Commit graph

36830 commits

Author SHA1 Message Date
Daniel Stenberg
97b0abb46b
noproxy: replace atoi with curlx_str_number
To better reject junk and detect overflows. There were already
additional precautions and protections in place, but this is cleaner.

Extended the 1614 unit tests with some more bad syntax cases.

Closes #19475
2025-11-12 10:30:59 +01:00
Daniel Stenberg
207721165e
src/checksrc: ban atoi use 2025-11-12 10:27:54 +01:00
Daniel Stenberg
4bb6a5d50f
tool_operate: use curlx_str_number intead of atoi
For consistency. This instance is for debug-only code and is not
important.

Closes #19480
2025-11-12 10:27:48 +01:00
Viktor Szakats
4841e4290d
badwords: re-sync with curl-www, fix issues found
Also:
- replace `manpage` with `man page`, add to `badwords.txt`.
- badwords.pl: import `-w` feature from curl-www, syncing the two
  scripts fully.
- badwords.txt: import missing items from curl-www, syncing the two
  files fully.
- pyspelling.words: drop `cURL` allowed word.

Closes #19468
2025-11-12 00:53:44 +01:00
Viktor Szakats
ebc5fea64d
autotools: drop autoconf <2.59 compatibility code (zz60-xc-ovr)
The minimum required autoconf is 2.59, since curl 7.76.0 (2021).

Follow-up to a59f046116 #6748

Closes #19464
2025-11-12 00:53:44 +01:00
Viktor Szakats
d499aa5238
mk-ca-bundle.pl: use open() with argument list to replace backticks
On Windows this requires Perl 5.22 from year 2015.

Also:
- mdlinkcheck: delete redundant error handling logic.
  Follow-up to 77be4a7ab2 #19437

Closes #19461
2025-11-12 00:53:43 +01:00
Dan Fandrich
f544eb97da docs: Line endings are no longer significant in test files
Since commit f477f3efc, CR/LF characters in test files are no longer
significant, making the files a little more XML-like.

Closes #19469
2025-11-11 10:07:41 -08:00
Daniel Stenberg
f1f5cc781c
cf-socket: split out the MTU and GRO setopts into sep functions
It simplifies the #ifdefs and declaring of local variables slightly.

Closes #19467
2025-11-11 17:57:40 +01:00
Daniel Stenberg
8c9946d35f
ccsidcurl: make curl_mime_data_ccsid() use the converted size
dynconvert() now offers to return the size of the converted data as it
might be different that the provided input size.

Bonus: minor indent fixing of some closing braces.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19465
2025-11-11 17:36:13 +01:00
Daniel Stenberg
3d9f7b436c
noproxy: simplify Curl_check_noproxy
By creating two separate matching functions for name and IP.

Closes #19466
2025-11-11 16:43:41 +01:00
Daniel Stenberg
6ca1d05797
ftp: remove #ifdef for define that is always defined
The CURL_FTP_HTTPSTYLE_HEAD logic was added back in 2007 with the
intention to remove that logic one day, but since we never bump the
SONAME it is not likely to happen anytime soon. Remove again for
readability.

Follow-up to 3217809294

Closes #19463
2025-11-11 16:27:19 +01:00
Daniel Stenberg
5bd670c393
wolfssl: avoid NULL dereference in OOM situation
Verify that wolfSSL_BIO_meth_new() actually works and handle situations
where it returns NULL.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19459
2025-11-11 16:23:27 +01:00
Daniel Stenberg
28380bb9fd
progress: show fewer digits
Without unit, show up to 99999 "raw" (5 digits). After that, prefer to
show the number as less than 1000 per unit and use single decimal
fraction. Like '123.4M' (spending 6 characters).

This now makes the largest possible size to show 8.0E (exabytes).

Probably makes the output easier to read.

Fixes #19431
Reported-by: Fd929c2CE5fA on github
Closes #19433
2025-11-11 16:22:34 +01:00
x2018
0dacc07969
cf-https-connect: allocate ctx at first in cf_hc_create()
Closes #19454
2025-11-11 16:18:55 +01:00
x2018
10b2dd8e6b
krb5_sspi: unify a part of error handling
Closes #19452
2025-11-11 16:17:53 +01:00
x2018
3f1a8dbb98
rustls: fix a potential memory issue
Closes #19425
2025-11-11 16:16:23 +01:00
Daniel Stenberg
c545e10fa7
sftp: fix range downloads in both SSH backends
When asking for the last N bytes of a file, and that size was larger
than the file size, it would miss the first byte due to a logic error.

The fixed range parser is now made a common function in the file now
renamed to vssh.c (from curl_path.c) - used by both backends.

Unit test 2605 verifies the parser.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19460
2025-11-11 14:51:22 +01:00
Viktor Szakats
67ef4a34f2
GHA/linux: build and enable nghttp2 for Fil-C job
pytests after: 527 passed, 286 skipped
pytests before: 392 passed, 423 skipped

runtests after: TESTDONE: 1646 tests out of 1646 reported OK: 100%
runtests before: TESTDONE: 1643 tests out of 1643 reported OK: 100%

Ref: b81d30ade3 #19458

Closes #19457
2025-11-11 00:15:47 +01:00
Viktor Szakats
b81d30ade3
pytest: fix conditions for test_02_28
- allow 02_28 to run in HTTP/1.1 without H2 support again.
  Follow-up to 3752de465d #19412

- fix to skip 02_28 for all protocols for curl without compression
  support (either zlib, brotli or ztsd).

Closes #19458
2025-11-10 23:30:20 +01:00
Viktor Szakats
cdb7ac11b4
GHA/linux: disable test 776 in valgrind jobs to avoid delay
Saving ~30 seconds in jobs affected.

Closes #19456
2025-11-10 23:14:01 +01:00
Viktor Szakats
af5a1647af
OS400/makefile.sh: fix shellcheck warning SC2038
Also:
- OS400/makefile.sh: use end-of-options marker in xargs command.
- OS400/make-tests.sh: drop warning suppression.
  Seems to not trigger anymore as of shellcheck 0.11.0

Closes #19451
2025-11-10 18:52:29 +01:00
Viktor Szakats
6aab1dc263
scripts: use end-of-options marker in find -exec commands
Closes #19450
2025-11-10 18:52:29 +01:00
Viktor Szakats
a8e46c5ab1
verify-release: update to avoid shellcheck warning SC2034
```
SC2034: dl appears unused
```

Also to shorten the code.

Closes #19449
2025-11-10 16:06:48 +01:00
Viktor Szakats
77be4a7ab2
mdlinkcheck: pass curl arguments to open() as list
To prevent misinterpreting quotes or other special characters.

Requires Perl 5.22+ (2015-Jun-01) on Windows.

Ref: https://perldoc.perl.org/functions/open

Closes #19437
2025-11-10 14:21:35 +01:00
Viktor Szakats
b39c158e4a
scripts: fix shellcheck SC2046 warnings
Fix SC2046: "Quote this to prevent word splitting."
Ref: https://www.shellcheck.net/wiki/SC2046

Also:
- shellcheck.sh: add `set -eu`.
- shellcheck.sh, yamlcheck.sh: always run from repo root.
- pass `--` before passing the list of files, where missing.
- badwords.pl, cleancmd.pl: rework to accept `git ls-files` arguments.
  Requires Perl 5.22+ (2015-Jun-01) on Windows.
  Ref: https://perldoc.perl.org/functions/open
- INTERNALS.md: require Perl 5.22 on Windows.
- spacecheck.pl: formatting.
- GHA/http3-linux: rework command to avoid SC2046.
- stop suppressing SC2046 warnings.

The yamlcheck.sh issue reported-by: Stanislav Fort (Aisle Research)
Ref: 20251109163515_6eb31da3-deb2-4f4d-8327-935904f27da5

Closes #19432
2025-11-10 14:21:35 +01:00
Viktor Szakats
f477f3efc3
tests/data: support using native newlines on disk, drop .gitattributes
Data files no longer depend on mixed newline styles. Before this
patch the harness still assumed data files to use LF newlines,
ensured by `.gitattribute` and distributing sources with LF newlines.

To allow using platform native newlines (CRLF on Windows typically),
update the test harness to support data files with any newline style
on disk. And delete `.gitattributes`.

Fix to:
- load original data files (from test/data) so that their newline-style
  doesn't matter on the checked out source repo, meaning it works
  when its CRLF on Windows, just like any other file.
  (if a BOM slips in, it's caught by `spacecheck.pl` as binary content.)
- do the same in `util.py` used by `smbserver.py` (for test 1451).
- also fix `util.py` to use us-ascii encoding for data files, replacing utf-8.

Also:
- runtests: rework the stray CR checker to allow full CRLF data files,
  and keep warning for mixed newlines.

Follow-up to 904e7ecb66 #19347

Closes #19398
2025-11-10 14:21:34 +01:00
Daniel Stenberg
8e321a53df
examples/crawler: fix variable
A variable missed in the previous rename cleanup

Follow-up to 928363f28c
Reported-by: Gisle Vanem
Closes #19446
2025-11-10 13:40:13 +01:00
Daniel Stenberg
7e87255020
socks_sspi: use free() not FreeContextBuffer()
The memory is allocated with malloc().

This reverts commit 1d01d4975f.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19445
2025-11-10 13:39:22 +01:00
Daniel Stenberg
37050a1462
OS400/ccsidcurl: fix curl_easy_setopt_ccsid for non-converted blobs
When a blob option is used and it does not convert, the code would
erroneously pass along an uninitialized stack struct.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19444
2025-11-10 13:38:36 +01:00
Daniel Stenberg
2f29a8f19e
RELEASE-NOTES: spellcheck 2025-11-10 10:41:38 +01:00
Daniel Stenberg
2f768b8c62
RELEASE-NOTES: synced 2025-11-10 10:09:03 +01:00
Daniel Stenberg
4efe88ee7e
renovate.json: drop parentheses from group names
They make git branch names using those parentheses, that need to be
quoted when used with git command lines. Avoid parentheses for easier to
use branch names.

Follow-up to f77c574445

Closes #19441
2025-11-10 09:48:05 +01:00
renovate[bot]
24774bbb5e
GHA: update awslabs/aws-lc to v1.63.0
Closes #19435
2025-11-10 09:21:25 +01:00
x2018
323b33d51f
digest_sspi: properly free sspi identity
Closes #19426
2025-11-10 09:20:26 +01:00
Daniel Stenberg
660f244640
urlapi: fix mem-leaks in curl_url_get error paths
Reported-by: Stanislav Fort (Aisle Research)
Closes #19440
2025-11-10 09:16:20 +01:00
x2018
baafa5ff76
schannel: fix potental memory leak of cert_store_path on four error paths
Closes #19423
2025-11-10 09:14:56 +01:00
x2018
87149c8383
mqtt: properly handle the message which exceeds maxsize
We should goto fail as topic is allocated.

Follow-up to 92fd791

Closes #19417
2025-11-10 09:07:27 +01:00
Stanislav Fort
b0aba1005b
cshutdn: acknowledge FD_SETSIZE for shutdown descriptors
In the logic called for curl_multi_fdset().

File descriptors larger than FD_SETSIZE size are simply ignored, which
of course will make things break but at least it does not trash memory.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19439
2025-11-10 08:54:43 +01:00
Daniel Stenberg
00872d5c98
rtmp: fix double-free on URL parse errors
Reported-by: Stanislav Fort (Aisle Research)
Closes #19438
2025-11-10 08:53:30 +01:00
Samuel Henrique
79d3e1d7d4
wcurl: import v2025.11.09
Closes #19430
2025-11-10 08:52:55 +01:00
Daniel Stenberg
c791223743
setopt: disable CURLOPT_HAPROXY_CLIENT_IP on NULL
As documented.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19434
2025-11-10 07:49:00 +01:00
Viktor Szakats
2701ac6a4d
processhelp.pm: log taskkill pid info, add debug envs, enable in CI
To debug the Windows CI fails further. Acting on the suspicions that
`taskkill` may sometimes be applied to the wrong process.

- log task info, and task child info before calling `taskkill` on a PID.
  (on native Windows.)
  One of the calls needs PowerShell.

- add env `CURL_TEST_NO_TASKKILL` to disable using `taskkill`.

- add env `CURL_TEST_NO_TASKKILL_TREE` to use `taskkill` without
  `-t`, meaning to kill the process, but not child processes.

- GHA/windows: disable `taskkill` calls, to see what happens.
  I'll revert or tweak this in a future commit depending on results.

Ref: https://github.com/curl/curl/discussions/14854#discussioncomment-13062859
Ref: https://github.com/curl/curl/discussions/14854#discussioncomment-14913014

Closes #19421
2025-11-10 02:00:17 +01:00
Viktor Szakats
c6f1b0ff49
tests/server: do not fall back to original data file in test2fopen()
Before this patch servers were loading the original data source file
(from `tests/data/test*`) if they failed to open the preprocessed data
file.

It was causing issues in many (most?) tests, because original data files
are not preprocessed, thus may be incomplete and/or come with wrong
newline characters. It's also causing difficult to diagnose issues when
a test accidentally references another test's data, which by chance
makes the test pass initially, until either that or the executed test
data gets an update, and breaking it, as seen in #19329.

Historically, the fallback existed first, then the preprocessed copy.
The fallback is no longer used by tests (except by stray accidents).

Fix it by dropping the fallback logic and relying on the preprocessed
data file saved there by the runtests framework.

Also fix two remaining test data cross-references:
- test1565: reference own server input data instead of test1's.
- test3014: reference own server input data instead of test1439's.
  Ref: #19398

Follow-up to aaf9522a2c #19329

Closes #19429
2025-11-09 21:14:41 +01:00
Viktor Szakats
28ff2b260e
tests/data: replace hard-coded test numbers with %TESTNUMBER
Closes #19427
2025-11-09 19:27:19 +01:00
Viktor Szakats
67236f7edd
tests/data: delete stray space indentation from xml tags
Closes #19428
2025-11-09 19:27:19 +01:00
Viktor Szakats
49ef2f8d1e
cmake: adjust defaults for target platforms not supporting shared libs
If CMake reports the target platform not supporting shared libs, turn
`BUILD_SHARED_LIBS` off by default. CMake 3.30+ fails with an error
when trying to create a `SHARED` target for such platforms. Earlier
versions used a workaround that may or may not have worked in practice.

Ref: https://cmake.org/cmake/help/v3.30/policy/CMP0164.html

Seen this with a build setting `-DCMAKE_SYSTEM_NAME=Generic`, e.g.
AmigaOS.

Note this may introduce incompatibility for "Generic" targets, which
support shared libs. If that's the case, set `BUILD_SHARED_LIBS=ON`
manually.

Also drop AmigaOS-specific logic handled automatically after this patch.

Ref: https://cmake.org/cmake/help/v3.7/command/get_property.html
Ref: https://cmake.org/cmake/help/v3.7/prop_gbl/TARGET_SUPPORTS_SHARED_LIBS.html

Closes #19420
2025-11-09 17:56:20 +01:00
Viktor Szakats
f760a5cef7
tests/data: replace %CR with crlf=headers where possible
Missed them in previous rounds of updates:
test 433, 1375, 1376, 1377, 1429

Closes #19424
2025-11-09 16:39:34 +01:00
Viktor Szakats
d35c880a75
INSTALL-CMAKE.md: document static option defaults more
Closes #19419
2025-11-09 13:16:02 +01:00
Daniel Stenberg
7aa50124c2
TODO: improve code for large MQTT payloads
Closes #19416
2025-11-09 11:53:39 +01:00
Daniel Stenberg
92fd791f31
mqtt: reject overly big messages
Reported-by: Jiyong Yang
Closes #19415
2025-11-09 11:40:28 +01:00