Commit graph

15746 commits

Author SHA1 Message Date
Stefan Eissing
de1a6f80eb
quiche: eliminate size_t casts
Use new curlx_sotouz_fits() instead.

Remove an unnecessary cast in osslq code while we are here.

Closes #19623
2025-11-20 22:38:21 +01:00
Stefan Eissing
7a22141de1
file: eliminate size_t cast
Use curlx_sztouz() instead.

Closes #19620
2025-11-20 22:36:47 +01:00
Daniel Stenberg
01623e26d0
http: error on OOM when creating range header
Closes #19630
2025-11-20 22:11:03 +01:00
Stefan Eissing
ad9b12d411
httpsrr/altsvc: eliminate size_t casts
Treat alpn raw data as unsigned chars, avoids size_t and char* casts.
Add method to convert a struct Curl_str to an alpnid.

Closes #19621
2025-11-20 17:56:57 +01:00
Stefan Eissing
6c55dd0028
vquic: eliminate size_t casts
Use new curlx_sotouz_fits() instead.

Closes #19624
2025-11-20 17:53:36 +01:00
Stefan Eissing
d2ab42d786
cf-socket: elminiate size_t casts
Use curlx_sztouz() instead.

Closes #19617
2025-11-20 17:43:06 +01:00
Stefan Eissing
ffcf8c5ce4
rtmp: eliminate size_t casts
Use curlx_sztouz() instead.

Closes #19619
2025-11-20 17:41:42 +01:00
Stefan Eissing
b812be567a
mqtt: eliminate size_t cast
Use new curlx_sotouz_fits() instead.

Closes #19622
2025-11-20 17:39:39 +01:00
Stefan Eissing
d9e9dd7f20
h2-proxy: eliminate size_t cast
Use curlx_sztouz() instead.

Closes #19616
2025-11-20 17:25:52 +01:00
Viktor Szakats
7e8f36bf8e
cmake: honor CURL_DISABLE_INSTALL and CURL_ENABLE_EXPORT_TARGET in lib and src
Based on existing code and commit history it appears
`CURL_DISABLE_INSTALL` means to prevent calling `install()`;
`CURL_ENABLE_EXPORT_TARGET` means to prevent calling `export()` and
`install()`s with `EXPORT` in them.

Fix them to also apply to the lib and src directories in that vain:
- lib: honor `CURL_DISABLE_INSTALL`
- src: honor `CURL_DISABLE_INSTALL`
- src: honor `CURL_ENABLE_EXPORT_TARGET`

https://cmake.org/cmake/help/v4.2/command/install.html
https://cmake.org/cmake/help/v4.2/command/export.html

- `CURL_DISABLE_INSTALL` follow-up to:
  aace27b096 #12287
- `CURL_ENABLE_EXPORT_TARGET` follow-up to:
  8698825106 #9638
  643ec29645 #7060

Closes #19144
2025-11-20 00:23:08 +01:00
Viktor Szakats
3d80d37cf0
curlx: add and use curlx_freopen()
To complement the existing `curlx_fopen()` internal API.
It's used by the curl's `--stderr` option.

`curlx_freopen()` adds two features to the bare `freopen()`:
- tracing for debug-enabled builds.
- Unicode and long-filename support for Windows builds.

In effect this adds long-filename and enables Unicode support for
the `--stderr <filename>` curl command-line option on Windows.

Also add to checksrc.

Follow-up to 2f17a9b654 #10673

Closes #19598
2025-11-19 22:04:53 +01:00
Christian Schmitz
991119051c
libssh2: add paths to error messages for quote commands
We really like to know what path curl parsed from our input.

Closes #19605
2025-11-19 16:25:07 +01:00
Stefan Eissing
17dc43ce6c
http: eliminate ssize_t
Use size_t to avoid conversions.

Closes #19610
2025-11-19 16:20:18 +01:00
Stefan Eissing
30afc66b88
gopher: convert ssize_t to size_t
Make type conversions unnecessary.

Closes #19608
2025-11-19 16:18:22 +01:00
Stefan Eissing
9fb843ac8f
ftp: use size_t instead of ssize_t
Make type conversions unnecessary.

Closes #19607
2025-11-19 16:16:20 +01:00
Viktor Szakats
47b8e1dbd3
tidy-up: move CURL_UNCONST() out from macro curl_unicodefree()
To stop applying it where not needed (most uses) and make it visible
where it's actually used (5 uses).

Follow-up to f4e23950c7 #16142

Closes #19606
2025-11-19 15:48:21 +01:00
Viktor Szakats
8bb8984e9d
curl_setup.h: document more funcs flagged by _CRT_SECURE_NO_WARNINGS
Based on these logs (non-Unicode, Unicode Schannel):
https://github.com/curl/curl/actions/runs/19446115443/job/55640968722?pr=19175
https://github.com/curl/curl/actions/runs/19446115443/job/55640968764?pr=19175

Follow-up to 5fa2d8320c #19175

Closes #19597
2025-11-19 01:48:20 +01:00
Daniel Stenberg
318cd4f2ee
lib: error for OOM when extracting URL query
Closes #19594
2025-11-18 23:42:24 +01:00
Daniel Stenberg
97169a91d9
hsts: propagate and error out correctly on OOM
Closes #19593
2025-11-18 16:40:32 +01:00
Daniel Stenberg
80005b4c8a
cookie: return error on OOM
Follow-up to 3f0629ca44
Closes #19591
2025-11-18 15:57:05 +01:00
Daniel Stenberg
6dac2631df
url: if OOM in parse_proxy() return error
Closes #19590
2025-11-18 14:54:16 +01:00
Daniel Stenberg
833efb437d
openssl: exit properly on OOM when getting certchain
Previously, a momentary OOM error in the middle could produce a broken
result instead of correctly returning error.

Closes #19471
2025-11-18 13:04:19 +01:00
Viktor Szakats
5fa2d8320c
build: tidy-up MSVC CRT warning suppression macros
- curl_setup.h: replace `_CRT_SECURE_NO_DEPRECATE` with
  `_CRT_SECURE_NO_WARNINGS`, which seems to be the preferred,
  more recent macro for this. Also syncing with libssh2.
  They are equivalent for curl sources with the supported compilers.
- cmake: stop setting `_CRT_SECURE_NO_DEPRECATE` globally for examples.
- examples: suppress CRT deprecation warnings on a per-file basis.
  To make it work when compiling examples out of curl's build systems.
  Use `_CRT_SECURE_NO_WARNINGS`.
- examples: document the functions requiring `_CRT_SECURE_NO_WARNINGS`.
- examples/block_ip: delete superfluous `_CRT_SECURE_NO_WARNINGS`.
- examples/block_ip: limit `_CRT_NONSTDC_NO_DEPRECATE` to MSVC.
- examples/log_failed_transfers: fix to set `_CRT_SECURE_NO_WARNINGS`
  before headers and limit to MSVC.
- curl_setup.h: document which SDKs support `_CRT_NONSTDC_NO_DEPRECATE`.

Closes #19175
2025-11-18 00:49:26 +01:00
Viktor Szakats
1e1ec7f6c2
badwords: add more contractions, fix fallouts
Also fix hits in autotools scripts (not to enforce).

Closes #19576
2025-11-17 19:29:15 +01:00
Daniel Stenberg
b360fc62fb
http: avoid two strdup()s and do minor simplifications
Closes #19571
2025-11-17 16:43:01 +01:00
Stefan Eissing
ea105708c9
h2/h3: handle methods with spaces
The parsing of the HTTP/1.1 formatted request into the h2/h3 header
structures should detect CURLOPT_CUSTOMREQUEST methods and forward them
correctly.

Add test_01_20 to verify

Fixes #19543
Reported-by: Omdahake on github
Closes #19563
2025-11-17 15:43:28 +01:00
Daniel Stenberg
2459dc7a22
http: the :authority header should never contain user+password
Pointed-out-by: Stanislav Fort
Closes #19568
2025-11-17 15:19:39 +01:00
x2018
821cba8fac
digest_sspi: fix a memory leak on error path
Closes #19567
2025-11-17 14:46:30 +01:00
x2018
11c0aaa339
openssl: fix a potential memory leak of bio_out
Closes #19561
2025-11-17 14:44:34 +01:00
x2018
22b8a6430d
openssl: fix a potential memory leak of params.cert
Closes #19560
2025-11-17 14:43:34 +01:00
x2018
a6c940a752
schannel_verify: fix a memory leak of cert_context
Closes #19556
2025-11-17 14:42:21 +01:00
x2018
b42f226b94
libssh: properly free sftp_attributes
Closes #19564
2025-11-17 14:40:39 +01:00
Viktor Szakats
1b48c6148a
tidy-up: miscellaneous
- schannel: delete superfluous parenthesis.
- tftp: delete stray space from log output.
- ws: update guard comment.
- docs/examples: constify variables.
- runtests/servers: enclose unknown parameter between quotes.
- scripts/perlcheck.sh: drop redundant grep `-E` option.
- THANKS: move names from comments to THANKS.
- sync `--depth` option style across scripts.
- sync git repo URL ending between some scripts.
- BINDINGS.md: drop protocol from archive.org URL path.
- whitespace, indent, unfold lines.

Closes #19565
2025-11-17 13:32:43 +01:00
Viktor Szakats
f0de14168a
cf-socket: limit use of TCP_KEEP* to Windows 10.0.16299+ at runtime
Before this patch `TCP_KEEP*` socket options were unconditionally used
if the build-time SDK supported them. This caused curl logging errors
(or trace messages since #19527) on Windows versions missing support
for them. After this patch, use them only when the runtime environment
supports it and fall back to the alternate method (`SIO_KEEPALIVE_VALS`)
dynamically.

Also:
- log a trace message when using the Win10 method.
- document which SDK versions offer `TCP_KEEP*` macros.

Ref: https://learn.microsoft.com/windows/win32/winsock/ipproto-tcp-socket-options
Ref: https://learn.microsoft.com/windows/win32/winsock/sio-keepalive-vals

Reported-by: Aleksandr Sergeev
Fixes #19520
Follow-up to dc34498d18 #19527
Closes #19559
2025-11-17 12:16:51 +01:00
Daniel Stenberg
b3d4f17e3d
curl_sasl: make Curl_sasl_decode_mech compare case insenstively
The provided mechanisms should be compared case insenstively.

Found by ZeroPath

Closes #19535
2025-11-17 08:01:13 +01:00
x2018
205a8e861f
wolfssl: fix a potential memory leak of session
Closes #19555
2025-11-16 23:32:41 +01:00
Daniel Stenberg
eeff93013c
rustls: minor adjustment of sizeof()
The mistake is harmless because it is still a size of a pointer, but
this is the correct pointer.

Acked-by: Daniel McCarney
Reported-by: pelioro on hackerone
Bug: https://hackerone.com/reports/3427460
Closes #19545
2025-11-16 17:54:49 +01:00
Viktor Szakats
69c89bf3d3
openssl: bump minimum OpenSSL version to 3.0.0
It also means that all supported OpenSSL versions and forks support
TLSv1.3 after this patch.

It reduces `openssl.c` size by more than 10%, or 400 LOC.

Ref: #18822
Closes #18330
2025-11-15 15:56:31 +01:00
Viktor Szakats
2e1a045d89
build: drop support for VS2008 (Windows)
Require Visual Studio 2010 or newer.

Ref: https://github.com/curl/curl/discussions/15972

Follow-up to dc28bb86c1 #17798
Follow-up to 63e513b106 #17380

Closes #17931
2025-11-15 15:56:19 +01:00
Viktor Szakats
554dfa5568
build: drop Windows CE / CeGCC support
Windows CE support was limited to successful builds with ming32ce
(a toolchain that hasn't seen an update since 2009, using an ancient gcc
version and "old mingw"-style SDK headers, that curl deprecated earlier).
Builds with MSVC were broken for a long time. mingw32ce builds were never
actually tested and runtime and unlikely to work due to missing stubs.
Windows CE toolchains also miss to comply with C89. Paired with lack of
demand and support for the platform, curl deprecated it earlier.

This patch removes support from the codebase to ease maintaining Windows
codepaths.

Follow-up to f98c0ba834 #17924
Follow-up to 8491e6574c #17379
Follow-up to 2a292c3984 #15975

Closes #17927
2025-11-15 15:35:23 +01:00
Viktor Szakats
2dc71ba8bf
badwords: check indented lines in source code, fix fallouts
- badwords.pl: add `-a` option to check all lines in source code files.
  Before this patch indented lines were skipped (to avoid Markdown code
  fences.)
- GHA/checksrc: use `-a` when verifying the source code.
- GHA/checksrc: disable `So` and `But` rules for source code.
- GHA/checksrc: add docs/examples to the verified sources.
- badwords.txt: delete 4 duplicates.
- badwords.txt: group and sort contractions.
- badwords.txt: allow ` url = `, `DIR`, `<file name`.

Closes #19536
2025-11-15 13:25:02 +01:00
Viktor Szakats
af4c789e00
badwords: fix two exceptions and drop them
Also:
- extend `dir` rule to exclude C assignments.

Closes #19532
2025-11-14 17:32:04 +01:00
Daniel Stenberg
3d91ca8cdb
vquic-tls/gnutls: call Curl_gtls_verifyserver unconditionally
Closes #19531
2025-11-14 17:05:11 +01:00
Stefan Eissing
dc34498d18
cf-socket: trace ignored errors
Instead of blasting the user with infof() statements.

Reported-by: Aleksandr Sergeev
Fixes #19520
Closes #19527
2025-11-14 17:04:15 +01:00
Stefan Eissing
9f979ea683
vtls: pinned key check
Cleanup the vtls pinned key matching somewhat. Add a DEBUGF
for pinned key hashes that do not match, so we can see in
traces what was going on.

Ref #19489
Closes #19529
2025-11-14 17:01:44 +01:00
Stefan Eissing
0abb72210e
getinfo: improve perf in debug mode
Save some cpu cycles in debug mode for getinfo. Look up env vars for
overwriting variables only when variables are actually requested.

Closes #19525
2025-11-14 16:47:47 +01:00
Daniel Stenberg
9a633ec04f
connect: reshuffle Curl_timeleft_ms to avoid 'redundant condition'
Line 143: "if(duringconnect)" would always equal true. While this is
harmless, I believe this minor tweak makes the flow slightly more
obvious to the reader and avoids the redundant condition.

Pointed out by CodeSonar

Closes #19523
2025-11-14 15:12:58 +01:00
Viktor Szakats
ae7b4eeade
curl_setup.h: drop stray #undef stat (Windows)
Follow-up to 9678ff5b1b #18776

Closes #19519
2025-11-14 01:47:12 +01:00
Daniel Stenberg
0afb52a0cd
code: minor indent fixes before closing braces
Closes #19512
2025-11-13 17:27:40 +01:00
Daniel Stenberg
833c429627
wolfssl: simplify wssl_send_earlydata
Move out logic from a switch() expression and return error directly
instead of using goto. This also removes the odd-looking two subsequent
closing braces at the same indent level.

Closes #19509
2025-11-13 13:46:28 +01:00