buffer every time
for escaping IAC codes. Now, it reuses a dynbuf for this purpose.

Closes #12652
2024-01-09 09:21:01 +01:00
Daniel Stenberg
a3abc81a48
pop3: replace calloc + memcpy with memdup0
... and make sure to return error on out of memory.

Closes #12650
2024-01-08 22:55:39 +01:00
Daniel Stenberg
cfe7902111
lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
Closes #12658
2024-01-08 22:48:24 +01:00
Daniel Stenberg
8e0323b4b5
mime: use memdup0 instead of malloc + memcpy
Closes #12649
2024-01-08 22:40:43 +01:00
Stefan Eissing
d0cb2c7a1f
url: init conn->sockfd and writesockfd to CURL_SOCKET_BAD
Also add more tracing to test 19

Follow-up to a0f9480

Fixes #12657
Closes #12659
2024-01-08 16:51:13 +01:00
Daniel Stenberg
e556470c23
connect: remove margin from eyeballer alloc
Presumably leftovers from debugging

Closes #12647
2024-01-08 09:30:45 +01:00
Daniel Stenberg
1058483615
ftp: only consider entry path if it has a length
Follow-up from 8edcfedc1a

Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65631

Avoids a NULL pointer deref.

Closes #12648
2024-01-07 16:34:55 +01:00
Stefan Eissing
a0f94800d5
transfer: adjust_pollset improvements
- let `multi_getsock()` initialize the pollset in what the
  transfer state requires in regards to SEND/RECV
- change connection filters `adjust_pollset()` implementation
  to react on the presence of POLLIN/-OUT in the pollset and
  no longer check CURL_WANT_SEND/CURL_WANT_RECV
- cf-socket will no longer add POLLIN on its own
- http2 and http/3 filters will only do adjustments if the
  passed pollset wants to POLLIN/OUT for the transfer on
  the socket. This is similar to the HTTP/2 proxy filter
  and works in stacked filters.

Closes #12640
2024-01-07 14:36:25 +01:00
Daniel Stenberg
8edcfedc1a
ftp: use memdup0 to store the OS from a SYST 215 response
avoid malloc + direct buffer fiddle

Closes #12639
2024-01-06 11:26:31 +01:00
Daniel Stenberg
f4beef524a
ftp: use dynbuf to store entrypath
avoid direct malloc

Closes #12638
2024-01-06 11:25:37 +01:00
Lealem Amedie
afdb6c2d34
wolfssl: load certificate *chain* for PEM client certs
Closes #12634
2024-01-06 11:24:11 +01:00
Stefan Eissing
8e2d7b9fa4
http: adjust_pollset fix
do not add a socket for POLLIN when the transfer does not want to send
(for example is paused).

Follow-up to 47f5b1a

Reported-by: bubbleguuum on github
Fixes #12632
Closes #12633
2024-01-04 15:45:22 +01:00
Stefan Eissing
f712af2891
http3/quiche: fix result code on a stream reset
- fixes pytest failures in test 07_22
- aligns CURLcode values on stream reset with ngtcp2

Closes #12629
2024-01-03 13:10:21 +01:00
Daniel Stenberg
eeda18b1d2
setopt: clear mimepost when formp is freed
A precaution to avoid a possibly dangling pointer left behind.

Reported-by: Thomas Ferguson
Fixes #12608
Closes #12621
2024-01-02 23:32:43 +01:00
Gisle Vanem
8558647613
content_encoding: change return code to typedef'ed enum
... to work around a clang ubsan warning.

Fixes #12618
Closes #12622
2024-01-02 23:28:17 +01:00
Viktor Szakats
aff26089e8
schannel: fix -Warith-conversion gcc 13 warning
```
lib/vtls/schannel.c:1201:22: warning: conversion to 'unsigned int' from 'int' may change the sign of the result [-Warith-conversion]
 1201 |     *extension_len = *list_len +
      |                      ^
```

Closes #12616
2024-01-02 07:50:47 +00:00
Viktor Szakats
f0ea11b50b
asyn-thread: silence -Wcast-align warning for Windows
Seen with llvm/clang 17:
```
lib/asyn-thread.c:310:5: warning: cast from 'PCHAR' (aka 'char *') to 'struct thread_sync_data *' increases required alignment from 1 to 8 [-Wcast-align]
  310 |     CONTAINING_RECORD(overlapped, struct thread_sync_data, w8.overlapped);
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.../llvm-mingw/aarch64-w64-mingw32/include/winnt.h:717:48: note: expanded from macro 'CONTAINING_RECORD'
  717 | #define CONTAINING_RECORD(address,type,field) ((type *)((PCHAR)(address) - (ULONG_PTR)(&((type *)0)->field)))
      |                                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```

Follow-up to a6bbc87f9e #12482

Ref: https://github.com/curl/curl/pull/12482#issuecomment-1873017261
Closes #12615
2024-01-02 07:50:46 +00:00
Jay Satiro
b83729a339 quiche: return CURLE_HTTP3 on send to invalid stream
Prior to this change if a send failed on a stream in an invalid state
(according to quiche) and not marked as closed (according to libcurl)
then the send function would return CURLE_SEND_ERROR.

We already have similar code for ngtcp2 to return CURLE_HTTP3 in this
case.

Caught by test test_07_upload.py: test_07_22_upload_parallel_fail.

Fixes https://github.com/curl/curl/issues/12590
Closes https://github.com/curl/curl/pull/12597
2024-01-02 00:54:15 -05:00
Patrick Monnerat
4b6d44f6e9
openldap: fix STARTTLS
It was not working anymore since introduction of connection filters.

Also do not attempt to recover from a failing TLS negotiation with
CURLUSESSL_TRY.

Closes #12610
2023-12-31 17:11:51 +01:00
Jay Satiro
26f002e02e system_win32: fix a function pointer assignment warning
- Use CURLX_FUNCTION_CAST to suppress a function pointer assignment
  warning.

a6bbc87f added lookups of some Windows API functions and then cast them
like `*(FARPROC*)&Curl_funcname = address`. Some versions of gcc warn
about that as breaking strict-aliasing rules so this PR changes those
assignments to use CURLX_FUNCTION_CAST.

Bug: https://github.com/curl/curl/pull/12581#issuecomment-1869804317
Reported-by: Marcel Raad

Closes https://github.com/curl/curl/pull/12602
2023-12-28 03:38:44 -05:00
Jay Satiro
e251e858b9 vtls: fix missing multissl version info
- Fix erroneous buffer copy logic from ff74cef5.

Prior to this change the MultiSSL version info returned to the user
was empty.

Closes https://github.com/curl/curl/pull/12599
2023-12-27 17:49:27 -05:00
Patrick Monnerat
fa6e123929
openldap: fix an LDAP crash
Reported-by: Ozan Cansel
Fixes #12593
Closes #12600
2023-12-27 14:42:32 +01:00
Daniel Stenberg
68f96fc9bf
getinfo: CURLINFO_QUEUE_TIME_T
Returns the time, in microseconds, during which this transfer was held
in a waiting queue before it started "for real". A transfer might be put
in a queue if after getting started, it cannot create a new connection
etc due to set conditions and limits imposed by the application.

Ref: #12293
Closes #12368
2023-12-27 09:28:48 +01:00
Stefan Eissing
e492c7c524
transfer: fix upload rate limiting, add test cases
- add test cases for rate limiting uploads for all
  http versions
- fix transfer loop handling of limits. Signal a re-receive
  attempt only on exhausting maxloops without an EAGAIN
- fix `data->state.selectbits` forcing re-receive to also
  set re-sending when transfer is doing this.

Reported-by: Karthikdasari0423 on github
Fixes #12559
Closes #12586
2023-12-22 16:52:02 +01:00
Daniel Stenberg
8b1d229835
mbedtls: free the entropy when threaded
The entropy_free was never done for threaded builds, causing a small
(fixed) memory leak.

Reported-by: RevaliQaQ on github
Fixes #12584
Closes #12585
2023-12-22 10:58:07 +01:00
Stefan Eissing
35380273b9
http2: improved on_stream_close/data_done handling
- there seems to be a code path that cleans up easy handles without
  triggering DONE or DETACH events to the connection filters. This
  would explain wh nghttp2 still holds stream user data
- add GOOD check to easy handle used in on_close_callback to
  prevent crashes, ASSERTs in debug builds.
- NULL the stream user data early before submitting RST
- add checks in on_stream_close() to identify UNGOOD easy handles

Reported-by: Hans-Christian Egtvedt
Fixes #10936
Closes #12562
2023-12-22 10:06:01 +01:00
Daniel Stenberg
ef2cf58c77
mprintf: overhaul and bugfixes
In a test case using lots of snprintf() calls using many commonly used
%-codes per call, this version is around 30% faster than previous
version.

It also fixes the #12561 bug which made it not behave correctly when
given unknown %-sequences. Fixing that flaw required a different take on
the problem, which resulted in the new two-arrays model.

lib557: extended - Verify the #12561 fix and test more printf features

unit1398: fix test: It used a <num>$ only for one argument, which is not
supported.

Fixes #12561
Closes #12563
2023-12-22 09:51:57 +01:00
Pavel P
a6bbc87f9e
asyn-thread: use GetAddrInfoExW on >= Windows 8
For doing async DNS resolution instead of starting a thread for each
request.

Fixes #12481
Closes #12482
2023-12-21 23:25:45 +01:00
Daniel Stenberg
a719be81e9
strerror: repair get_winsock_error()
It would try to read longer than the provided string and crash.

Follow-up to ff74cef5d4
Reported-by: calvin2021y on github
Fixes #12578
Closes #12579
2023-12-21 23:17:15 +01:00
ivanfywang
98794c56af
ngtcp2: put h3 at the front of alpn
Closes #12576
2023-12-21 15:28:40 +01:00
zengwei2000
8d23a40ba6
altsvc: free 'as' when returning error
Closes #12570

Signed-off-by: zengwei <zengwei1@uniontech.com>
2023-12-21 09:15:19 +01:00
Viktor Szakats
2dbe75bd7f
build: fix some -Wsign-conversion/-Warith-conversion warnings
- enable `-Wsign-conversion` warnings, but also setting them to not
  raise errors.
- fix `-Warith-conversion` warnings seen in CI.
  These are triggered by `-Wsign-converion` and causing errors unless
  explicitly silenced. It makes more sense to fix them, there just a few
  of them.
- fix some `-Wsign-conversion` warnings.
- hide `-Wsign-conversion` warnings with a `#pragma`.
- add macro `CURL_WARN_SIGN_CONVERSION` to unhide them on a per-build
  basis.
- update a CI job to unhide them with the above macro:
  https://github.com/curl/curl/actions/workflows/linux.yml -> OpenSSL -O3

Closes #12492
2023-12-19 12:45:28 +00:00
Daniel Stenberg
dd29622f32
CURLOPT_SERVER_RESPONSE_TIMEOUT_MS: add
Proposed-by: Yifei Kong
Ref: https://curl.se/mail/lib-2023-11/0023.html
Closes #12369
2023-12-18 23:09:30 +01:00
Viktor Szakats
0923012758
build: more -Wformat fixes
- memdebug: update to not trigger `-Wformat-nonliteral` warnings.
- imap: mark `imap_sendf()` with  `CURL_PRINTF()`.
- tool_msgs: mark static function with `CURL_PRINTF()`.

Follow-up to 3829759bd0 #12489

Closes #12540
2023-12-18 14:56:57 +00:00
Viktor Szakats
03e7dff8ff
windows: delete redundant headers
`winsock2.h` pulls in `windows.h`. `ws2tcpip.h` pulls in `winsock2.h`.
`winsock2.h` and `ws2tcpip.h` are also pulled by `curl/curl.h`.

Keep only those headers that are not already included, or the code under
it uses something from that specific header.

Closes #12539
2023-12-18 14:56:57 +00:00
Daniel Stenberg
f58e493e44
curl.h: add CURLE_TOO_LARGE
A new error code to be used when an internal field grows too large, like
when a dynbuf reaches its maximum. Previously it would return
CURLE_OUT_OF_MEMORY for this, which is highly misleading.

Ref: #12268
Closes #12269
2023-12-18 10:34:22 +01:00
Viktor Szakats
15b09d9343
ssh: fix namespace of two local macros
Avoid using the libssh and libssh2 macro namespaces by prefixing
these local macro names with `CURL_`.

Follow-up to 413a0fedd0 #12346

Reviewed-by: Daniel Stenberg
Closes #12544
2023-12-17 14:58:22 +00:00
Baruch Siach
af520ac9fe
gnutls: fix build with --disable-verbose
infof() parameters must be defined event with --disable-verbose since
commit dac293cfb7 ("lib: apache style infof and trace
macros/functions").

Move also 'ptr' definition under !CURL_DISABLE_VERBOSE_STRINGS.

Fixes the following build failure:

In file included from ../lib/sendf.h:29,
                 from vtls/gtls.c:44:
vtls/gtls.c: In function 'Curl_gtls_verifyserver':
vtls/gtls.c:841:34: error: 'version' undeclared (first use in this function); did you mean 'session'?
  841 |         gnutls_protocol_get_name(version), ptr);
      |                                  ^~~~~~~

Closes #12505
2023-12-16 22:06:21 +01:00
Viktor Szakats
423645a1ef
build: delete unused HAVE_{GSSHEIMDAL,GSSMIT,HEIMDAL}
Stop setting `HAVE_GSSHEIMDAL`, `HAVE_GSSMIT` and `HAVE_HEIMDAL`.
There was no place in the build system or source code that used them.

Reviewed-by: Daniel Stenberg
Closes #12506
2023-12-16 13:16:52 +00:00
Viktor Szakats
c1bc090d65
windows: simplify detecting and using system headers
- autotools, cmake: assume that if we detect Windows, `windows.h`,
  `winsock2.h` and `ws2tcpip.h` do exist.
- lib: fix 3 outlier `#if` conditions to use `USE_WINSOCK` instead of
  looking for `winsock2.h`.
- autotools: merge 3 Windows check methods into one.
- move Watt-32 and lwIP socket support to `setup-win32.h` from
  `config-win32.h`. It opens up using these with all build tools. Also
  merge logic with Windows Sockets.
- fix to assume Windows sockets with the mingw32ce toolchain.
  Follow-up to: 2748c64d60
- cmake: delete unused variable `signature_call_conv` since
  eb33ccd533.
- autotools: simplify `CURL_CHECK_WIN32_LARGEFILE` detection.
- examples/externalsocket: fix header order.
- cmake/OtherTests.cmake: delete Windows-specific `_source_epilogue`
  that wasn't used anymore.
- cmake/OtherTests.cmake: set `WIN32_LEAN_AND_MEAN` for test
  `SIZEOF_STRUCT_SOCKADDR_STORAGE`.

After this patch curl universally uses `_WIN32` to guard
Windows-specific logic. It guards Windows Sockets-specific logic with
`USE_WINSOCK` (this might need further work).

Reviewed-by: Jay Satiro
Closes #12495
2023-12-16 13:13:44 +00:00
Viktor Szakats
3829759bd0
build: enable missing OpenSSF-recommended warnings, with fixes
https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
as of 2023-11-29 [1].

Enable new recommended warnings (except `-Wsign-conversion`):

- enable `-Wformat=2` for clang (in both cmake and autotools).
- add `CURL_PRINTF()` internal attribute and mark functions accepting
  printf arguments with it. This is a copy of existing
  `CURL_TEMP_PRINTF()` but using `__printf__` to make it compatible
  with redefinting the `printf` symbol:
  https://gcc.gnu.org/onlinedocs/gcc-3.0.4/gcc_5.html#SEC94
- fix `CURL_PRINTF()` and existing `CURL_TEMP_PRINTF()` for
  mingw-w64 and enable it on this platform.
- enable `-Wimplicit-fallthrough`.
- enable `-Wtrampolines`.
- add `-Wsign-conversion` commented with a FIXME.
- cmake: enable `-pedantic-errors` the way we do it with autotools.
  Follow-up to d5c0351055 #2747
- lib/curl_trc.h: use `CURL_FORMAT()`, this also fixes it to enable format
  checks. Previously it was always disabled due to the internal `printf`
  macro.

Fix them:

- fix bug where an `set_ipv6_v6only()` call was missed in builds with
  `--disable-verbose` / `CURL_DISABLE_VERBOSE_STRINGS=ON`.
- add internal `FALLTHROUGH()` macro.
- replace obsolete fall-through comments with `FALLTHROUGH()`.
- fix fallthrough markups: Delete redundant ones (showing up as
  warnings in most cases). Add missing ones. Fix indentation.
- silence `-Wformat-nonliteral` warnings with llvm/clang.
- fix one `-Wformat-nonliteral` warning.
- fix new `-Wformat` and `-Wformat-security` warnings.
- fix `CURL_FORMAT_SOCKET_T` value for mingw-w64. Also move its
  definition to `lib/curl_setup.h` allowing use in `tests/server`.
- lib: fix two wrongly passed string arguments in log outputs.
  Co-authored-by: Jay Satiro
- fix new `-Wformat` warnings on mingw-w64.

[1] 56c0fde389/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C%2B%2B.md

Closes #12489
2023-12-16 13:12:37 +00:00
Viktor Szakats
ba8752e556
Makefile.mk: drop Windows support
And DLL-support with it. This leaves `Makefile.mk` for MS-DOS and Amiga.

We recommend CMake instead. With unity mode it's much faster, and about
the same without.

Ref: https://github.com/curl/curl/pull/12221#issuecomment-1783761806
Reviewed-by: Daniel Stenberg
Closes #12224
2023-12-16 13:12:22 +00:00
Tatsuhiko Miyagawa
1e9db6997a
http: fix off-by-one error in request method length check
It should allow one more byte.

Closes #12534
2023-12-16 13:20:09 +01:00
Daniel Stenberg
907eea0804
Revert "urldata: move async resolver state from easy handle to connectdata"
This reverts commit 56a4db2e4e (#12198)

We want the c-ares channel to be held in the easy handle, not per
connection - for performance.

Closes #12524
2023-12-15 12:57:35 +01:00