url: check sasl additional parameters for connection reuse.

Also move static function safecmp() as non-static Curl_safecmp() since
its purpose is needed at several places.

Bug:

url: check sasl additional parameters for connection reuse.

Also move static function safecmp() as non-static Curl_safecmp() since
its purpose is needed at several places.

Bug: https://curl.se/docs/CVE-2022-22576.html

CVE-2022-22576

Closes #8746

show more ...

libssh2: compare sha256 strings case sensitively

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1549435
Closes #8744

tool_getparam: error out on missing -K file

Add test 411 to verify.

Reported-by: Median Median Stride
Bug: https://hackerone.com/reports/1542881
Closes #8731

ngtcp2: deal with sub-millisecond timeout

Closes #8738

misc: update copyright year ranges

c_escape: escape '?' in generated --libcurl code

In order to avoid the risk of it being used in an accidental trigraph in
the generated code.

Reported-by: Harry Sintonen
Bug

c_escape: escape '?' in generated --libcurl code

In order to avoid the risk of it being used in an accidental trigraph in
the generated code.

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1548535
Closes #8742

show more ...

mlc: curl.zuul.vexxhost.dev is reachable again

remove it from ignorelist for linkcheck

Closes #8736

ngtcp2: avoid busy loop in low CWND situation

Closes #8739

TODO: telnet - exit immediately upon connection if stdin is /dev/null

Suggested-by: Robin A. Meade
URL: https://curl.se/mail/archive-2022-04/0027.html

docs: updates spellings with full words

Closes #8730

tests/FILEFORMAT.md: spellfix

misc: fix typos

Fix a few random typos is comments and workflow names.

macos: fix .plist installation into framework

The copy command introduced in e498a9b1f had leftover '>' from the
previous sed command it replaced, which broke its syntax. Fix by
rem

macos: fix .plist installation into framework

The copy command introduced in e498a9b1f had leftover '>' from the
previous sed command it replaced, which broke its syntax. Fix by
removing.

Reported-by: Emanuele Torre <torreemanuele6@gmail.com>

show more ...

Makefile: fix ca-bundle due to mk-ca-bundle.pl being moved

The script was moved in 8e22fc68e7dda43e9f but the lines that called it
was not changed to reflect it's new position

S

Makefile: fix ca-bundle due to mk-ca-bundle.pl being moved

The script was moved in 8e22fc68e7dda43e9f but the lines that called it
was not changed to reflect it's new position

Signed-off-by: Christopher Degawa <ccom@randomderp.com>

Closes #8728

show more ...

macos: set .plist version in autoconf

Set the libcurl version in libcurl.plist like how libcurl.vers is
created.

Closes: #8692
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

macos: set .plist version in autoconf

Set the libcurl version in libcurl.plist like how libcurl.vers is
created.

Closes: #8692
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Nick Zitzmann <nickzman@gmail.com>

show more ...

cookies: Improve errorhandling for reading cookiefile

The existing programming had some issues with errorhandling for reading
the cookie file. If the file failed to open, we would silent

cookies: Improve errorhandling for reading cookiefile

The existing programming had some issues with errorhandling for reading
the cookie file. If the file failed to open, we would silently ignore it
and continue as if there was no file (or stdin) passed. In this case, we
would also call fclose() on the NULL FILE pointer, which is undefined
behavior. Fix by ensuring that the FILE pointer is set before calling
fclose on it, and issue a warning in case the file cannot be opened.
Erroring out on nonexisting file would break backwards compatibility of
very old behavior so we can't really go there.

Closes: #8699
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Jay Satiro <raysatiro@yahoo.com>

show more ...

libcurl-tutorial.3: spellfix and minor polish

CURLINFO_PRIMARY_PORT.3: spellfix

Reported-by: Patrick Monnerat

libssh: fix double close

libssh closes the socket in ssh_diconnect() so make sure that libcurl
does not also close it.

Fixes #8708
Closes #8718

unit1620: call global_init before calling Curl_open

Curl_open calls the resolver init and on Windows if the resolver backend
is c-ares then the Windows sockets library (winsock) must alr

unit1620: call global_init before calling Curl_open

Curl_open calls the resolver init and on Windows if the resolver backend
is c-ares then the Windows sockets library (winsock) must already have
been initialized (via global init).

Ref: https://github.com/curl/curl/pull/8540#issuecomment-1059771800

Closes https://github.com/curl/curl/pull/8719

show more ...

CURLINFO_PRIMARY_PORT.3: clarify which port this is

As it was not entirely clear previously.

Closes #8725

CURLOPT_UNRESTRICTED_AUTH.3: extended explanation

Include details about Authentication headers.

Reported-by: Brad Spencer
Fixes #8724
Closes #8726

.github/workflows/macos.yml: add a libssh job with c-ares

... to enable the memdebug system

Closes #8720

RELEASE-NOTES: synced

docs/HTTP3.md: fix typo

also fix msh3 section formatting

Ref: https://github.com/curl/curl/commit/37492ebb#r70980087