Conversation
Reported-by: Joshua Rogers Fixes curl#19089 Closes curl#19090
After this patch libcurl requires (as already documented) the `curl_global_init()` call when using the `curl_formadd()` API with mbedTLS. Note: NTLM is not supported with mbedTLS 4+, because it lacks the necessary crypto primitive: DES. Also: - lib: de-dupe mbedTLS minimum version checks into `curl_setup.h`. - lib: initialize PSA Crypto as part of `curl_global_init()`. For MD5, SHA-256, `curl_formadd()`, and MultiSSL builds with mbedTLS but where mbedTLS isn't the default backend. - lib1308: fix to call `curl_global_init()` (for the Form API). - curl_ntlm_core: disable with mbedTLS 4+. - md4: disable mbedTLS implementation when building against 4.x. - md5: use mbedTLS PSA Crypto API when available, otherwise use the default local implementation. - sha256: use mbedTLS PSA Crypto API when available, otherwise use the default local implementation. - vtls/mbedtls: drop PSA Crypto initialization in favor of `curl_global_init()`. - vtls/mbedtls: use PSA Crypto random API with all mbedTLS versions. - vtls/mbedtls: do the same for the SHA-256 callback. - autotools: detect mbedTLS 4+, and disable NTLM for 3.x. - cmake: disable NTLM for mbedTLS 3.x. - GHA/linux: keep building mbedTLS 3.x manually and use it in an existing job, while also enabling pytest in it. - GHA/linux: bump to mbedTLS 4.0.0. Closes curl#19075 Closes curl#19074 Refs: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-4.0.0 https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-4.0.0/docs/4.0-migration-guide.md https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-4.0.0/tf-psa-crypto/docs/1.0-migration-guide.md [404] https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/1.0-migration-guide.md https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/psa-transition.md https://github.com/Mbed-TLS/TF-PSA-Crypto/tree/627f727bbed3d9319ed548f1c0839a29c223414e/docs/4.0-migration-guide Closes curl#19077
It should limit the size to the size of the target array, not the incoming data. Pointed out by ZeroPath Closes curl#19095
Pointed out by ZeroPath Closes curl#19094
In MOST protocols and runs, the 'pretransfer' time is less than the 'starttransfer'. E.g. request being sent before response comes in. However, when curl is starved of cpu a server response might start streaming in before the multi-state transitioned to DID (and recorded the 'pretransfer' time). Do no longer check that 'pretransfer' is less or equal 'starttransfer'. Check that is is less or equal to the total time instead. Closes curl#19096
The choice to continue processing incoming data although the writeout of the headers/data failed is not obvious. Add a comment explaining why this is done. Closes curl#19093
Detect and prevent abuse or mistakes. Limit set to 100. Closes curl#19091
- make sure memory allocated by libcurl is freed with curl_free() - drop the ensure_trailing_slash complexity Closes curl#19097
Follow-up to eefd03c Pointed out by ZeroPath https://zeropath.com/ Closes curl#19099
Follow-up to 9d7b532 Pointed out by ZeroPath Closes curl#19098
Avoid the possible 64-bit offset truncation when used on systems with small 'long', like Windows. bonus: make mime_open_file() return bool Pointed out by ZeroPath Closes curl#19100
Found via: curl#17961 Closes curl#19102
When freeing buffers allocated by SSPI, use its own function, not free(). Reported-by: Joshua Rogers Closes curl#19046
A bit more minimal build than the one used for trurl. To stress test a build with most features disabled. Costs 40 seconds, of which 6 is the build, rest is installing tools. Ref: curl/curl-for-win@5b38500 Ref: curl/curl-for-win@3ee1069 Follow-up to 5af2457 curl#17818 Closes curl#17961
For files with sizes using an exact multiple of 256 bytes, the final successful read(s) filled the buffer(s) and the subsequent fread returned 0 for EOF, which caused read_file_into to fail. Now, it needs to return 0 and not be EOF to be an error. Follow-up to dd95a49 Pointed out by ZeroPath Closes curl#19104
Also make the verbose log say it Pointed out by ZeroPath Closes curl#19103
Before this patch system `malloc()`/`free()` were used to allocate the buffer returned in the `output_token` object from the debug stub of `gss_init_sec_context()` when enabled via `CURL_STUB_GSS_CREDS` in debug-enabled libcurl builds. This object is later released via stock `gss_release_buffer()`, which, in the Windows builds of MIT Kerberos, doesn't use the system `free()`, but the Win32 `HeapFree()`. Fix it by using the GSS alloc/free macros: `gssalloc_malloc()` and `gssalloc_free()` from `gssapi_alloc.h`. To make this work without MIT Kerberos feature detection, use a canary macro to detect a version which installs `gssapi_alloc.h` for Windows. For <1.15 (2016-11-30) releases, that do not install it, disable the GSS debug stub in libcurl. Strictly speaking, non-Windows builds would also need to use GSS allocators, but, detecting support for `gssapi_alloc.h` is impossible without build-level logic. Built-level logic is complex and overkill, and MIT Kerberos, as of 1.22.1, uses standard malloc/free on non-Windows platforms anyway. (except in GSS debug builds.) Follow-up to 7384083 curl#17752 Closes curl#19064
curl has run on Closes curl#19106
Bug: https://curl.se/mail/lib-2025-10/0018.html Reported-by: curl.stunt430 Closes curl#19105
Follow-up to 3a30583 Closes curl#19108
Pointed out by ZeroPath Closes curl#19110
Pointed out by ZeroPath Closes curl#19111
- tool_formparse: replace truncated `fseek` with `curlx_fseek`. - tool_operate: replace truncated `fseek` with `curlx_fseek`. - tool_paramhlp: replace local duplicate `myfseek`, with `curlx_fseek`. Follow-up to 4fb12f2 curl#19100 Closes curl#19107
The -F option allows users to provide a file with a set of headers for a specific formpost section. This code used old handcrafted parsing logic that potentially could do wrong. Rewrite to use my_get_line() and dynbuf. Supports longer lines and should be more solid parsing code. Gets somewhat complicated by the (unwise) feature that allows "folding" of header lines in the file: if a line starts with a space it should be appended to the previous. The previous code trimmed spurious CR characters wherever they would occur in a line but this version does not. It does not seem like something we want or that users would expect. Test 646 uses this feature. Closes curl#19113
In providercheck(), when failing to open the "store", the exit path would not previously free the created UI_METHOD and instead leak this resource. Pointed out by ZeroPath Closes curl#19114
- do not pre-fill `HAVE_LINUX_TCP_H` on Linux. `linux/tcp.h` is a Linux kernel userspace header. It's likely installed when using glibc and likely missing by default when using something else, e.g. MUSL (e.g. on Alpine). Therefore always detect it for Linux targets, and only pre-fill it for non-Linux ones. - do not pre-fill `HAVE_GLIBC_STRERROR_R` on Linux. To fix it for non-glibc envs, e.g. MUSL (e.g. on Alpine). Note, the pre-fill option is a disabled by default, internal option and strongly not recommended outside of curl development. Closes curl#19116
To make it actually run. Also fix the NTLM expected result, also syncing it with other tests. Follow-up to e6b21d4 curl#6037 Closes curl#19288
Pointed out by TIOBE scanner via Coverity 2025.3.0. Closes curl#19290
Also: - tests/libtest/cli_h2_serverpush: re-sync formatting. Previously fixed in tests based on a local clang-tidy v20 report. Pointed out by TIOBE scanner via Coverity 2025.3.0. Follow-up to 83a8818 curl#17706 Closes curl#19291
Also: - delete dead code. - sync `http2-download.c` and `http2-upload.c` sources. - simplessl: fix constant expression. - simplessl: avoid `expression is constant` VS2010 warning, drop pragma. - replace large stack buffers with dynamic allocation. - http2-download: fix to fill transfer number. Some of these were pointed out by TIOBE scanner via Coverity 2025.3.0. Closes curl#19292
To make special newlines more explicit and visible. Mostly in `<protocol>` sections, some in `<data*>` and `<upload>`. Reducing the number of `tests/data/test*`: - CRLF newlines from 21535 to 11337. - files with mixed newlines from 1335 to 707. Also delete empty `<protocol>` sections. Closes curl#19284
Follow-up to eb22e37 curl#19281 Follow-up to 55d4767 curl#19279 Closes curl#19296
To match the ASCII-7 requirement for curl test data files. Follow-up to 9243ed5 curl#17329 Follow-up to 87ba80a Closes curl#19297
When a SCP/SFTP connection calls the protocol handler disconnect, it required the connections *and* the easy handles SSH meta data to be present. When the disconnect is called with an admin handle, the easy meta data is not present, which prevented the shutdown to run. The easy meta data is however not necessary to run the shutdown state machine. Calling it with a NULL `sshp` is fine. To avoid any mixups, check `sshp` in state operations that need it. Fixes curl#19293 Reported-by: And-yW on github Closes curl#19295
To avoid linkcheck CI fails. It was failing regularly in the last months.
- 'CURL *' handles are called 'curl' - 'CURLM *' handles are called 'multi' - write callbacks are called 'write_cb' - read callbacs are called 'read_cb' - CURLcode variables are called 'res' It makes the examples look and feel more consistent. It allows for easier copy and pasting between examples. Closes curl#19299
To make them explicit, visible, avoid being accidentally trimmed. Also prevents Git warnings, e.g. on `git am`. Also: - runtests: add support for `%spc%` and `%tab%` macros. - test59: delete non-significant line-ending space. - spacecheck.pl: drop line-ending whitespace exception for tests. Closes curl#19300
- add global init and deinit where missing. - check global init success. - improve cleaning up on error codepaths. - drop `CLI_ERR()` macro, that could quit. Also make error messages tell the reason. Closes curl#19309
If it has no data, pass in a zero. Fixes curl#19303 Reported-by: Harry Sintonen Closes curl#19305
When openssl does not verify the certificate, but apple sectrust does, we also pass it the ocsp stapled response when configured and available. When openssl does not verify the cert chain, it will also not be able to verify the ocsp stapling. Do not call it if sectrust is the verifier of the cert chain. Fixes curl#19307 Reported-by: Harry Sintonen Closes curl#19308
... intead of overwriting the previous ones in ossl_populate_x509_store() Pointed out by ZeroPath Closes curl#19306
Add --upload-parallel=n for controlling upload parallelism. Make upload processing similar to download processing. Closes curl#19302
Follow-up to d29f14b curl#19300 Closes curl#19315
- use `AM`/`CM` where missing. In GHA/linux-old and AppVeyor CI. To denote autotools and CMake, and to align with rest of the jobs. - rename `Old Linux` to `Linux Old` to align with the rest of Linux jobs on GitHub web views sorted by name. Closes curl#19316
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
15 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.