Avoid dangling pointer in curl header.str

If buf_len is zero, this would leave behind a dangling pointer
to an already released header.str. Make sure this can't happen
by always over

Avoid dangling pointer in curl header.str

If buf_len is zero, this would leave behind a dangling pointer
to an already released header.str. Make sure this can't happen
by always overwriting the pointer.

Closes GH-7376.

show more ...

Fix curl_copy_handle() with CURLINFO_HEADER_OUT

The CURLOPT_DEBUGDATA will point to the old curl handle after
copying. Update it to point to the new handle.

We don't separately

Fix curl_copy_handle() with CURLINFO_HEADER_OUT

The CURLOPT_DEBUGDATA will point to the old curl handle after
copying. Update it to point to the new handle.

We don't separately store whether CURLINFO_HEADER_OUT is enabled,
so I'm doing this unconditionally. It should be harmless if
CURLOPT_DEBUGFUNCTION is not used.

show more ...

Add missing derefs in CurlFile

As pointed out on GH-6456.

Fix #80595: Resetting POSTFIELDS to empty array breaks request

This is mainly to work around https://github.com/curl/curl/issues/6455,
but not building the mime structure for empty hasht

Fix #80595: Resetting POSTFIELDS to empty array breaks request

This is mainly to work around https://github.com/curl/curl/issues/6455,
but not building the mime structure for empty hashtables is a general
performance optimization, so we do not restrict it to affected cURL
versions (7.56.0 to 7.75.0).

The minor change to bug79033.phpt is unexpected, but should not matter
in practice.

Closes GH-6606.

show more ...

Fixed bug #79741

Fix #79199: curl_copy_handle() memory leak

`curl_copy_handle()` already registers a new resource, so we must not
increase the refcount of the original resource.

Fix #79013: Content-Length missing when posting a curlFile with curl

Unfortunately, some Webservers (e.g. IIS) do not implement the (F)CGI
specifications correctly wrt. chunked uploads (

Fix #79013: Content-Length missing when posting a curlFile with curl

Unfortunately, some Webservers (e.g. IIS) do not implement the (F)CGI
specifications correctly wrt. chunked uploads (i.e. Transfer-encoding:
chunked), but instead pass -1 as CONTENT_LENGTH to the CGI
application. However, our (F)CFI SAPIs (i.e. cgi and cgi-fcgi) do not
support this.

Therefore we try to retrieve the stream size in advance and pass it to
`curl_mime_data_cb()` to prevent libcurl from doing chunked uploads.
This is basically the same approach that `curl_mime_filedata()`
implements, except that we are keeping already opened streams open for
the `read_cb()`.

show more ...

Fix #79019: Copied cURL handles upload empty file

To cater to `curl_copy_handle()` of cURL handles with attached
`CURLFile`s, we must not attach the opened stream, because the stream

Fix #79019: Copied cURL handles upload empty file

To cater to `curl_copy_handle()` of cURL handles with attached
`CURLFile`s, we must not attach the opened stream, because the stream
may not be seekable, so that we could rewind, when the same stream is
going to be uploaded multiple times. Instead, we're opening the stream
lazily in the read callback.

Since `curl_multi_perfom()` processes easy handles asynchronously, we
have no control of the operation sequence. Since duplicated cURL
handles may be used with multi handles, we cannot use a single arg
structure, but actually have to rebuild the whole mime structure on
handle duplication and attach this to the new handle.

In order to better test this behavior, we extend the test responder to
print the size of the upload, and patch the existing tests accordingly.

show more ...

Add CURLOPT CURLOPT_HTTP09_ALLOWED available since 7.64.0

Extract function

As suggested by Nikita[1].

[1] <https://github.com/php/php-src/pull/5045#discussion_r364265013>

Revert "Extend CURLFile to support streams"

This reverts commit 17a9f1401aeb35fe1e3657b38102a410d151d42f, because
this commit would break ABI, and also due to bug #79013.
We keep the

Revert "Extend CURLFile to support streams"

This reverts commit 17a9f1401aeb35fe1e3657b38102a410d151d42f, because
this commit would break ABI, and also due to bug #79013.
We keep the commit for PHP 7.4+, though.

show more ...

Don't link against openssl 1.1 in curl

OpenSSL 1.1 does not need crypto locking callbacks, so avoid
detecting and linking against it in the first place.

Clean up curl openssl check

Only set HAVE_CURL_OPENSSL flag, and remove Windows specific code,
as all of this is only relevant for OpenSSL < 1.1, which is not
used on Windows.

Fix #79033: Curl timeout error with specific url and post

We must not set an empty mime structure as `CURLOPT_MIMEPOST`; instead
we set it to `NULL` if `CURLOPT_POSTFIELDS` has been set

Fix #79033: Curl timeout error with specific url and post

We must not set an empty mime structure as `CURLOPT_MIMEPOST`; instead
we set it to `NULL` if `CURLOPT_POSTFIELDS` has been set to an empty
array.

show more ...

Extend CURLFile to support streams

Due to former restrictions of the libcurl API, curl multipart/formdata
file uploads supported only proper files. However, as of curl 7.56.0
the ne

Extend CURLFile to support streams

Due to former restrictions of the libcurl API, curl multipart/formdata
file uploads supported only proper files. However, as of curl 7.56.0
the new `curl_mime_*()` API is available (and already supported by
PHP[1]), which allows us to support arbitrary *seekable* streams, which
is generally desirable, and particularly resolves issues with the
transparent Unicode and long part support on Windows (see bug #77711).

Note that older curl versions are still supported, but CURLFile is
still restricted to proper files in this case.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=a83b68ba56714bfa06737a61af795460caa4a105>

(cherry picked from commit c68dc6b5e37e74d89e0a387079139c054c8faa81)

show more ...

Use curl_mime_*() functions if available

As of curl 7.56.0, `curl_formadd()` is deprecated in favor of
`curl_mime_*()`, so we use the latter if available.

(cherry picked from co

Use curl_mime_*() functions if available

As of curl 7.56.0, `curl_formadd()` is deprecated in favor of
`curl_mime_*()`, so we use the latter if available.

(cherry picked from commit a83b68ba56714bfa06737a61af795460caa4a105)

show more ...

Report errors from stream read and write operations

The php_stream_read() and php_stream_write() functions now return
an ssize_t value, with negative results indicating failure. Function

Report errors from stream read and write operations

The php_stream_read() and php_stream_write() functions now return
an ssize_t value, with negative results indicating failure. Functions
like fread() and fwrite() will return false in that case.

As a special case, EWOULDBLOCK and EAGAIN on non-blocking streams
should not be regarded as error conditions, and be reported as
successful zero-length reads/writes instead. The handling of EINTR
remains unclear and is internally inconsistent (e.g. some code-paths
will automatically retry on EINTR, while some won't).

I'm landing this now to make sure the stream wrapper ops API changes
make it into 7.4 -- however, if the user-facing changes turn out to
be problematic we have the option of clamping negative returns to
zero in php_stream_read() and php_stream_write() to restore the
old behavior in a relatively non-intrusive manner.

show more ...

Fixed bug #77946

Save multi_info_read() result into easy handle.

Fix CURLINFO_COOKIELIST leak

Don't warn if libcurl SSL library not detected

libcurl may link against 7 different ssl libraries, all of which
are thread-safe -- apart from openssl, of course. We check for
openssl

Don't warn if libcurl SSL library not detected

libcurl may link against 7 different ssl libraries, all of which
are thread-safe -- apart from openssl, of course. We check for
openssl and register locking callbacks in that case, but we should
not warn if any other library is used.

show more ...

Require semicolon after SAVE_CURL_ERROR()

Deprecate and ignore $version parameter of curl_version()

`curl_version()`[1] (of ext/curl) makes `curl_version_info()`[2] (of
libcurl) available to PHP userland. The latter requires to

Deprecate and ignore $version parameter of curl_version()

`curl_version()`[1] (of ext/curl) makes `curl_version_info()`[2] (of
libcurl) available to PHP userland. The latter requires to pass an
`age` argument which usually is `CURLVERSION_NOW`, so that the
information returned by the runtime matches the declarations used
during compile time. For C programs it is simply necessary to pass
this information, and in rare occasions it might make sense to pass
something else than `CURLVERSION_NOW`. curl.h notes:

| The 'CURLVERSION_NOW' is the symbolic name meant to be used by
| basically all programs ever that want to get version information.

For the PHP binding, using a newer `age` than available at compile time
will neither provide the PHP program more information, nor would using
an older `age` have tangible benefits.

We therefore deprecate the useless `$version` parameter, and if it is
passed nonetheless, we use `CURLVERSION_NOW` instead of the supplied
value, and raise a warning.

[1] <https://www.php.net/manual/en/function.curl-version.php>
[2] <https://curl.haxx.se/libcurl/c/curl_version_info.html>

show more ...

Add more missing CURL_VERSION_* constants

And also check for CURL_VERSION_* constants in the sync-constants.php
script.

Related to request #72189: Add missing `CURL_VERSION_*` c

Add more missing CURL_VERSION_* constants

And also check for CURL_VERSION_* constants in the sync-constants.php
script.

Related to request #72189: Add missing `CURL_VERSION_*` constants.

show more ...

Extend CURLFile to support streams

Due to former restrictions of the libcurl API, curl multipart/formdata
file uploads supported only proper files. However, as of curl 7.56.0
the ne

Extend CURLFile to support streams

Due to former restrictions of the libcurl API, curl multipart/formdata
file uploads supported only proper files. However, as of curl 7.56.0
the new `curl_mime_*()` API is available (and already supported by
PHP[1]), which allows us to support arbitrary *seekable* streams, which
is generally desirable, and particularly resolves issues with the
transparent Unicode and long part support on Windows (see bug #77711).

Note that older curl versions are still supported, but CURLFile is
still restricted to proper files in this case.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=a83b68ba56714bfa06737a61af795460caa4a105>

show more ...

Use curl_mime_*() functions if available

As of curl 7.56.0, `curl_formadd()` is deprecated in favor of
`curl_mime_*()`, so we use the latter if available.