Commit Graph

36115 Commits

Author SHA1 Message Date
Viktor Szakats
87cbeecee4
windows: stop passing unused, optional argument for Win9x compatibility
Expiry timestamp in `AcquireCredentialsHandle()` (SSPI) and
`InitializeSecurityContext()` (Schannel) calls. The argument is optional
in both. The returned value was never used in curl. The reason for
passing it was Windows 95 compatibility, according to comments in
the SSPI code. curl no longer supports Windows 95.

Ref: https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-acquirecredentialshandlea
Ref: https://learn.microsoft.com/windows/win32/secauthn/initializesecuritycontext--schannel

Ref: 3fe5311967
Ref: aaa42aa0d5

Closes #18490
2025-09-20 02:27:07 +02:00
Viktor Szakats
ad26a6cb99
tidy-up: avoid using the reserved macro namespace
To avoid hitting `-Wreserved-macro-identifier` where possible.

- amigaos: introduce local macro instead of reusing `__request()`.
- easy_lock: avoid redefining `__has_builtin()`.
  Follow-up to 33fd57b8ff #9062
- rand: drop interim macro `_random()`.
- windows: rename local macro `_tcsdup()` to `Curl_tcsdup()`.
  To avoid using the reserved macro namespace and to avoid
  colliding with `_tcsdup()` as defined by Windows headers.
- checksrc: ban `_tcsdup()` in favor of `Curl_tcsdup()`.
- tool_doswin: avoid redefining `_use_lfn()` (MS-DOS).
- tool_findfile: limit `__NO_NET_API` hack to AmigaOS.
  Syncing this pattern with `lib/netrc.c`.
  Follow-up to 784a8ec2c1 #16279
- examples/http2-upload: avoid reserved namespace for local macro.

More cases will be removed when dropping WinCE support via #17927.

Cases remain when defining external macros out of curl's control.

Ref: #18477
Closes #18482
2025-09-20 02:27:06 +02:00
Viktor Szakats
096fc4325b
digest_sspi: fix two memory leaks in error branches
Closes #18488
2025-09-20 01:28:35 +02:00
Viktor Szakats
91720b620e
cmake: add CURL_CODE_COVERAGE option
To sync up with the `--enable-code-coverage` `./configure` option.

Ref: https://gcc.gnu.org/onlinedocs/gcc/Invoking-Gcov.html
Ref: https://gcc.gnu.org/onlinedocs/gcc/Cross-profiling.html
Ref: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html

Closes #18468
2025-09-20 01:28:35 +02:00
Viktor Szakats
dc3f4fd89b
autotools: make --enable-code-coverage support llvm/clang
Cherry-picked from #18468

Closes #18473
2025-09-20 01:28:35 +02:00
Viktor Szakats
1c49f2f26d
windows: replace _beginthreadex() with CreateThread()
Replace `_beginthreadex()` C runtime calls with native win32 API
`CreateThread()`. The latter was already used in `src/tool_doswin.c`
and in UWP and Windows CE builds before this patch. After this patch
all Windows flavors use it. To drop PP logic and simplify code.

While working on this it turned out that `src/tool_doswin.c` calls
`TerminateThread()`, which isn't recommended by the documentation,
except for "the most extreme cases". This patch makes no attempt
to change that code.
Ref: 9a2663322c #17572
Ref: https://learn.microsoft.com/windows/win32/api/processthreadsapi/nf-processthreadsapi-terminatethread

Also:
- use `WaitForSingleObjectEx()` on all desktop Windows.
  Ref: 4be80d5109
  Ref: https://sourceforge.net/p/curl/feature-requests/82/
  Ref: https://learn.microsoft.com/windows/win32/api/synchapi/nf-synchapi-waitforsingleobjectex
- tests: drop redundant casts.
- lib3207: fix to not rely on thread macros when building without thread
  support.

Assisted-by: Jay Satiro
Assisted-by: Marcel Raad
Assisted-by: Michał Petryka
Follow-up to 38029101e2 #11625

Closes #18451
2025-09-20 01:28:35 +02:00
Viktor Szakats
8d004781a5
build: drop the winbuild build system
In favor of CMake.

Closes #18040
2025-09-20 01:20:25 +02:00
Daniel Stenberg
5e2d4d7905
base64: accept zero length argument to base64_encode
We used to treat 0 as "call strlen() to get the length" for
curlx_base64_encode, but it turns out this is rather fragile as we
easily do the mistake of passing in zero when the data is actually not
there and then calling strlen() is wrong.

Force the caller to pass in the correct size. A zero length input string
now returns a zero length output and a NULL pointer.

Closes #18617
2025-09-19 22:57:20 +02:00
Daniel Stenberg
a0369e1705
gtls: avoid potential use of uninitialized variable in trace output
Reported in Joshua's sarif data

Closes #18620
2025-09-19 22:55:52 +02:00
Daniel Stenberg
58f071dbe4
tool_getparam/set_rate: skip the multiplication on overflow
The code detected the problem but didn't avoid the calculation
correctly.

Fixes #18624
Reported-by: BobodevMm on github
Closes #18625
2025-09-19 22:54:57 +02:00
Daniel Stenberg
b0c823b86f
RELEASE-NOTES: synced
and bump to 8.17.0
2025-09-19 16:47:01 +02:00
Daniel Stenberg
fd6eb8d6e7
cookie: avoid saving a cookie file if no transfer was done
Because parts of the cookie loading happens on transfer start the
in-memory cookie jar risks being incomplete and then a save might
wrongly truncate the target file.

Added test 1902 to verify.

Reported-by: divinity76 on github
Fixes #18621
Closes #18622
2025-09-19 16:40:20 +02:00
Daniel Stenberg
1055864b03
telnet: make printsub require another byte input
Reported in Joshua's sarif data

Closes #18618
2025-09-19 14:40:09 +02:00
Daniel Stenberg
df60e8fe70
cf_socket_recv: don't count reading zero bytes as first byte
Reported in Joshua's sarif data

Closes #18615
2025-09-19 14:39:15 +02:00
Daniel Stenberg
4f5528675a
libssh: react on errors from ssh_scp_read
Reported in Joshua's sarif data

Closes #18616
2025-09-19 14:38:20 +02:00
Viktor Szakats
b2356a3197
GHA: tidy up actions/checkout version in comments [ci skip] 2025-09-19 14:20:14 +02:00
Viktor Szakats
9618c337d1
GHA/codeql: try disabling the TRAP cache
The `cpp` CodeQL job is adding a cache entry for each run on the master
branch. One for Linux, another for Windows. Size: 68MB + 180MB = 248MB.
In one week we got 50+ such entries, almost filling the available cache
space.

Following the recommendation in an open issue thread, this patch tries
to disable this cache. Since it only affects master, the effect can only
be verified after merging.

The latest cache is picked up in PRs. The performance impact is also to
be seen after merge.

Bug: https://github.com/curl/curl/pull/18528#issuecomment-3288950880
Ref: https://github.com/github/codeql-action/pull/1172
Ref: https://github.com/github/codeql-action/issues/2030
Ref: https://github.com/github/codeql-action/issues/2885#issuecomment-2879069087

Follow-up to cc50f05370 #18528

Closes #18613
2025-09-19 11:30:39 +02:00
Viktor Szakats
0d9a07abb7
libssh2: drop two redundant null-terminations
The null-termination was first added in the initial SFTP commit in 2006:
a634f64400

At that time this was a reasonable concern because libssh2 started
null-terminating this string just one year prior, in 2005:
efc3841fd2

This fix was released in libssh2 v0.13 (2006-03-02).

curl requires libssh2 v1.2.8, making this workaround no longer necessary.

Follow-up to 9f18cb6544 #18598

Closes #18606
2025-09-19 09:46:45 +02:00
Daniel Stenberg
9fb8d567ca
tool_operate: keep the progress meter for --out-null
Fixes #18607
Closes #18609
2025-09-19 09:13:12 +02:00
Viktor Szakats
9f18cb6544
libssh2: error check and null-terminate in ssh_state_sftp_readdir_link()
- null-terminate the result to match the other getter
  `libssh2_sftp_symlink_ex()` call.

- check negative result and bail out early.

Reported-by: Joshua Rogers

Closes #18598
2025-09-18 22:01:27 +02:00
Viktor Szakats
cec6c1cd9c
GHA/codeql: make it run on docs updates, to verify examples
Follow-up to b4922b1295 #18564
2025-09-18 20:26:27 +02:00
Viktor Szakats
f13250edf1
examples: fix two issues found by CodeQL
- http2-upload: use `fstat()` to query file length to fix TOCTOU.

- ftpuploadresume: fix checking `sscanf()` return value.

Follow-up to b4922b1295 #18564
Closes #18605
2025-09-18 20:14:21 +02:00
Jay Satiro
ce354d0f4d tool_operate: Improve wording in retry message
- Use the plural 'seconds' for anything other than exactly 1 second.

Before: Will retry in 1.250 second.
After: Will retry in 1.250 seconds.

Follow-up to ca034e83.

Closes https://github.com/curl/curl/pull/18604
2025-09-18 12:09:02 -04:00
Daniel Stenberg
54aff4db3c
tftp: check and act on tftp_set_timeouts() returning error
Reported-by: Joshua Rogers
Ref: https://github.com/curl/curl/pull/18574#issuecomment-3300183302
Closes #18603
2025-09-18 17:54:13 +02:00
Joshua Rogers
ad147ec53d
tftp: propagate expired timer from tftp_state_timeout()
When Curl_timeleft() < 0 we used to return 0, masking the expiry and
skipping the caller’s (timeout_ms < 0) path. Now we set FIN and return
the negative value so tftp_multi_statemach() aborts with
CURLE_OPERATION_TIMEDOUT as intended.

Closes #18574
2025-09-18 17:34:31 +02:00
Jay Satiro
f8175b1536 socks_sspi: Fix some memory cleanup calls
- Ensure memory allocated by malloc() is freed by free().

Prior to this change SSPI's FreeContextBuffer() was sometimes used to
free malloc'd memory. I can only assume the reason we have no crash
reports about this is because the underlying heap free is probably the
same for both.

Reported-by: Joshua Rogers

Fixes https://github.com/curl/curl/issues/18587
Closes https://github.com/curl/curl/pull/18594
2025-09-18 11:29:15 -04:00
Joshua Rogers
a80abc45a5
sasl: clear canceled mechanism instead of toggling it
Use &= ~authused in SASL_CANCEL (was ^=) to actually remove the offending
mechanism and avoid re-enabling a disabled mech on retry.

Closes #18573
2025-09-18 17:27:29 +02:00
Daniel Stenberg
44a586472b
ldap: do not base64 encode zero length string
Reported-by: Joshua Rogers
Closes #18602
2025-09-18 17:15:30 +02:00
Viktor Szakats
b4922b1295
GHA/codeql: enable cares, debug, build curlinfo, examples
Also build examples, out of curiousity, as an experiment, possibly
temporary. It needs around 40 seconds.

Closes #18564
2025-09-18 16:48:17 +02:00
Daniel Stenberg
232d5a2ed9
openldap: avoid indexing the result at -1 for blank responses
Reported-by: Joshua Rogers

Closes #18600
2025-09-18 16:06:33 +02:00
Daniel Stenberg
5cc2b83446
smb: adjust buffer size checks
The checks did not account for the **two byte** 16bit read so risked
reading one more byte than what actually was received.

Reported-by: Joshua Rogers

Closes #18599
2025-09-18 16:05:33 +02:00
Stefan Eissing
0f08211330
cfilter: unlink and discard
Rewrite the code that removes a filter from the connection and discards
it. Always look at the connection, otherwise it will not work of the
filter is at the top of the chain.

Change QUIC filter setup code to always tear down the chain in
construction when an error occured.

HTTP proxy, do not remove the h1/h2 sub filter on close. Leave it to be
discarded with the connection. Avoids keeping an additional pointer that
might become dangling.

Triggered by a reported on a code bug in discard method.

Reported-by: Joshua Rogers
Closes #18596
2025-09-18 12:20:26 +02:00
Daniel Stenberg
ca034e839c
tool: fix exponential retry delay
Also, show retry delay with decimals since it might be not be integer
seconds.

Regression from da27db068f (shipped in 8.16.0)

Reported-by: Andrew Olsen
Fixes #18591
Assisted-by: Jay Satiro
Closes #18595
2025-09-18 10:15:54 +02:00
Joshua Rogers
4e74b9f592
socks_sspi: restore non-blocking socket on error paths
Closes #18592
2025-09-18 08:13:52 +02:00
Joshua Rogers
20f757ef14
tool_cb_hdr: fix fwrite check in header callback
Compare fwrite result to nmemb (items), not cb (bytes).

Closes #18593
2025-09-18 08:04:47 +02:00
Daniel Stenberg
a827e4294c
smtp: check EHLO responses case insensitively
Adjust test 980 to announce starttls in lowercase.

Fixes #18588
Reported-by: Joshua Rogers
Closes #18589
2025-09-18 08:02:12 +02:00
Christian Schmitz
3031fae3bd
multi.h: add CURLMINFO_LASTENTRY
For multiple enums, we use LASTENTRY values to do range checks when
receiving an option as integer. So I added LASTENTRY, so the check will
work, even if you add more options later.

Closes #18578
2025-09-17 23:14:38 +02:00
Michael Osipov
74fdc1185f
configure: add "-mt" for pthread support on HP-UX
HP-UX requires this compiler and linker flag to pass proper macros and
add required libraries.

Closes #18585
2025-09-17 23:12:43 +02:00
Christian Schmitz
0f067ba4aa
libcurl-multi.md: added curl_multi_get_offt mention
The multi interface page didn't mention the new curl_multi_get_offt
function.

Closes #18579
2025-09-17 23:11:38 +02:00
Daniel Stenberg
dbe4e28d57
managen: render better manpage references/links
- When an option name is used in text, this script no longer outputs the
  short plus long version in the manpage output. It makes the text much
  more readable.

  This always showing both verions was previously done primarily to make
  sure roffit would linkify it correctly, but since roffit 0.17 it
  should link both long or short names correctly.

- When managen outputs generic text about options at the end of the
  description it now highlights them properly so that they too get
  linkified correctly in the HTML version. For consistency.

Closes #18580
2025-09-17 15:49:15 +02:00
Daniel Stenberg
0a27a506b1
managen: ignore version mentions < 7.66.0
Only mention version specific details for versions from within the last
six years.

Closes #18583
2025-09-17 15:47:34 +02:00
Daniel Stenberg
04e08664a8
RELEASE-NOTES: synced 2025-09-17 10:30:31 +02:00
Daniel Stenberg
9236199908
setopt: make CURLOPT_MAXREDIRS accept -1 (again)
Regression from b059f7d (shipped in 8.16.0)

Reported-by: Adam Light
Fixes #18571
Closes #18576
2025-09-17 08:58:32 +02:00
Daniel Stenberg
3053a3e90f
docs/libcurl: use lowercase must
To shout less. Use bold in some places.

Closes #18570
2025-09-16 17:12:26 +02:00
renovate[bot]
22ac7f30ad
GHA: update openssl/openssl to v3.5.3
Closes #18566
2025-09-16 16:58:09 +02:00
Daniel Stenberg
cdb56c6666
docs/libcurl: clarify some timeout option behavior
Closes #18569
2025-09-16 16:57:28 +02:00
Stefan Eissing
ff8dfd315c
aws-lc: re-enable large read-ahead with v1.61.0 again
AWS-LC fixed a bug with large read ahead buffers in v1.61.0. Check a
define introduced in that version to enable the large read ahead again.

AWS-LC issue: https://github.com/aws/aws-lc/issues/2650

Closes #18568
2025-09-16 16:55:11 +02:00
Viktor Szakats
ea752b575c
sws: fix checking sscanf() return value
Closes #18565
2025-09-16 13:34:51 +02:00
Viktor Szakats
619307feb0
cmake: fix building docs when the base directory contains .3
Fixing:
```
ninja: error: '<...>/basedir.md/_bld/docs/libcurl/libcurl-symbols.md',
  needed by 'docs/libcurl/curl_easy_cleanup.3', missing and no known rule to make it
```

Reported-by: Nir Azkiel
Fixes #18560
Follow-up to 898b012a9b #1288
Closes #18563
2025-09-16 12:37:11 +02:00
Viktor Szakats
f6ddc1fc1e
Makefile.example: simplify and make it configurable
- build in a single step.

- allow overriding all variables:
  source, target, compiler, libpaths, libs, flags.

Example:
```shell
LIBS= LDFLAGS= SRC=altsvc.c make -f Makefile.example
```

Closes #18554
2025-09-16 11:25:55 +02:00