Commit graph

3364 commits

Author SHA1 Message Date
Daniel Stenberg
f8769845c8
config2setopts: acknowledge OOM error from CURLOPT_MIMEPOST
It should make curl exit. Found with "strict torture".

Closes #20375
2026-01-20 16:44:39 +01:00
Stefan Eissing
3dd7f5890f
socket: check result of SO_NOSIGPIPE
New define USE_SO_NOSIGPIPE in curl_setup.h, for now set whenever
SO_NOSIGPIPE is defined. Maybe overridden in the future on systems where
this does not work.

With USE_SO_NOSIGPIPE defined, set SO_NOSIGPIPE on all sockets created
by libcurl and fail the creation when setsockopt() fails.

Closes #20370
2026-01-20 16:38:49 +01:00
Viktor Szakats
09c9afdd71
cmake: silence silly Apple clang warnings in C89 mode, test in CI
- `stdbool.h` is also included via system headers. Disabling it from curl
  does not fix it. Silencing lots of these:
  ```
  curl/lib/curlx/warnless.h:64:1: warning: '_Bool' is a C99 extension [-Wc99-extensions]
   64 | bool curlx_sztouz(ssize_t sznum, size_t *puznum);
      | ^
  /Library/Developer/CommandLineTools/usr/lib/clang/17/include/stdbool.h:24:14: note: expanded from macro 'bool'
   24 | #define bool _Bool
      |              ^
  ```

- silence `-Wcomma` warnings.
  in favor of the global silencing approach, since a couple of more of
  these were hit (in vquic, tool1622, unit1309, unit1636), and it seems
  silly to update them all.
  Revert e8189c4420 #20362

Also:
- cmake: include C standard in 'platform flags' log line.
- GHA/macos: switch a job to C89 to verify.
- GHA/linux: show 'C89' in job names.

Ref: https://cmake.org/cmake/help/v3.7/variable/CMAKE_C_STANDARD.html

Closes #20363
2026-01-20 13:05:01 +01:00
Viktor Szakats
f07a98ae11
build: drop global suppression of -Wformat-nonliteral, fix fallouts
Extend two existing local suppressions to GCC, and add another
GCC-specific one as a replacement.

Before this patch suppressing this warning was odd with clang, because
after this option, `-Wformat=2` is used, which re-enables it.

Also:
- mprintf: minimize scope of a warning suppression.
- tests/server: suppress this warning for a system `vsnprintf()` call
  where it could trigger in C89 builds or with
  `CFLAGS=-DCURL_NO_FMT_CHECKS` set. Seen with Apple clang 17:
  ```
  curl/tests/server/util.c:114:37: warning: format string is not a string literal [-Wformat-nonliteral]
    114 |   vsnprintf(buffer, sizeof(buffer), msg, ap);
        |                                     ^~~
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/secure/_stdio.h:124:69: note: expanded from macro 'vsnprintf'
    124 | #define vsnprintf(str, len, ...) __vsnprintf_chk_func (str, len, 0, __VA_ARGS__)
        |                                                                     ^~~~~~~~~~~
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/secure/_stdio.h:81:65: note: expanded from macro '__vsnprintf_chk_func'
     81 |         __builtin___vsnprintf_chk (str, len, flag, __darwin_obsz(str), format, ap)
        |                                                                        ^~~~~~
  ```

Ref: #20363

Closes #20366
2026-01-20 12:38:02 +01:00
Viktor Szakats
814b54d83e
tidy-up: miscellaneous
- whitespace, indent, comments, clang-format.
- openssl: move feature guards within function blocks.
- tunit: drop redundant blocks.

Closes #20361
2026-01-20 12:37:56 +01:00
Maksim Ściepanienka
a87f346189
config2setopts: fix for --disable-aws build configuration
Closes #20368
2026-01-20 07:49:48 +01:00
Viktor Szakats
e8189c4420
tool_getparam: avoid -Wcomma with Apple clang in C89 mode
Seen with Apple clang 17:
```
curl/src/tool_getparam.c:3062:12: warning: possible misuse of comma operator here [-Wcomma]
 3062 |   for(i = 1, stillflags = TRUE; i < argc && !result; i++) {
      |            ^
curl/src/tool_getparam.c:3062:7: note: cast expression to void to silence warning
 3062 |   for(i = 1, stillflags = TRUE; i < argc && !result; i++) {
      |       ^~~~~
      |       (void)( )
```

Closes #20362
2026-01-20 00:20:43 +01:00
Viktor Szakats
2d5a063121
build: merge TrackMemory (CURLDEBUG) into debug-enabled option
Drop separate `TrackMemory` (aka `CURLDEBUG`) debug feature.

After recent changes (thread-safety,
193cb00ce9, and updates leading up to
it), `TrackMemory` is unlikely to cause build or runtime issues.

To simplify builds and debug options, enable `TrackMemory`
unconditionally for debug-enabled (aka `DEBUGBUILD`) builds. Before
this patch, this was already the default, with an option to disable
it, or enable it in non-debug-enabled builds.

Note, in practice these two debug options already went hand in hand. It
was not possible to toggle them separately for a long time due to bugs,
before 59dc9f7e69 (2024-05-28) fixed it.

This patch also removes/deprecates separate knobs and feature flags for
`TrackMemory`:
- autotools: `--enable-curldebug`/`--disable-curldebug`
- cmake: `-DENABLE_CURLDEBUG=ON`/`OFF`
- C macro: `CURLDEBUG`
- libcurl: `CURL_VERSION_CURLDEBUG` symbol deprecated in favor
  of `CURL_VERSION_DEBUG`. They always return the same value after this
  patch.

Also:
- drop `TrackMemory` from `curl -V` output.
- rename internal `CURLDEBUG` macro to `CURL_MEMDEBUG` internally.
  To avoid confusion with `DEBUGBUILD`, but to keep guarding
  `TrackMemory`-related internals for readability.
- runtests: bind `TrackMemory` to debug feature. Keep it a separate
  test feature requirement, for clarity.
- CI: drop test builds for combinations of the two options.
- GHA/linux: no longer disable TrackMemory in the TSAN job.

Ref: https://github.com/curl/curl/pull/20328#issuecomment-3754528407

Closes #20331
2026-01-19 18:43:17 +01:00
Daniel Stenberg
6d6899c2f0
tool: support fractions for --limit-rate and --max-filesize
Allow 2.5k or 3.7M etc. Add mention in documentation.

Verify in test case 1623.

Closes #20266
2026-01-17 23:25:26 +01:00
Viktor Szakats
85c841cb45
msvc: drop exception, make BIT() a bitfield with Visual Studio
Add casts to `bool`, or use `bit` type in local variables, where
neccessary to avoid MSVC compiler warnings C4242.

Note: There may remain places needing the above updates, where not
tested in CI, and missed in manual review.

Also:
- urldata: convert struct field `connect_only` to bitfield to match its
  counterpart in another struct.
- rename curl-specific `bit` type to `curl_bit`.

Closes #20142
2026-01-17 11:46:31 +01:00
Viktor Szakats
ac6264366f
tidy-up: miscellaneous
- tool_bname: scope an include.
- `endif` comments.
- Markdown fixes.
- comment tidy-ups.
- whitespace, newlines, indent.

Closes #20309
2026-01-15 13:06:13 +01:00
Viktor Szakats
82e0d387a2
build: drop more forward function declarations
Most by moving functions around. Also delete unused ones.
Reducing their number from 83 to 33.

Remaining ones due to:
- circular dependencies.
- H3 code, that I did not attempt to update and likely the above applies.
- static declarations with attributes (`CURL_PRINTF`, `WARN_UNUSED_RESULT`).
- OS400 code.

Closes #20321
2026-01-14 23:34:05 +01:00
Daniel Stenberg
2b12dbc116
tool_cb_hdr: move etag and content-disposition logic into funcs
Co-authored-by: Jay Satiro
Closes #20288
2026-01-14 14:54:54 +01:00
Viktor Szakats
c6cd54d3a2
tool_doswin: document ENABLE_VIRTUAL_TERMINAL_PROCESSING toolchain support
Closes #20315
2026-01-14 12:53:14 +01:00
Viktor Szakats
2623e333fd
build: drop stray ifndef guards for local/internal macros
For:
- lib/vtls: `MAX_PINNED_PUBKEY_SIZE`.
- src: `UNPRINTABLE_CHAR`.
- tests/server/tftpd: `PKTSIZE`.

Closes #20314
2026-01-14 12:53:14 +01:00
Viktor Szakats
20900e4a1e
tool_doswin: merge if blocks, drop forward declarations
Closes #20311
2026-01-14 12:06:33 +01:00
Viktor Szakats
7d9004ee47
build: drop duplicate C includes
- `stdlib.h` and `string.h` is included via `curl_setup_once.h`,
  allowing to drop from `tests/server` sources and `tool_doswin.c`.

- `stdlib.h` is also included via `setup-vms.h` (earlier than above),
  allowing to drop it from `curl_addrinfo.h` on VMS.

Closes #20303
2026-01-14 00:55:05 +01:00
Viktor Szakats
0431cbe71a
build: globally suppress DJGPP warnings in FD_SET()
Replacing the many local `#pragma` used before this patch,
reducing the number of `__DJGPP__` guards from 58 to 13.

Closes #20299
2026-01-13 23:17:10 +01:00
Viktor Szakats
60f9d3dd7b
build: omit forward declarations
- drop redundant forward declarations.
- reorder local functions to not need forward declarations.
- tftpd: merge two `ifdef` blocks.

Closes #20297
2026-01-13 21:15:36 +01:00
Jay Satiro
3652127e81 tool_cb_hdr: suppress header output when --out-null
This change brings --out-null more in line with the documentation which
says --out-null is expected to behave like a portable -o /dev/null.

Prior to this change curl did not suppress the header output from --head
when --out-null was used to suppress output.

Assisted-by: Daniel Stenberg
Reported-by: Andrew Kvalheim

Ref: https://curl.se/docs/manpage.html#--out-null

Fixes https://github.com/curl/curl/discussions/20235
Closes https://github.com/curl/curl/pull/20256
2026-01-12 15:36:44 -05:00
Patrick Monnerat
67d0bfc6c2
tool_filetime: sync dummy macro signature with function prototype
Closes #20265
2026-01-12 16:29:32 +01:00
Daniel Stenberg
40fee505a0
tool_operate: split single_transfer into sub functions
To make it more manageable and less complex

Closes #20258
2026-01-12 08:42:23 +01:00
Viktor Szakats
2465f7c61d
tool: improve error/warning messages when output filename sanitization fails
On MS-DOS (OOM and bad filename) and Windows (OOM only).

Given the rarity of both platform and error, we make a compromise and
return an unrelated libcurl error (43) in case of a bad output filename
on MS-DOS.

After:
```
$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/ --output out.txt
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/ --output out.txt
Warning: bad output filename
curl: (43) A libcurl function was given a bad argument

$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: bad output filename
curl: (43) A libcurl function was given a bad argument
```

Before:
```
$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/ --output out.txt
Warning: bad output glob
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/ --output out.txt
Warning: bad output glob
curl: (3) URL using bad/illegal format or missing URL

$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: Failed to extract a filename from the URL to use for storage
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: Failed to extract a filename from the URL to use for storage
curl: (3) URL using bad/illegal format or missing URL
```

Ref: #20116 (simpler reboot of)
Ref: #20113 #20121
Ref: 40c1748af5 #20198
Ref: eb7f5b71e5 #20143
Ref: 8c02407bef #20125
Fixes #20044
Closes #20199
2026-01-10 13:21:27 +01:00
Viktor Szakats
df7718b5cf
curl: limit Windows-specific code to Windows builds, other tidy-ups
Prior to this patch, some Windows logic, including a Windows-specific
warning message was compiled in for all platforms.

Also:
- fix double space in warning message on UWP.
- formatting.

Follow-up to 9a2663322c #17572

Closes #20213
2026-01-09 09:42:01 +01:00
Daniel Stenberg
97a02fade6
curl: rename a struct OutStruct field to 'regular_file'
From 's_isreg'. It explains better in plain English what it is for.

Closes #20222
2026-01-08 22:34:05 +01:00
Daniel Stenberg
8a25cf3d7c
tool_operate: remove 'else' for VMS
It seems malplaced as it then avoids the following logic when invoked
from a VMS shell and that seems unlikely to be desired.

Based on code review. I have no system to try this on.

Follow-up to f1261bcdd7
Closes #20221
2026-01-08 22:33:06 +01:00
Viktor Szakats
bb7f69f9a2
tool_dirhie: drop superfluous F_OK fallback (Windows)
Follow-up to cb5ba675a7

Closes #20214
2026-01-07 22:59:52 +01:00
Viktor Szakats
40c1748af5
tool_urlglob: fix propagating OOM error from sanitize_file_name()
Make sure to convert a low-level OOM error code a libcurl one, to make
the curl tool to display an accurate error code and messages. On Windows
and MS-DOS.

Improving:
```
$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/ --output out.txt
[...]
curl: (3) URL using bad/illegal format or missing URL
```
to:
```
[...]
curl: (27) Out of memory
```

Cherry-picked from #20116
Closes #20198
2026-01-06 20:02:55 +01:00
pojomi
dc739fee16
config2setopts: add space in cookie header with multiple -b
Closes #20184
2026-01-05 23:32:00 +01:00
Daniel Stenberg
eb7f5b71e5
tool_doswin: remove the max length check
A too long name is likely to cause a problem later anyway and get
reported there. We don't enforce file name lengths for any other
systems.

Assisted-by: Jay Satiro
Assisted-by: Viktor Szakats

Closes #20143
2026-01-04 11:22:43 +01:00
Daniel Stenberg
b32e66a8ee
tool_progress: fix large time outputs and decimal size display
Time output:

- was broken for really large times

- now uses spaces instead of --:--:--

- >99999y is now the largest shown time

- show HH:MM:SS as long as hours are fewer than 100

Size:

- made the decimal output always only use a single decimal

Test:

- Add test 1622 to verify these functions

Closes #20177
2026-01-04 00:16:59 +01:00
Daniel Stenberg
5ef7fa39d5
tool_getparam: use UNITTEST not, ifdef
Closes #20174
2026-01-04 00:09:12 +01:00
Viktor Szakats
d3bf8d391f
src: drop redundant definition of BIT()
It's defined in `lib/curl_setup_once.h` which is always included before
the duplicate definition in `src/tool_cfgable.h`. Delete the latter.

Follow-up to 06bb158737 #16211

Closes #20152
2026-01-02 10:45:12 +01:00
Viktor Szakats
8292820b73
pytest: replace allowlist with feature check to enable OCSP test 17_08
Add a `cert-status` feature flag to `curlinfo`, based on the conditions
used in `lib/vtls` sources.

To:
- fix disabling this test when using OpenSSL (or fork) built with
  the `no-ocsp` option.
- enable this test for AWS-LC in CI.

Note:
- BoringSSL (and quiche) has OSCP disabled by default.
- MultiSSL dynamic selection continues to confuse this test.
  (To fix it, support would need to be detected by querying libcurl
  via curl. Probably overkill given that OCSP is on its way out.)

Follow-up to f2c765028f #20149

Closes #20133
2026-01-02 01:23:27 +01:00
Daniel Stenberg
d3eddf4761
source: misc typos
Found by typos-cli

Closes #20138
2026-01-01 12:43:59 +01:00
Daniel Stenberg
23b080401a
tool_getparam: simplify the --rate parser
Avoids a memcpy()

Closes #20119
2026-01-01 12:34:54 +01:00
Daniel Stenberg
c7b26b6679
tool_paramhlp: simplify number parsing
Closes #20134
2026-01-01 12:15:34 +01:00
Daniel Stenberg
0c278cd586
tool_paramhlp: remove a malloc+free from proto2num()
Closes #20120
2025-12-31 17:59:30 +01:00
Yedaya Katsman
660600c747
badwords: add fist -> first, fix fallouts
There are still `curl_fistrgs` in packages/OS400/curl.inc.in but
I'm not sure what that's supposed to be exactly.

Closes #20066
2025-12-31 12:21:42 +01:00
Viktor Szakats
8c02407bef
tool_doswin: add debug envs to test filename sanitization failure modes
- `CURL_FN_SANITIZE_BAD=<any-value>` to simulate
  `SANITIZE_ERR_INVALID_PATH`.

- `CURL_FN_SANITIZE_OOM=<any-value>` to simulate
  `SANITIZE_ERR_OUT_OF_MEMORY`.

Both are Windows/MS-DOS-specific and require debug-enabled curl build.

Cherry-picked from #20116
Closes #20125
2025-12-31 12:16:11 +01:00
Daniel Stenberg
37d871af01
tool_getparam: use memdup0() instead of malloc + copy
Closes #20118
2025-12-30 23:53:24 +01:00
Jay Satiro
1068d048ec tool_doswin: increase allowable length of path sanitizer
- Use 32767-1 instead of PATH_MAX-1 (260-1) as the maximum allowable
  length of a path in Windows.

Prior to this change the path sanitizer in Windows used 32767-1 as the
maximum length only for paths that had the "\\" prefix like
"\\?\longpath". Since then we added some workarounds to open longer
paths without "\\?\" prefix by normalizing the path and adding that
prefix, and the sanitizer is called before the prefix is added.

Bug: https://github.com/curl/curl/issues/20044
Reported-by: Viktor Szakats

Closes https://github.com/curl/curl/pull/20046
2025-12-30 04:00:50 -05:00
Viktor Szakats
7032982896
tidy-up: miscellaneous
- asyn-thrdd.c: scope an include.
- apply more clang-format suggestions.
- tidy-up PP guard comments.
- delete empty line from the top of headers.
- add empty line after `curl_setup.h` include where missing.
- fix indent.
- CODE_STYLE.md: add `strcpy`.
  Follow-up to 8636ad55df #20088
- lib1901.c: drop unnecessary line.
  Follow-up to 436e67f65b #20076

Closes #20070
2025-12-26 22:06:09 +01:00
Daniel Stenberg
a585cc35e5
memdebug: stop tracking send and recv
- they rarely catch any problems
- we have other ways to test different send/recv problems
- the number of such calls vary much more per invoke than others, making
  memdebugging harder
- reducing the total number of fallible functions per test is good
- they were not used as intended anyway

Closes #20097
2025-12-26 10:27:27 +01:00
Viktor Szakats
685173e881
src: drop unused includes
Also replace some indirect includes with direct ones.

Closes #20096
2025-12-25 18:42:54 +01:00
Viktor Szakats
532d134767
build: stop disabling strcpy checks with clang-tidy
Follow-up to 436e67f65b #20076

Closes #20084
2025-12-24 00:02:40 +01:00
Daniel Stenberg
a535be4ea0
curlx: curlx_strcopy() instead of strcpy()
This function REQUIRES the size of the target buffer as well as the
length of the source string. Meant to make it harder to do a bad
strcpy().

Removes 23 calls to strcpy().

Closes #20067
2025-12-22 23:01:05 +01:00
Viktor Szakats
4ad87f2cb8
checksrc: ensure using ifdef/ifndef when possible, fix fallouts
Follow-up to 89771d19d5 #18018

Closes #20065
2025-12-21 21:12:31 +01:00
Viktor Szakats
969351bb1e
windows: fix CreateFile() calls to support long filenames
It makes them work in Schannel's CA bundle loader, and curl tool's
set/get file timestamp operations (e.g. in `-R`/`--remote-time`). Also
to match file open operations, that already support long filenames.

E.g. when using `--remote-time`, fixing:
```
Warning: Failed to set filetime 1741363917 on outfile: CreateFile failed:
Warning: GetLastError 0x00000003
```

The special long filename logic is necessary to support Windows releases
prior to Windows 10 v1607. With the latter, it's possible to opt-in to
this behavior via a manifest setting. Note that Windows itself also needs
to opt-in to support this. Finally note that curl itself needs passing
`--globoff` to let long filenames through, pending #20044 and #20046.

Refs:
https://learn.microsoft.com/windows/win32/api/fileapi/nf-fileapi-createfilea
https://learn.microsoft.com/windows/win32/fileio/maximum-file-path-limitation

Ref: #8361
Inspired by: #19286
Inspired-by: Mathesh V
Closes #19286
Closes #20040
2025-12-20 14:16:42 +01:00
Viktor Szakats
c0d8fedb49
tool_urlglob: constify an argument
Also: add argument names to prototypes.

Closes #20045
2025-12-20 11:34:28 +01:00