curlx/fopen: replace open CRT functions their with `_s` counterparts (Windows) by vszakats · Pull Request #19643 · curl/curl

vszakats · 2025-11-21T19:15:31Z

_wopen -> _wsopen_s
_open, open -> _sopen_s
_wfopen -> _wfopen_s
fopen -> fopen_s
_wfreopen -> _wfreopen_s
freopen -> freopen_s

For better error handling and for using the CRT functions recommended
via warnings suppressed by _CRT_SECURE_NO_WARNINGS.

Also:

add missing freopen_s() prototype when building with mingw-w64 <5.
https://sourceforge.net/p/mingw-w64/mingw-w64/ci/a5d824654cdc57f6eac1bb581b078986f3eb6856/
tests/server: replace open() in the signal handler with _sopen_s()
on Windows.
tests/server: reduce scope of a checksrc exception to a single line.
checksrc: ban replaced functions.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/open-wopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/sopen-s-wsopen-s
https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-wfreopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-wfopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-s-wfopen-s
https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-s-wfreopen-s

vszakats · 2025-11-21T20:08:25Z

Issues:

freopen_s requires mingw-w64 4+.
#include <share.h> includes lib/share.h instead of share.h from the CRT.
Ref: lib: include files using known path #16991 that seemed fixing this issue reported in share.h conflicts with windows ucrt header #16949, but apparently this
use-case still hits it. Avoiding the name collision by renaming would be best?
test failures. I still got something wrong about the update that makes some tests
fail, some others time out.
→ Caused by passing invalid pmode flags to open on Windows
after the above: TESTFAIL: These test cases failed: 204 1490 (file:// protocol)

vszakats · 2025-11-21T20:54:51Z

Fine, pytests broken (test_17_ssl_use, 20 variants failed) after Homebrew bumped wolfSSL to 5.8.4 (from previous release 5.8.2):
BAD: https://github.com/curl/curl/actions/runs/19582773452/job/56084526466
GOOD: https://github.com/curl/curl/actions/runs/19575732267

SSL_connect failed with error -311: unknown type in record hdr

https://github.com/wolfSSL/wolfssl/releases/tag/v5.8.4-stable

→ #19644

Cherry-picked from curl#19643

The safe (`_s`) variants of the Windows `open()` reject these flags, while the classic ones silently accepted them. Also: - also drop the now unused `stat()` call on Windows. - replace magic number with their equivalent Windows and Unix-specific `S_*` macros. Refs: https://learn.microsoft.com/cpp/c-runtime-library/reference/open-wopen https://learn.microsoft.com/cpp/c-runtime-library/reference/fstat-fstat32-fstat64-fstati64-fstat32i64-fstat64i32 Cherry-picked from #19643 Closes #19645

Ref: https://learn.microsoft.com/cpp/c-runtime-library/reference/open-wopen Ref: #19645 Cherry-picked from #19643 Closes #19647

…ision Windows CRTs have a `share.h`. Before this patch when trying to `#include <share.h>` it, the compiler picked up curl's internal `lib/share.h` instead. Rename it to avoid this issue. CRT `share.h` has constants necessary for using safe open CRT functions. Also rename `lib/share.c` to keep matching the header. Ref: https://learn.microsoft.com/cpp/c-runtime-library/sharing-constants Ref: 625f2c1 #16949 #16991 Cherry-picked from #19643 Closes #19676

Replace: - `open()` with `curlx_open()` (1 call). - `fopen()` with `curlx_fopen()`. - `fclose()` with `curlx_fclose()`. To centralize interacting with the CRT in preparation for using "safe" alternatives on Windows. This also adds long-filename and Unicode support for these operations on Windows. Keep using `open()` in the signal handler to avoid any issues with calling code not allowed in signal handlers. Cherry-picked from #19643 Closes #19679

https://learn.microsoft.com/cpp/c-runtime-library/reference/open-wopen https://learn.microsoft.com/cpp/c-runtime-library/reference/sopen-s-wsopen-s https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-wfreopen https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-wfopen https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-s-wfopen-s https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-s-wfreopen-s

vszakats · 2025-11-25T01:03:45Z

TL;DR the reason for the CI failures seen earlier in #19581 (comment) were:

missed passing _SH_DENYNO (or other valid values) to open().
pre-existing code passing invalid mode flags to open().

These were addressed in this PR and a series of separate commits today.

vszakats · 2025-11-25T02:15:54Z

CRT functions flagged by _CRT_SECURE_NO_WARNINGS after this patch:

39 'strcpy' (lib, src, curlx, libtests, servers) → strcpy_s
21 'getenv' (lib, src, libtests) → _dupenv_s
18 'sscanf' (1x libtests, servers) → sscanf_s
3 'localtime' (src, libtests, servers) → localtime_s
2 'gmtime' (lib, src) → gmtime_s
1 'sprintf' (curlx) → sprintf_s → curlx: replace sprintf with snprintf #19681

https://learn.microsoft.com/cpp/c-runtime-library/reference/fsopen-wfsopen Ref: 1e7d0ba curl#19643

Replacing `fopen_s()`/`_wfopen_s()`, to allow customizing share mode, and keep the sharing mode as was with `fopen()`/`_wopen()` earlier and as used in `_sopen_s()`/`_wsopen_s()`. The replaced functions used `_SH_SECURE` internally. Otherwise they are identical to the replacements. Ref: https://learn.microsoft.com/cpp/c-runtime-library/reference/fsopen-wfsopen Reported-by: Jay Satiro Fixes #20155 Ref: #20156 Follow-up to 1e7d0ba #19643 Closes #20186

vszakats marked this pull request as draft November 21, 2025 19:16

github-actions Bot added the tests label Nov 21, 2025

This comment was marked as off-topic.

Sign in to view

This was referenced Nov 21, 2025

pytest: test_17_ssl_use fail (20 variants) with wolfSSL 5.8.4 #19644

Closed

curl_fopen: do not pass invalid mode flags to open() on Windows #19645

Closed

vszakats force-pushed the wopen branch from 700931f to 3a03ad9 Compare November 22, 2025 00:43

vszakats added a commit to vszakats/curl that referenced this pull request Nov 22, 2025

file: do not pass invalid pmode flags to open() on upload (Windows)

631308d

Cherry-picked from curl#19643

vszakats mentioned this pull request Nov 22, 2025

file: do not pass invalid mode flags to open() on upload (Windows) #19647

Closed

1 task done

vszakats force-pushed the wopen branch from aa13e09 to 0e21885 Compare November 24, 2025 12:29

vszakats added a commit to vszakats/curl that referenced this pull request Nov 24, 2025

file: do not pass invalid pmode flags to open() on upload (Windows)

41713d3

Cherry-picked from curl#19643

vszakats added a commit that referenced this pull request Nov 24, 2025

file: do not pass invalid mode flags to open() on upload (Windows)

8201306

Ref: https://learn.microsoft.com/cpp/c-runtime-library/reference/open-wopen Ref: #19645 Cherry-picked from #19643 Closes #19647

vszakats force-pushed the wopen branch from 0e21885 to 6111b8a Compare November 24, 2025 13:33

vszakats mentioned this pull request Nov 24, 2025

lib: rename internal header share.h to curl_share.h to avoid collision #19676

Closed

vszakats force-pushed the wopen branch from ecb050e to f12d58b Compare November 24, 2025 23:28

vszakats mentioned this pull request Nov 25, 2025

tests/server: use curlx file open/close functions #19679

Closed

vszakats added 10 commits November 25, 2025 01:47

curl_setup.h update

5dc0727

add to checksrc

ddc2099

freopen

7448e41

must pass a share mode to not fail

cc636b8

include share.h

1d6cecf

revert to plain freopen for mingw-w64 v3

f0cf545

freopen fixup checksrc

0351000

cleanup

5a7044e

cleanup

7ff6863

vszakats added 6 commits November 25, 2025 01:47

curl_setup.h drop _open, no longer used

0d48d3d

checksrc.pl ban _open

eb62511

servers/util: use _sopen_s on Windows

70e59ae

tests/server: fopen -> curlx_fopen upd list

b113c18

tests/server: move .checksrc exception to file

c8b8a3d

checksrc.pl cleanup

0ce059a

vszakats force-pushed the wopen branch from f12d58b to 0ce059a Compare November 25, 2025 00:49

curl_setup.h drop open in tests from the warning list

05211a7

vszakats marked this pull request as ready for review November 25, 2025 00:58

vszakats added the Windows Windows-specific label Nov 25, 2025

vszakats added 4 commits November 25, 2025 02:50

fix mingw-w64 cutoff version

9dc6309

fopen.c add missing declaration for mingw-w64 <5

9568939

fopen.c add missing declaration for mingw-w64 <5 curl_setup.h

d6db485

checksrc

2b69422

vszakats closed this in 1e7d0ba Nov 25, 2025

vszakats deleted the wopen branch November 25, 2025 02:45

vszakats added a commit to vszakats/curl that referenced this pull request Jan 5, 2026

curlx_win32_fopen: try _fsopen/_wfsopen with _SH_DENYNO

18b1356

https://learn.microsoft.com/cpp/c-runtime-library/reference/fsopen-wfsopen Ref: 1e7d0ba curl#19643

vszakats mentioned this pull request Jan 5, 2026

curlx_win32_fopen: use _fsopen()/_wfsopen() with _SH_DENYNO #20186

Closed

Navigation Menu

Repository navigation

curlx/fopen: replace open CRT functions their with `_s` counterparts (Windows) - #19643

curlx/fopen: replace open CRT functions their with `_s` counterparts (Windows)#19643
vszakats wants to merge 21 commits into
curl:masterfrom
vszakats:wopen

vszakats commented Nov 21, 2025 •

edited

Loading

Uh oh!

vszakats commented Nov 21, 2025 •

edited

Loading

Uh oh!

This comment was marked as off-topic.

vszakats commented Nov 21, 2025 •

edited

Loading

Uh oh!

vszakats commented Nov 25, 2025

Uh oh!

vszakats commented Nov 25, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

vszakats commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vszakats commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as off-topic.

vszakats commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vszakats commented Nov 25, 2025

Uh oh!

vszakats commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

vszakats commented Nov 21, 2025 •

edited

Loading

vszakats commented Nov 21, 2025 •

edited

Loading

vszakats commented Nov 21, 2025 •

edited

Loading

vszakats commented Nov 25, 2025 •

edited

Loading