digest: replace strcpy for empty string with simple assignment

Closes #13586

autotools: fix `HAVE_IOCTLSOCKET_FIONBIO` test for gcc 14

```
conftest.c:152:41: error: passing argument 3 of 'ioctlsocket' from incompatible pointer type [-Wincompatible-pointer-types]

autotools: fix `HAVE_IOCTLSOCKET_FIONBIO` test for gcc 14

```
conftest.c:152:41: error: passing argument 3 of 'ioctlsocket' from incompatible pointer type [-Wincompatible-pointer-types]
152 | if(0 != ioctlsocket(0, FIONBIO, &flags))
| ^~~~~~
| |
| int *
```

Reported-by: LigH
Fixes #13579
Closes #13587

show more ...

CI: ignore test 286 on Appveyor gcc 7 build

Disabled earlier for gcc 9 builds. gcc 7 uses the same runner and
prone to similar intermittent failures.

Follow-up to f1e05a6e6e7225

CI: ignore test 286 on Appveyor gcc 7 build

Disabled earlier for gcc 9 builds. gcc 7 uses the same runner and
prone to similar intermittent failures.

Follow-up to f1e05a6e6e7225fa09952abb2c935ae1abe44f45 #12106 #12040
Closes #13575

show more ...

cf-socket: don't try getting local IP without socket

In cf_tcp_connect(), it might fail and not get a socket assigned to
ctx->sock but set_local_ip() is still called which would make

cf-socket: don't try getting local IP without socket

In cf_tcp_connect(), it might fail and not get a socket assigned to
ctx->sock but set_local_ip() is still called which would make
getsockname() get invoked with a negative file desriptor and fail.

By adding this check, set_local_ip() will now instead blank out the
fields correctly.

Spotted by CodeSonar

Closes #13577

show more ...

tool_getparam: remove two redundant conditions

When getstr() does not return error, it returns a valid pointer.

Spotted by CodeSonar

Closes #13576

quiche: trust its timeout handling

- set the idle timeout transport parameter
in milliseconds as documented by quiche
- do not calculate the idle timeout, rely on
quiche hand

quiche: trust its timeout handling

- set the idle timeout transport parameter
in milliseconds as documented by quiche
- do not calculate the idle timeout, rely on
quiche handling it

Closes #13581

show more ...

dmaketgz: accept a SOURCE_DATE_EPOCH as an second argument

to make it easier to reproduce a tarball

Closes #13573

RELEASE-NOTES: synced

h3/ngtcp2: improve error handling

- identify ngtcp2 and nghttp3 error codes that are fatal
- close quic connection on fatal errors
- refuse further filter operations once connection

h3/ngtcp2: improve error handling

- identify ngtcp2 and nghttp3 error codes that are fatal
- close quic connection on fatal errors
- refuse further filter operations once connection is closed
- confusion about the nghttp3 API. We should close the QUIC stream on
cancel and not use the nghttp3 calls intended to be invoked when the
QUIC stream was closed by the peer.

Closes #13562

show more ...

docs: fix some CURLINFO examples

- improve getinfo result check for example sections:
CURLINFO_ACTIVESOCKET, CURLINFO_LASTSOCKET, CURLINFO_SSL_VERIFYRESULT,
CURLINFO_PROXY_SSL_VE

docs: fix some CURLINFO examples

- improve getinfo result check for example sections:
CURLINFO_ACTIVESOCKET, CURLINFO_LASTSOCKET, CURLINFO_SSL_VERIFYRESULT,
CURLINFO_PROXY_SSL_VERIFYRESULT

- fix getinfo result check for example sections:
CURLINFO_NUM_CONNECTS, CURLINFO_OS_ERRNO

- fix verify result check for example sections:
CURLINFO_PROXY_SSL_VERIFYRESULT

Bug: https://github.com/curl/curl/discussions/13557#discussion-6625507
Reported-by: farazrbx@users.noreply.github.com

Closes https://github.com/curl/curl/pull/13559

show more ...

KNOWN_BUGS: gssapi library name + version is missing in curl_version_info()

Closes #13492
Closes #13570

krb5: use dynbuf

Closes #13568

managen: fix the option sort order

... it used to strip off the .d file extension to sort correctly but
ever since the extension changed to .md the operation failed and the
sort got

managen: fix the option sort order

... it used to strip off the .d file extension to sort correctly but
ever since the extension changed to .md the operation failed and the
sort got wrong.

Follow-up to 2494b8dd5175cee7f2e

Closes #13567

show more ...

GHA: repair the linux-old job

package libc6_2.28-10+deb10u2_amd64.deb changed to
libc6_2.28-10+deb10u3_amd64.deb

Closes #13564

appveyor: make gcc 6 mingw64 job build-only

This job has proven to be the flakiest of all, and it's also the oldest
Windows runner we had tests running on: 'Visual Studio 2015', that is

appveyor: make gcc 6 mingw64 job build-only

This job has proven to be the flakiest of all, and it's also the oldest
Windows runner we had tests running on: 'Visual Studio 2015', that is
running on Windows Server 2012 R2:
https://www.appveyor.com/docs/windows-images-software/

Turn off tests on this job to help stabilizing CI runs.

This was also one of the slowest running job amongst the AppVeyor CI ones.

Flakiness data:
https://testclutch.curl.se/static/reports/summary.html
Entries:
Appveyor / CMake, mingw-w64, gcc 6, Debug, x86, Schannel, Static, no-unity (curl) [current]
Appveyor / CMake, mingw-w64, gcc 6, Debug, x86, Schannel, Static (curl) [former]

Closes #13566

show more ...

unit2604: use alloc instead of overlong string const

Closes #13563

bufq: remove duplicate word in comment

Inspired by 13552.

Closes: #13554
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

lib/cf-h1-proxy: silence compiler warnings (gcc 14)

They came up ealier with gcc 12 (Windows), but apparently gcc 14 is
still reporting them, also under Linux.

```
/home/run

lib/cf-h1-proxy: silence compiler warnings (gcc 14)

They came up ealier with gcc 12 (Windows), but apparently gcc 14 is
still reporting them, also under Linux.

```
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c: In function 'cf_h1_proxy_close':
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:1060:17: warning: null pointer dereference [-Wnull-dereference]
1060 | cf->connected = FALSE;
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:1061:8: warning: null pointer dereference [-Wnull-dereference]
1061 | if(cf->ctx) {
| ~~^~~~~
In function 'tunnel_free',
inlined from 'cf_h1_proxy_destroy' at /home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:1053:3:
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:198:27: warning: null pointer dereference [-Wnull-dereference]
198 | struct h1_tunnel_state *ts = cf->ctx;
| ^~
```
Ref: https://github.com/curl/curl-for-win/actions/runs/8985369476/job/24679219528#step:3:6320

Fixes #13237
Closes #13555

show more ...

mbedtls: support TLS 1.3

Closes #13539

version: use msnprintf instead of strncpy

- to ensure a terminating null byte
- to avoid zero-padding the target

debug code only

Closes #13549

curl_path: make Curl_get_pathname use dynbuf

... instead of malloc and memcpy

- unit test 2604 verifies Curl_get_pathname()

Closes #13550

lib: make protocol handlers store scheme name lowercase

- saves a lowercase operation when the "[scheme]_proxy" name is
generated
- appears less "shouting"
- update test 970, 9

lib: make protocol handlers store scheme name lowercase

- saves a lowercase operation when the "[scheme]_proxy" name is
generated
- appears less "shouting"
- update test 970, 972, 1438 and 1536

Closes #13553

show more ...

lib: remove two instances of "only only" messages

Fixes #13551
Reported-by: Lucas Nussbaum
Closes #13552

asyn-thread: fix curl_global_cleanup crash in Windows

- Make sure that asynchronous resolves handled by Winsock are stopped
before WSACleanup is called.

This is implemented by

asyn-thread: fix curl_global_cleanup crash in Windows

- Make sure that asynchronous resolves handled by Winsock are stopped
before WSACleanup is called.

This is implemented by ensuring that when Curl_resolver_kill is called
(eg via multi_done) it will cancel the Winsock asynchronous resolve and
wait for the cancellation to complete. Winsock runs the asynchronous
completion routine immediately when a resolve is canceled.

Prior to this change it was possible that during curl_global_cleanup
"a DNS resolver thread created by GetAddrInfoExW did not terminate yet,
however curl is already shutting down, deinitializing Winsock with
WSACleanup() leading to an access violation."

Background:

If libcurl is built with the asynchronous threaded resolver option for
Windows then it resolves in one of two ways. For Windows 8.1 and later,
libcurl resolves by using the Winsock asynchronous resolver which does
its own thread management. For older versions of Windows, libcurl
resolves by creating a separate thread that calls getaddrinfo. This
change only affects the former and it's already handled for the latter.

Reported-by: Ch40zz@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/13509
Closes https://github.com/curl/curl/pull/13518

show more ...

asyn-thread: fix Curl_thread_create result check

- Compare to curl_thread_t_null instead of 0 for error.

Currently for both supported thread libraries (pthreads and Windows)
cur

asyn-thread: fix Curl_thread_create result check

- Compare to curl_thread_t_null instead of 0 for error.

Currently for both supported thread libraries (pthreads and Windows)
curl_thread_t_null is defined as 0. However, the pattern throughout the
code is to check against curl_thread_t_null and not 0 since for
posterity some thread library may not use 0 for error.

Closes https://github.com/curl/curl/pull/13542

show more ...