Commit graph

38362 commits

Author SHA1 Message Date
Stefan Eissing
7a22141de1
file: eliminate size_t cast
Use curlx_sztouz() instead.

Closes #19620
2025-11-20 22:36:47 +01:00
Daniel Stenberg
5f273fdddf
tool_urlglob: clean up used memory on errors better
Previously it had to realloc the pattern array to store the last entry
even when that last entry triggered an error and could be only half
filled in.

Also cleaned up for readability and better reallocs for sets.

Reported-by: letshack9707 on hackerone
Closes #19614
2025-11-20 22:34:34 +01:00
renovate[bot]
c5ef882e90
GHA: update actions/checkout action to v6 from v5
Closes #19628
2025-11-20 22:27:00 +01:00
Daniel Stenberg
92d9dbe4c0
INTERNALS: add release dates to the oldest supported dependencies
Closes #19611
2025-11-20 22:11:48 +01:00
Daniel Stenberg
01623e26d0
http: error on OOM when creating range header
Closes #19630
2025-11-20 22:11:03 +01:00
Stefan Eissing
ad9b12d411
httpsrr/altsvc: eliminate size_t casts
Treat alpn raw data as unsigned chars, avoids size_t and char* casts.
Add method to convert a struct Curl_str to an alpnid.

Closes #19621
2025-11-20 17:56:57 +01:00
Stefan Eissing
6c55dd0028
vquic: eliminate size_t casts
Use new curlx_sotouz_fits() instead.

Closes #19624
2025-11-20 17:53:36 +01:00
Stefan Eissing
d2ab42d786
cf-socket: elminiate size_t casts
Use curlx_sztouz() instead.

Closes #19617
2025-11-20 17:43:06 +01:00
Stefan Eissing
ffcf8c5ce4
rtmp: eliminate size_t casts
Use curlx_sztouz() instead.

Closes #19619
2025-11-20 17:41:42 +01:00
Stefan Eissing
b812be567a
mqtt: eliminate size_t cast
Use new curlx_sotouz_fits() instead.

Closes #19622
2025-11-20 17:39:39 +01:00
Stefan Eissing
d9e9dd7f20
h2-proxy: eliminate size_t cast
Use curlx_sztouz() instead.

Closes #19616
2025-11-20 17:25:52 +01:00
Viktor Szakats
7e8f36bf8e
cmake: honor CURL_DISABLE_INSTALL and CURL_ENABLE_EXPORT_TARGET in lib and src
Based on existing code and commit history it appears
`CURL_DISABLE_INSTALL` means to prevent calling `install()`;
`CURL_ENABLE_EXPORT_TARGET` means to prevent calling `export()` and
`install()`s with `EXPORT` in them.

Fix them to also apply to the lib and src directories in that vain:
- lib: honor `CURL_DISABLE_INSTALL`
- src: honor `CURL_DISABLE_INSTALL`
- src: honor `CURL_ENABLE_EXPORT_TARGET`

https://cmake.org/cmake/help/v4.2/command/install.html
https://cmake.org/cmake/help/v4.2/command/export.html

- `CURL_DISABLE_INSTALL` follow-up to:
  aace27b096 #12287
- `CURL_ENABLE_EXPORT_TARGET` follow-up to:
  8698825106 #9638
  643ec29645 #7060

Closes #19144
2025-11-20 00:23:08 +01:00
Viktor Szakats
3d80d37cf0
curlx: add and use curlx_freopen()
To complement the existing `curlx_fopen()` internal API.
It's used by the curl's `--stderr` option.

`curlx_freopen()` adds two features to the bare `freopen()`:
- tracing for debug-enabled builds.
- Unicode and long-filename support for Windows builds.

In effect this adds long-filename and enables Unicode support for
the `--stderr <filename>` curl command-line option on Windows.

Also add to checksrc.

Follow-up to 2f17a9b654 #10673

Closes #19598
2025-11-19 22:04:53 +01:00
Viktor Szakats
2decbb1c1f
runtests: add -m=seconds to override test curl command timeout
To override the curl default of 5 minutes (300000 ms).

Sometimes a simple test data change can result in a stuck test, this
option makes it exit with an error early. Possible future use in CI
or fast machines to prevent a single test taking 5 minutes and failing
the whole job.

Example hangers:

tests/data/test65:
```diff
-<data1000 crlf="yes">
+<data1000 crlf="headers">
```

tests/data/tests993:
```diff
-%repeat[1000 x 95 328485%0d%0a]%</data>
+%repeat[1000 x 95 328485%0d%0a]%
+</data>
```

Closes #19319
2025-11-19 22:04:52 +01:00
Christian Schmitz
991119051c
libssh2: add paths to error messages for quote commands
We really like to know what path curl parsed from our input.

Closes #19605
2025-11-19 16:25:07 +01:00
Stefan Eissing
17dc43ce6c
http: eliminate ssize_t
Use size_t to avoid conversions.

Closes #19610
2025-11-19 16:20:18 +01:00
Stefan Eissing
30afc66b88
gopher: convert ssize_t to size_t
Make type conversions unnecessary.

Closes #19608
2025-11-19 16:18:22 +01:00
Stefan Eissing
9fb843ac8f
ftp: use size_t instead of ssize_t
Make type conversions unnecessary.

Closes #19607
2025-11-19 16:16:20 +01:00
Viktor Szakats
47b8e1dbd3
tidy-up: move CURL_UNCONST() out from macro curl_unicodefree()
To stop applying it where not needed (most uses) and make it visible
where it's actually used (5 uses).

Follow-up to f4e23950c7 #16142

Closes #19606
2025-11-19 15:48:21 +01:00
Viktor Szakats
b0d23b901f
GHA: set --buildinfo for test-torture jobs
Only the `test-ci` build target sets `--buildinfo` automatically,
since 985f39c0ce. It needs to be set
manually for other targets used in CI, such as `test-torture`,
to enable the `buildinfo.txt` dump in the runtests step.

For Test Clutch. In an attempt to re-sync `targetarch` with the rest of
macOS jobs on the feature matrix page:
https://testclutch.curl.se/static/reports/feature-matrix.html
Before this patch and possibly since the breaking update It's `aarch64e`
for torture jobs and `aarch64` for the rest

(stricly speaking `aarch64e` is the correct value for all macOS jobs, but
autotools and cmake report arm64/aarch64 without the `e`.)

Regression from 985f39c0ce #18147

Closes #19601
2025-11-19 15:48:20 +01:00
Daniel Stenberg
b98e791e57
test777: simple ---ssl-sessions test with wrong sessions 2025-11-19 12:58:24 +01:00
Daniel Stenberg
abe6ea0531
curlinfo: add "ssl-sessions" as a feature to show
To allow tests depend on it
2025-11-19 12:58:24 +01:00
Daniel Stenberg
c255d2fdcb
tool_cfgable: free ssl-sessions at exit
Also free the memory correctly in tool_ssls_load

Closes #19602
2025-11-19 12:58:15 +01:00
Viktor Szakats
8bb8984e9d
curl_setup.h: document more funcs flagged by _CRT_SECURE_NO_WARNINGS
Based on these logs (non-Unicode, Unicode Schannel):
https://github.com/curl/curl/actions/runs/19446115443/job/55640968722?pr=19175
https://github.com/curl/curl/actions/runs/19446115443/job/55640968764?pr=19175

Follow-up to 5fa2d8320c #19175

Closes #19597
2025-11-19 01:48:20 +01:00
Viktor Szakats
7f3731ce14
tests/data: mark non-XML-compliant files as such, xmllint the rest in CI
There are 58 non-compliant files. Mark them with the `notxml` keyword.
Also include the compliant ones in the GHA/checksrc xmllint CI job.

Also:
- delete XML prolog from the 3 test data files that had them.
- FILEFORMAT.md: document the `notxml` keyword.
- FILEFORMAT.md: fix a typo.

Follow-up to de49cc89ab #19470
Follow-up to f3095f0dbd #19528
Follow-up to 87ba80a6df

Closes #19595
2025-11-19 00:02:45 +01:00
Viktor Szakats
36d0f12881
DISTROS.md: add OpenBSD
Closes #19596
2025-11-19 00:02:45 +01:00
Daniel Stenberg
318cd4f2ee
lib: error for OOM when extracting URL query
Closes #19594
2025-11-18 23:42:24 +01:00
Viktor Szakats
9726fc8259
test2405, 2407: mark tests based on lib2405 flaky
Flaky in macOS CI jobs.

2405:
https://github.com/curl/curl/actions/runs/19448567968/job/55648448197 CM gcc-13 aws-lc
https://github.com/curl/curl/actions/runs/19432797208/job/55595742192 AM clang !ssl
https://github.com/curl/curl/actions/runs/19431697816/job/55591941993 AM clang !ssl !debug brotli zstd
https://github.com/curl/curl/actions/runs/19421214342/job/55558775785 CM llvm@18 GnuTLS !ldap krb5 +examples
https://github.com/curl/curl/actions/runs/19413038235/job/55537174590 CM llvm@18 mbedTLS !ldap brotli zstd MultiSSL AppleIDN

2407:
https://github.com/curl/curl/actions/runs/19462732039/job/55691022408 AM clang !ssl
https://github.com/curl/curl/actions/runs/19440283144/job/55621665647 CM gcc-13 OpenSSL gsasl rtmp AppleIDN SecTrust +examples
https://github.com/curl/curl/actions/runs/19440283144/job/55621665682 AM gcc-13 !ssl !debug
https://github.com/curl/curl/actions/runs/19436530386/job/55608724437 CM gcc-13 aws-lc
https://github.com/curl/curl/actions/runs/19436530386/job/55608724641 CM llvm@18 GnuTLS !ldap krb5 +examples
https://github.com/curl/curl/actions/runs/19435651588/job/55605648449 CM llvm@18 OpenSSL gsasl rtmp AppleIDN SecTrust +examples

Ref: https://testclutch.curl.se/static/reports/results-count.html

Bug: https://github.com/curl/curl/pull/19487#issuecomment-3546858203
Bug: https://github.com/curl/curl/pull/19487#issuecomment-3546921877

Follow-up to 2c7e1792a0 #19487
Follow-up to 96a5ce5a82 #19481
Follow-up to c78044c07e #15146 #15155

Closes #19587
2025-11-18 21:27:44 +01:00
Viktor Szakats
de49cc89ab
tests/data: more XML-compliance via %LT and %GT macros in email addresses
Reduce number of files failing `xmllint --format` from 133 to 57 (-76)
(3% of 1894), by replacing `<` and `>` with new macro `%LT` and `%GT`,
in most places, which is in email addresses (192 lines).

Follow-up to a9ec2a676c #19491

Closes #19470
2025-11-18 18:57:53 +01:00
Daniel Stenberg
97169a91d9
hsts: propagate and error out correctly on OOM
Closes #19593
2025-11-18 16:40:32 +01:00
Daniel Stenberg
80005b4c8a
cookie: return error on OOM
Follow-up to 3f0629ca44
Closes #19591
2025-11-18 15:57:05 +01:00
Daniel Stenberg
6dac2631df
url: if OOM in parse_proxy() return error
Closes #19590
2025-11-18 14:54:16 +01:00
Daniel Stenberg
833efb437d
openssl: exit properly on OOM when getting certchain
Previously, a momentary OOM error in the middle could produce a broken
result instead of correctly returning error.

Closes #19471
2025-11-18 13:04:19 +01:00
Daniel Stenberg
88024c6d39
tool_getparam: verify that a file exists for some options
Passing the option as-is to libcurl is fine, but checking that the file
exists allows the tool to better provide a helpful message.

This now done for the following options:

  --cacert, --crlfile, --knownhosts, --netrc-file, --proxy-cacert amd
  --proxy-crlfile

Bonus: bail out properly on OOM errors in the --cert parser.

Reported-by: Wesley Moore
Fixes #19583
Closes #19585
2025-11-18 11:37:08 +01:00
Viktor Szakats
54a3f63520
GHA: reduce timeouts for Linux and macOS jobs
Also syncing the run tests timeout in GHA/linux with GHA/maos.

Closes #19582
2025-11-18 11:20:01 +01:00
Daniel Stenberg
1cbe510d8b
TEST-SUITE.md: correct the man page's path
Closes #19586
2025-11-18 11:02:17 +01:00
boingball
a41cea7d67
AmigaOS: increase minimum stack size for tool_main
In testing, the older stack size of 16384 was causing curl to crash on
heavy TLS loads

Closes #19578
2025-11-18 07:54:11 +01:00
Viktor Szakats
3c7cf8eac3
examples: tidy-up headers and includes
To have a more similar layout across examples.

Closes #19580
2025-11-18 02:05:07 +01:00
Viktor Szakats
0a2618b265
examples: make functions/data static where missing
Also to avoid compiler warnings on missing declarations.
Missed by CI for these "complicated" examples.

Closes #19579
2025-11-18 01:05:14 +01:00
Viktor Szakats
5fa2d8320c
build: tidy-up MSVC CRT warning suppression macros
- curl_setup.h: replace `_CRT_SECURE_NO_DEPRECATE` with
  `_CRT_SECURE_NO_WARNINGS`, which seems to be the preferred,
  more recent macro for this. Also syncing with libssh2.
  They are equivalent for curl sources with the supported compilers.
- cmake: stop setting `_CRT_SECURE_NO_DEPRECATE` globally for examples.
- examples: suppress CRT deprecation warnings on a per-file basis.
  To make it work when compiling examples out of curl's build systems.
  Use `_CRT_SECURE_NO_WARNINGS`.
- examples: document the functions requiring `_CRT_SECURE_NO_WARNINGS`.
- examples/block_ip: delete superfluous `_CRT_SECURE_NO_WARNINGS`.
- examples/block_ip: limit `_CRT_NONSTDC_NO_DEPRECATE` to MSVC.
- examples/log_failed_transfers: fix to set `_CRT_SECURE_NO_WARNINGS`
  before headers and limit to MSVC.
- curl_setup.h: document which SDKs support `_CRT_NONSTDC_NO_DEPRECATE`.

Closes #19175
2025-11-18 00:49:26 +01:00
Viktor Szakats
1e1ec7f6c2
badwords: add more contractions, fix fallouts
Also fix hits in autotools scripts (not to enforce).

Closes #19576
2025-11-17 19:29:15 +01:00
Viktor Szakats
ad35ecba97
badwords: fix issues found in scripts and other files
Single pass, not enforced.

Also:
- pyspelling.words: drop `web page`

Closes #19572
2025-11-17 17:18:07 +01:00
Viktor Szakats
42c43f695c
renovate.json: replace CI: prefix with GHA:
All bumped dependencies are in GHA.

Follow-up to 6225d7ba2f #19547
2025-11-17 16:50:20 +01:00
renovate[bot]
39320e1e1b
GHA: update dependencies
- github/codeql-action to 4.31.3
- google/boringssl to v0.20251110.0
- ruff to 0.14.5

Closes #19442
Closes #19455
2025-11-17 16:48:56 +01:00
Daniel Stenberg
b360fc62fb
http: avoid two strdup()s and do minor simplifications
Closes #19571
2025-11-17 16:43:01 +01:00
Viktor Szakats
142fd1cf32
appveyor: add VS2010 x86 Release VS project job and switch VS2013 to x64
To have a test case for VS2010 after bumping to minimum Vista.

Ref: #18009
Closes #19570
2025-11-17 15:50:24 +01:00
Stefan Eissing
ea105708c9
h2/h3: handle methods with spaces
The parsing of the HTTP/1.1 formatted request into the h2/h3 header
structures should detect CURLOPT_CUSTOMREQUEST methods and forward them
correctly.

Add test_01_20 to verify

Fixes #19543
Reported-by: Omdahake on github
Closes #19563
2025-11-17 15:43:28 +01:00
Daniel Stenberg
2459dc7a22
http: the :authority header should never contain user+password
Pointed-out-by: Stanislav Fort
Closes #19568
2025-11-17 15:19:39 +01:00
Viktor Szakats
4075339db2
projects/README.md: Markdown fixes
Closes #19569
2025-11-17 15:09:09 +01:00
x2018
821cba8fac
digest_sspi: fix a memory leak on error path
Closes #19567
2025-11-17 14:46:30 +01:00