Commit graph

15993 commits

Author SHA1 Message Date
Daniel Stenberg
84e43eefc8
mqtt: return error when a too large packet is decoded
Closes #20148
2026-01-01 23:30:10 +01:00
Daniel Stenberg
f7d8725a55
inet_ntop: avoid the strlen()
Also, skip adding the terminating null that is not used.

Closes #20139
2026-01-01 18:06:39 +01:00
Daniel Stenberg
d3eddf4761
source: misc typos
Found by typos-cli

Closes #20138
2026-01-01 12:43:59 +01:00
Viktor Szakats
e4f4eeb0c5
libssh: fix indent
Closes #20135
2025-12-31 18:49:53 +01:00
Viktor Szakats
258521e170
hostip.h: drop redundant setjmp.h include
Already included directly via `hostip.c`, and other header users do not
use it.

Also add comment about why `setjmp.h` is used.

Cherry-picked from #20106

Closes #20132
2025-12-31 17:00:57 +01:00
Viktor Szakats
7ad830bb58
openssl: stop checking for OPENSSL_NO_SHA* macros
Macros have been deleted upstream and never defined in OpenSSL 1.1.0+:
474e469bbd

BoringSSL deleted the last internals uses in 2014:
457112e197

LibreSSL refers to them internally and in two public headers, but never
set them via `openssl/opensslfeatures.h` / `openssl/opensslconf.h`.

Follow-up to 69c89bf3d3 #18330

Closes #20130
2025-12-31 17:00:03 +01:00
Viktor Szakats
0d0ac29cdd
openssl: stop checking for OPENSSL_NO_TLSEXT macro
The macro has been deleted upstream and never defined in OpenSSL 1.1.0+:
e481f9b90b

BoringSSL and LibreSSL deleted the last uses in 2014:
6dbd73db5d
7b2f3298f7

Also:
- drop internal guard `HAS_ALPN_OPENSSL`. It's always set.

Follow-up to 69c89bf3d3 #18330

Closes #20129
2025-12-31 16:55:52 +01:00
Viktor Szakats
c7b25e6e82
lib: drop unused or duplicate curlx/timeval.h includes
Note: This patch doesn't aim to add `timeval.h` includes missing from
local headers using `curltime` type. They remain relying on `urldata.h`
being included first. This patch also doesn't delete existing, used
includes already present in local headers (as internal users may rely
on them).

Ref: #20106
Closes #20126
2025-12-31 15:59:19 +01:00
Viktor Szakats
def95e3bbc
openssl: fix building against no-ocsp openssl with Apple SecTrust
(Not tested in CI. Regression in 8.17.0.)

Fixing:
```
lib/vtls/openssl.c:4750:8: error: variable 'sectrust_verified' set but not used [-Werror,-Wunused-but-set-variable]
 4750 |   bool sectrust_verified = FALSE;
      |        ^
1 error generated.
```

Follow-up to b4630ed8fa #19308

Closes #20128
2025-12-31 15:51:02 +01:00
Viktor Szakats
be675eeb6d
openssl: fix building against no-dsa openssl
(Not tested in CI. Regression within this release cycle.)

Fixing:
```
lib/vtls/openssl.c:304:48: error: unused parameter 'data' [-Werror,-Wunused-parameter]
  304 | static CURLcode get_pkey_dsa(struct Curl_easy *data,
      |                                                ^
lib/vtls/openssl.c:305:40: error: unused parameter 'pubkey' [-Werror,-Wunused-parameter]
  305 |                              EVP_PKEY *pubkey, BIO *mem, int i)
      |                                        ^
lib/vtls/openssl.c:305:53: error: unused parameter 'mem' [-Werror,-Wunused-parameter]
  305 |                              EVP_PKEY *pubkey, BIO *mem, int i)
      |                                                     ^
lib/vtls/openssl.c:305:62: error: unused parameter 'i' [-Werror,-Wunused-parameter]
  305 |                              EVP_PKEY *pubkey, BIO *mem, int i)
      |                                                              ^
```

Follow-up to 833efb437d #19471

Closes #20127
2025-12-31 15:51:01 +01:00
Yedaya Katsman
660600c747
badwords: add fist -> first, fix fallouts
There are still `curl_fistrgs` in packages/OS400/curl.inc.in but
I'm not sure what that's supposed to be exactly.

Closes #20066
2025-12-31 12:21:42 +01:00
trxvorr
f81e7197c1
digest: fix OWS and escaped quote handling
The migration to the strparse API introduced regressions in Digest
authentication parsing where Optional Whitespace (OWS) after commas was
not skipped, and escaped quotes in values were not correctly parsed.

This change ensures whitespace is skipped before key lookups and escaped
characters are properly handled and unescaped in quoted values.

Reported-by: herdiyanitdev on hackerone
Closes #20102
2025-12-30 23:22:26 +01:00
Stefan Eissing
52ac8104e1
ratelimit blocking: fix busy loop
Fix the pollset in perform state to not add sockets for directions
that are blocked. This otherwise will lead to busy loops for a
transfer that cannot be progressed.

Reported-by: Fizn-Ahmd on github
Fixes #20091
Closes #20109
2025-12-29 22:44:34 +01:00
Harry Sintonen
16d5f2a566
libssh: require private key or user-agent for public key auth
Closes #20110
2025-12-29 17:28:22 +01:00
Daniel Stenberg
bc9ab557df
telnet: abort on bad suboption sequence
Instead of trying to repair.

Reported-by: Huseyin Tintas

Closes #20108
2025-12-29 10:49:30 +01:00
Daniel Stenberg
7fc78c2c1c
urlapi: set uncondtional return code
Curl_parse_login_details() can only return a single return code so
adjust accordingly.

Pointed out by CodeSonar

Closes #20107
2025-12-29 10:17:49 +01:00
Daniel Stenberg
2754e0f3d3
url: return error at once when OOM in netrc handling
Closes #20103
2025-12-29 10:16:48 +01:00
Daniel Stenberg
5c0cdd26d6
strcopy: minor comment edit to avoid matching a grep for strcpy use 2025-12-27 23:25:13 +01:00
Daniel Stenberg
6842d4ec4d
curl_quiche: refuse headers with CR, LF or null bytes
Also renamed the struct field to 'h1hdr' from 'scratch' to better say
what its purpose is.

Closes #20101
2025-12-27 16:27:11 +01:00
Daniel Stenberg
0e054134b7
urlapi: return OOM correctly from parse_hostname_login()
Closes #20100
2025-12-27 16:25:55 +01:00
Daniel Stenberg
0ccd16d29a
ftp: return from ftp_state_use_port immediately on OOM
Closes #20100
2025-12-27 16:25:52 +01:00
Daniel Stenberg
19ca87d4e2
cf-socket: return OOM error if socket() failes due to OOM
Closes #20100
2025-12-27 16:25:38 +01:00
Viktor Szakats
7032982896
tidy-up: miscellaneous
- asyn-thrdd.c: scope an include.
- apply more clang-format suggestions.
- tidy-up PP guard comments.
- delete empty line from the top of headers.
- add empty line after `curl_setup.h` include where missing.
- fix indent.
- CODE_STYLE.md: add `strcpy`.
  Follow-up to 8636ad55df #20088
- lib1901.c: drop unnecessary line.
  Follow-up to 436e67f65b #20076

Closes #20070
2025-12-26 22:06:09 +01:00
Daniel Stenberg
abcb10f3ac
ftp: return better on OOM in two places
Found with strict torture testing.

Closes #20099
2025-12-26 10:48:41 +01:00
Daniel Stenberg
a585cc35e5
memdebug: stop tracking send and recv
- they rarely catch any problems
- we have other ways to test different send/recv problems
- the number of such calls vary much more per invoke than others, making
  memdebugging harder
- reducing the total number of fallible functions per test is good
- they were not used as intended anyway

Closes #20097
2025-12-26 10:27:27 +01:00
Daniel Stenberg
d4b62bff64
curl_threads: don't do another malloc if the first fails
Closes #20095
2025-12-25 22:14:39 +01:00
Daniel Stenberg
18af4e4e10
cookie: flush better
The cookie flushing (saving to a cookie jar) should only be done if a
transfer has been started. This is now done by checking the
cookies->running field, which is not reset in curl_easy_reset() so the
saving works correctly even after a call to that.

Follow-up to fd6eb8d6e7

Verified by test 1920

Reported-by: Alexander Batischev
Fixes #20090
Closes #20094
2025-12-25 12:05:23 +01:00
Viktor Szakats
e78a466ebd
lib: drop unused protocol headers
- drop unused `http.h` includes.
- drop unused `http1.h` include.
- drop unused `http2.h` includes.
- vssh/ssh.h: drop unused `vssh.h` include.
- urldata.h: drop unused protocol includes.
- url: include `smtp.h` directly.
- rtsp.h: include directly where used.
- imap, smtp: drop redundant include, move another from .h to .c.

Verified with an all non-unity CI run.

Closes #20093
2025-12-25 12:00:22 +01:00
Daniel Stenberg
adca486c12
libssh: set both knownhosts options to the same file
Reported-by: Harry Sintonen

Closes #20092
2025-12-25 11:01:41 +01:00
Daniel Stenberg
ca46112991
curl_ntlm_core: fix DES_* symbols for some wolfSSL builds
Recent wolfSSL with OPENSSL_COEXIST enabled does not provide the DES_*
symbols, so we do.

Reported-by: Daniel Pouzzner
Closes #20083
2025-12-24 22:49:43 +01:00
Daniel Stenberg
76e7d496b6
escape: add a length check in curl_easy_escape
Only accept up to SIZE_MAX/16 input bytes. To avoid overflows, mistakes
and abuse.

Follow-up to 9bfc7f9234

Reported-by: Daniel Santos

Closes #20086
2025-12-24 22:47:26 +01:00
Viktor Szakats
532d134767
build: stop disabling strcpy checks with clang-tidy
Follow-up to 436e67f65b #20076

Closes #20084
2025-12-24 00:02:40 +01:00
Viktor Szakats
436e67f65b
tests: replace strcpy() with curlx_strcopy()
Also:
- examples/hsts-preload: apply the same change as it's based on lib1915
  in tests. Make a local clone of `curlx_strcopy()`. Then drop the
  `_CRT_SECURE_NO_WARNINGS` hack, that's no longer necessary.
- curl_setup.h: delete `strcpy()` from the `_CRT_SECURE_NO_WARNINGS`
  list.

Closes #20076
2025-12-23 22:25:39 +01:00
Daniel Stenberg
7e064d0756
cf-h1-proxy: support folded headers in CONNECT responses
Update test 1941 to verify this

Remove unused code from dynhds for handling folded headers, and the
associated unit tests of those functions in test 2602 and 2603.

Closes #20080
2025-12-23 17:12:14 +01:00
Viktor Szakats
17628b15ec
vquic: initialize new callback in nghttp3 1.14.0+
Fixing (seen in curl-for-win production build):
```
lib/vquic/curl_ngtcp2.c:1257:1: error: missing field 'recv_settings2' initializer [-Werror,-Wmissing-field-initializers]
 1257 | };
      | ^
1 error generated.
```
Ref: https://ci.appveyor.com/project/curlorg/curl-for-win/builds/53281785#L6752
Ref: https://github.com/curl/curl/actions/runs/20459295003/job/58788229134#step:3:5513

Also:
- Mark previous callback deprecated.
- Document ngtcp2, nghttp3 versions for callback entry feature guards.

Refs:
https://github.com/ngtcp2/nghttp3/releases/tag/v1.14.0
https://github.com/ngtcp2/nghttp3/pull/432
1616ab8350

Closes #20077
2025-12-23 13:34:07 +01:00
Daniel Stenberg
a535be4ea0
curlx: curlx_strcopy() instead of strcpy()
This function REQUIRES the size of the target buffer as well as the
length of the source string. Meant to make it harder to do a bad
strcpy().

Removes 23 calls to strcpy().

Closes #20067
2025-12-22 23:01:05 +01:00
Stefan Eissing
f099c2ca55
apple sectrust: fix ancient evaluation
On versions before macOS 10.14, ios 12 and watchos 5, check the
evaluation code to return the error from evaluation.

Reported-by: Stanislav Fort
Closes #20074
2025-12-22 23:00:08 +01:00
Daniel Stenberg
6b9c75e219
content_encoding: avoid strcpy
Build list with dynbuf.

Closes #20072
2025-12-22 14:17:21 +01:00
Viktor Szakats
d92e264ff0
curlx: rename Curl_-prefixed symbols to curlx_
Closes #20069
2025-12-22 01:47:22 +01:00
Viktor Szakats
6e6fafa9b0
binmode: delete extra nop instruction from fallback macro
Follow-up to 250d613763 #15787

Closes #20068
2025-12-22 01:47:21 +01:00
Viktor Szakats
4ad87f2cb8
checksrc: ensure using ifdef/ifndef when possible, fix fallouts
Follow-up to 89771d19d5 #18018

Closes #20065
2025-12-21 21:12:31 +01:00
Viktor Szakats
e8415a8296
lib: drop, or replace sendf.h with curl_trc.h where possible
- replace `sendf.h` with `curl_trc.h` where it was included just for it.
- drop unused `curl_trc.h` includes.
- easy: delete obsolete comment about `send.h` include reason.

Also:
- move out `curl_trc.h` include from `sendf.h` and include it directly
  in users, where not done already. To flatten the include tree and
  to less rely on indirect includes.
- stop including `sendf.h` from other headers, replace it with forward
  declaration of `Curl_easy`, as done already elsewhere.

Verified with an all non-unity CI run.

Closes #20061
2025-12-21 12:39:25 +01:00
Viktor Szakats
4cf88d8477
x509asn1: drop unused hostcheck.h, vtls_int.h includes
Closes #20063
2025-12-21 11:14:22 +01:00
Viktor Szakats
884b5ea921
lib: include curlx/warnless.h from curl_setup.h
To make it available for all files. Drop includes from individual
sources. This header was already included from most sources and not
specific to any internal subsystem.

Also to ensure that two system symbol redefines on Windows (`read()` and
`write()`) get applied to all sources. Move them to `curl_setup.h`.

Closes #20056
2025-12-21 02:36:33 +01:00
Viktor Szakats
70651cb6de
lib: drop unused vssh/ssh.h includes
Closes #20060
2025-12-21 02:31:58 +01:00
Viktor Szakats
a3f866ac76
transfer: drop unused vquic/vquic.h include
Closes #20059
2025-12-21 02:31:58 +01:00
Viktor Szakats
6011b83852
curl_ntlm_core: move vauth/vauth.h include from header to source
To not include it implicitly for all `curl_ntlm_core.h` users.

Closes #20058
2025-12-21 02:16:34 +01:00
Viktor Szakats
d4298603b5
tidy-up: curlx/nonblock.h includes
Delete where unused, include where to used to avoid relying on
side-effect of other headers.

Also: delete "for curlx_nonblock" comments. That's the only symbol
offered by this header.

Closes #20055
2025-12-21 02:16:34 +01:00
Viktor Szakats
fdb5152091
lib: drop unused vtls/vtls.h includes
Closes #20057
2025-12-21 02:16:34 +01:00
Viktor Szakats
3c1c299b27
lib: drop unused curlx headers
`curlx/base64.h` and `curlx/strparse.h`.

Closes #20054
2025-12-21 02:16:33 +01:00