Curl_parsenetrc: don't access local pwbuf outside of scope

Accessing local variables outside of the scope is forbidden and
depending on the compiler can result in the value being
ove

Curl_parsenetrc: don't access local pwbuf outside of scope

Accessing local variables outside of the scope is forbidden and
depending on the compiler can result in the value being
overwritten. Fixed by moving the pwbuf to be in scope.

Closes #8850

show more ...

RELEASE-NOTES: synced

and bump curlver to 7.83.2 for now (but likely to become 7.84.0 soon)

ci: update github actions

- bump actions/checkout from 2 to 3
- bump actions/upload-artifact from 1 to 3
- bump github/codeql-actions from 1 to 2
- use version tag for actions/ch

ci: update github actions

- bump actions/checkout from 2 to 3
- bump actions/upload-artifact from 1 to 3
- bump github/codeql-actions from 1 to 2
- use version tag for actions/checkout

Closes #8843

show more ...

test1919: verify CURLOPT_XOAUTH2_BEARER leak fix

url: free old conn better on reuse

Make use of conn_free() better and avoid duplicate code.

Reported-by: Andrea Pappacoda
Fixes #8841
Closes #8842

FAQ: Clarify Windows double quote usage

- Windows command prompt doesn't use literal quoting via single quotes.

- Windows command prompt inner double quotes are escaped with a

FAQ: Clarify Windows double quote usage

- Windows command prompt doesn't use literal quoting via single quotes.

- Windows command prompt inner double quotes are escaped with a
backslash.

- Windows powershell does use single quotes but curl is not a powershell
script so the arguments may not be passed on correctly.

- Windows powershell inner double quotes seems can be passed to curl if
the outer quotes are double quotes and an escape of backslash-backtick
is used.

Command prompt example:

~~~
getargs -v -d "\"a\""

argv[0]: getargs
argv[1]: -v
argv[2]: -d
argv[3]: "a"
~~~

Ref: https://github.com/curl/curl/issues/8818
Ref: https://gist.github.com/jay/19aba48653bd591cf4b90eb9249a302c

Reported-by: KotlinIsland@users.noreply.github.com

Closes https://github.com/curl/curl/pull/8823

show more ...

github/workflows/nss: apt update first

Fix "libnss3-dev_3.49.1-1ubuntu1.6_amd64.deb 404 Not Found"

Closes #8837

page-footer: mention exit code zero too

Success (zero) is also an "exit code" worth mentioning.

Closes #8833

gssapi: initialize gss_buffer_desc strings

Explicitly initialize gss_buffer_desc strings such that a call to
freeing resources will succeed even if no data has been allocated
to it.

gssapi: initialize gss_buffer_desc strings

Explicitly initialize gss_buffer_desc strings such that a call to
freeing resources will succeed even if no data has been allocated
to it.

Reported-by: Jay Satiro <raysatiro@yahoo.com>

show more ...

gssapi: improve handling of errors from gss_display_status

In case gss_display_status() returns an error, avoid trying to add
it to the buffer as the message may well be a NULL pointer.

gssapi: improve handling of errors from gss_display_status

In case gss_display_status() returns an error, avoid trying to add
it to the buffer as the message may well be a NULL pointer.

Originally this fix comes from a discussion in issue #8816.

Closes: #8832
Reviewed-by: Jay Satiro <raysatiro@yahoo.com>

show more ...

http2: always debug print stream id in decimal with %u

Prior to this change the stream id shown could be hex or decimal which
was inconsistent and confusing.

Closes https://gith

http2: always debug print stream id in decimal with %u

Prior to this change the stream id shown could be hex or decimal which
was inconsistent and confusing.

Closes https://github.com/curl/curl/pull/8808

show more ...

url: remove redundant #ifdefs in allocate_conn()

No change in behavior intended by this commit.

tests 266, 116 and 1540: add a small write delay

This makes it more likely that the trailer is received
seperately from the last-chunk.

curl doesn't seem to care about this but

tests 266, 116 and 1540: add a small write delay

This makes it more likely that the trailer is received
seperately from the last-chunk.

curl doesn't seem to care about this but it makes the tests
more useful when testing external proxies like Privoxy.

show more ...

tests 1117,1238,1523: adjust writedelay servercmds

... so the delays are the same now that the unit
is in milliseconds.

tests/server/sws.c: change the HTTP writedelay unit to milliseconds

This allows to use write delays for large responses without
resulting in the test taking an unreasonable amount of tim

tests/server/sws.c: change the HTTP writedelay unit to milliseconds

This allows to use write delays for large responses without
resulting in the test taking an unreasonable amount of time.

In many cases delaying writes by a whole second or more isn't
necessary for the desired effect.

Closes #8827

show more ...

aws-sigv4: fix potentional NULL pointer arithmetic

We need to check if the strchr() call returns NULL (due to missing
char) before we use the returned value in arithmetic. There is no

aws-sigv4: fix potentional NULL pointer arithmetic

We need to check if the strchr() call returns NULL (due to missing
char) before we use the returned value in arithmetic. There is no
live bug here, but fixing it before it can become for hygiene.

Closes: #8814
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

show more ...

quiche: support ca-fallback

Follow-up to b01f3e679f4c1ea3 which added this for ngtcp2/openssl

Removed from KNOWN_BUGS

Fixes #8696
Closes #8830

x509asn1: mark msnprintf return as unchecked

We have lots of unchecked msnprintf calls, and this particular msnprintf
call isn't more interesting than the others, but this one yields a C

x509asn1: mark msnprintf return as unchecked

We have lots of unchecked msnprintf calls, and this particular msnprintf
call isn't more interesting than the others, but this one yields a Coverity
warning so let's implicitly silence it. Going over the other invocations
is probably a worthwhile project, but for now let's keep the static
analyzers happy.

Closes: #8831
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

show more ...

RELEASE-NOTES: synced

curl 7.83.1 release

THANKS: added contributors from 7.83.1

zuul: fix the ngtcp2-gnutls build

Add packages and tweak the configure options.

Use the GnuTLS 3.7.4 branch (not main).

Closes #8829

ngtcp2: add ca-fallback support for OpenSSL backend

Closes #8828

url: check SSH config match on connection reuse

CVE-2022-27782

Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2022-27782.html
Closes #8825

tls: check more TLS details for connection reuse

CVE-2022-27782

Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2022-27782.html
Closes #8825

cookies: make bad_domain() not consider a trailing dot fine

The check for a dot in the domain must not consider a single trailing
dot to be fine, as then TLD + trailing dot is fine and c

cookies: make bad_domain() not consider a trailing dot fine

The check for a dot in the domain must not consider a single trailing
dot to be fine, as then TLD + trailing dot is fine and curl will accept
setting cookies for it.

CVE-2022-27779

Reported-by: Axel Chong
Bug: https://curl.se/docs/CVE-2022-27779.html
Closes #8820

show more ...