tool_operate: more transfer cleanup after parallel transfer fail

In some circumstances when doing parallel transfers, the
single_transfer_cleanup() would not be called and then 'inglob'

tool_operate: more transfer cleanup after parallel transfer fail

In some circumstances when doing parallel transfers, the
single_transfer_cleanup() would not be called and then 'inglob' could
leak.

Test 496 verifies

Reported-by: Trail of Bits
Closes #9749

show more ...

mqtt: spell out CONNECT in comments

Instead of calling it 'CONN' in several comments, use the full and
correct protocol packet name.

Suggested by Trail of Bits

Closes #

mqtt: spell out CONNECT in comments

Instead of calling it 'CONN' in several comments, use the full and
correct protocol packet name.

Suggested by Trail of Bits

Closes #9751

show more ...

CURLOPT_POSTFIELDS.3: refer to CURLOPT_MIMEPOST

Not the deprecated CURLOPT_HTTPPOST option.

Also added two see-alsos.

Reported-by: Trail of Bits
Closes #9752

RELEASE-NOTES: synced

ngtcp2: Fix build errors due to changes in ngtcp2 library

ngtcp2/ngtcp2@b0d86f60 changed:

- ngtcp2_conn_get_max_udp_payload_size =>
ngtcp2_conn_get_max_tx_udp_payload_size

ngtcp2: Fix build errors due to changes in ngtcp2 library

ngtcp2/ngtcp2@b0d86f60 changed:

- ngtcp2_conn_get_max_udp_payload_size =>
ngtcp2_conn_get_max_tx_udp_payload_size

- ngtcp2_conn_get_path_max_udp_payload_size =>
ngtcp2_conn_get_path_max_tx_udp_payload_size

ngtcp2/ngtcp2@ec59b873 changed:

- 'early_data_rejected' member added to ng_callbacks.

Assisted-by: Daniel Stenberg
Reported-by: jurisuk@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/9747
Closes https://github.com/curl/curl/pull/9748

show more ...

curl_path: return error if given a NULL homedir

Closes #9740

libssh: if sftp_init fails, don't get the sftp error code

This flow extracted the wrong code (sftp code instead of ssh code), and
the code is sometimes (erroneously) returned as zero any

libssh: if sftp_init fails, don't get the sftp error code

This flow extracted the wrong code (sftp code instead of ssh code), and
the code is sometimes (erroneously) returned as zero anyway, so skip
getting it and set a generic error.

Reported-by: David McLaughlin
Fixes #9737
Closes #9740

show more ...

mqtt: return error for too long topic

Closes #9744

tool_paramhlp: make the max argument a 'double'

To fix compiler warnings "Implicit conversion from 'long' to 'double'
may lose precision"

Closes #9700

cirrus-ci: add more macOS builds with m1 based on x86_64 builds

Also refactor macOS builds to use task matrix.

Assisted-by: Marc Hörsken
Closes #9565

cmake: set HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID on Windows

`lib/config-win32.h` enables this configuration option unconditionally.
Make it apply to CMake builds as well.

While here,

cmake: set HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID on Windows

`lib/config-win32.h` enables this configuration option unconditionally.
Make it apply to CMake builds as well.

While here, delete a broken check for
`HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID` from `CMakeLists.txt`. This came with
the initial commit [1], but did not include the actual verification code
inside `CMake/CurlTests.c`, so it always failed. A later commit [2]
added a second test, for non-Windows platforms.

Enabling this flag causes test 1056 to fail with CMake builds, as they
do with autotools builds. Let's apply the same solution and ignore the
results here as well.

[1] 4c5307b45655ba75ab066564afdc0c111a8b9291
[2] aec7c5a87c8482b6ddffa352d7d220698652262e

Reviewed-by: Daniel Stenberg
Assisted-by: Marcel Raad

Closes #9726

show more ...

cmake: set HAVE_GETADDRINFO_THREADSAFE on Windows

autotools enables this configuration option unconditionally for Windows
[^1]. Do the same in CMake.

The above will make this wo

cmake: set HAVE_GETADDRINFO_THREADSAFE on Windows

autotools enables this configuration option unconditionally for Windows
[^1]. Do the same in CMake.

The above will make this work for all reasonably recent environments.
The logic present in `lib/config-win32.h` [^2] has the following
exceptions which we did not cover in this CMake update:

- Builds targeting Windows 2000 and earlier
- MS Visual C++ 5.0 (1997) and earlier

Also make sure to disable this feature when `HAVE_GETADDRINFO` isn't
set, to avoid a broken build. We might want to handle that in the C
sources in a future commit.

[^1]: https://github.com/curl/curl/blob/68fa9bf3f5d7b4fcbb57619f70cb4aabb79a51f6/m4/curl-functions.m4#L2067-L2070

[^2]: https://github.com/curl/curl/blob/68fa9bf3f5d7b4fcbb57619f70cb4aabb79a51f6/lib/config-win32.h#L511-L528

Closes #9727

show more ...

cmake: sync HAVE_SIGNAL detection with autotools

`HAVE_SIGNAL` means the availability of the `signal()` function in
autotools, while in CMake it meant the availability of that function

cmake: sync HAVE_SIGNAL detection with autotools

`HAVE_SIGNAL` means the availability of the `signal()` function in
autotools, while in CMake it meant the availability of that function
_and_ the symbol `SIGALRM`.

The latter is not available on Windows, but the function is, which means
on Windows, autotools did define `HAVE_SIGNAL`, but CMake did not,
introducing a slight difference into the binaries.

This patch syncs CMake behaviour with autotools to look for the function
only.

The logic came with the initial commit adding CMake support to curl, so
the commit history doesn't reveal the reason behind it. In any case,
it's best to check the existence of `SIGALRM` directly in the source
before use. For now, curl builds fine with `HAVE_SIGNAL` enabled and
`SIGALRM` missing.

Follow-up to 68fa9bf3f5d7b4fcbb57619f70cb4aabb79a51f6

Closes #9725

show more ...

cmake: delete duplicate HAVE_GETADDRINFO test

A custom `HAVE_GETADDRINFO` check came with the initial CMake commit
[1]. A later commit [2] added a standard check for it as well. The

cmake: delete duplicate HAVE_GETADDRINFO test

A custom `HAVE_GETADDRINFO` check came with the initial CMake commit
[1]. A later commit [2] added a standard check for it as well. The
standard check run before the custom one, so CMake ignored the latter.

The custom check was also non-portable, so this patch deletes it in
favor of the standard check.

[1] 4c5307b45655ba75ab066564afdc0c111a8b9291
[2] aec7c5a87c8482b6ddffa352d7d220698652262e

Closes #9731

show more ...

tool_formparse: unroll the NULL_CHECK and CONST_FREE macros

To make the code read more obvious

Assisted-by: Jay Satiro

Closes #9710

docs/INSTALL: update Android Instructions for newer NDKs

Closes #9732

markdown-uppercase: ignore quoted sections

Sections within the markdown ~~~ or ``` are now ignored.

Closes #9733

RELEASE-NOTES: synced

test8: update as cookies no longer can have "embedded" TABs in content

test1105: extend to verify TAB in name/content discarding cookies

cookie: reject cookie names or content with TAB characters

TABs in name and content seem allowed by RFC 6265: "the algorithm strips
leading and trailing whitespace from the cookie name a

cookie: reject cookie names or content with TAB characters

TABs in name and content seem allowed by RFC 6265: "the algorithm strips
leading and trailing whitespace from the cookie name and value (but
maintains internal whitespace)"

Cookies with TABs in the names are rejected by Firefox and Chrome.

TABs in content are stripped out by Firefox, while Chrome discards the
whole cookie.

TABs in cookies also cause issues in saved netscape cookie files.

Reported-by: Trail of Bits

URL: https://curl.se/mail/lib-2022-10/0032.html
URL: https://github.com/httpwg/http-extensions/issues/2262

Closes #9659

show more ...

curl/add_parallel_transfers: better error handling

1 - consider the transfer handled at once when in the function, to avoid
the same list entry to get added more than once in rare er

curl/add_parallel_transfers: better error handling

1 - consider the transfer handled at once when in the function, to avoid
the same list entry to get added more than once in rare error
situations

2 - set the ERRORBUFFER for the handle first after it has been added
successfully

Reported-by: Trail of Bits

Closes #9729

show more ...

netrc: remove the two 'changed' arguments

As no user of these functions used the returned content.

test495: verify URL encoded user name + netrc-optional

Reproduced issue #9709

netrc: use the URL-decoded user

When the user name is provided in the URL it is URL encoded there, but
when used for authentication the encoded version should be used.

Regressio

netrc: use the URL-decoded user

When the user name is provided in the URL it is URL encoded there, but
when used for authentication the encoded version should be used.

Regression introduced after 7.83.0

Reported-by: Jonas Haag
Fixes #9709
Closes #9715

show more ...