From: Viktor Szakats <commit@vsz.me>
Date: Sun, 25 Jan 2026 02:26:03 +0000 (+0100)
Subject: build: constify `memchr()`/`strchr()`/etc result variables
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0e2507a3c65376d6bda860ff20bd94ada9bbb9fd;p=thirdparty%2Fcurl.git

build: constify `memchr()`/`strchr()`/etc result variables

And a few variables around.

There remain cases where the accepted pointer is const, yet the returned
pointer is written to.

Partly addressing (glibc 2.43):
```
* For ISO C23, the functions bsearch, memchr, strchr, strpbrk, strrchr,
  strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr that return
  pointers into their input arrays now have definitions as macros that
  return a pointer to a const-qualified type when the input argument is
  a pointer to a const-qualified type.
```
Ref: https://lists.gnu.org/archive/html/info-gnu/2026-01/msg00005.html

Reported-by: Rudi Heitbaum
Ref: #20420

Closes #20421
---

diff --git a/lib/cookie.c b/lib/cookie.c
index 2c57226dc5..5d7cd13310 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -331,7 +331,7 @@ static bool bad_domain(const char *domain, size_t len)
     return FALSE;
   else {
     /* there must be a dot present, but that dot must not be a trailing dot */
-    char *dot = memchr(domain, '.', len);
+    const char *dot = memchr(domain, '.', len);
     if(dot) {
       size_t i = dot - domain;
       if((len - i) > 1)
diff --git a/lib/dict.c b/lib/dict.c
index fcdea918cf..832da30ce4 100644
--- a/lib/dict.c
+++ b/lib/dict.c
@@ -136,7 +136,7 @@ static CURLcode sendf(struct Curl_easy *data, const char *fmt, ...)
 
 static CURLcode dict_do(struct Curl_easy *data, bool *done)
 {
-  char *word;
+  const char *word;
   char *eword = NULL;
   char *ppath;
   char *database = NULL;
diff --git a/lib/doh.c b/lib/doh.c
index d992a17a9c..88c09889bc 100644
--- a/lib/doh.c
+++ b/lib/doh.c
@@ -129,7 +129,7 @@ UNITTEST DOHcode doh_req_encode(const char *host,
   /* encode each label and store it in the QNAME */
   while(*hostp) {
     size_t labellen;
-    char *dot = strchr(hostp, '.');
+    const char *dot = strchr(hostp, '.');
     if(dot)
       labellen = dot - hostp;
     else
diff --git a/lib/ftp.c b/lib/ftp.c
index b244089a19..1fda9c608d 100644
--- a/lib/ftp.c
+++ b/lib/ftp.c
@@ -935,7 +935,7 @@ static CURLcode ftp_state_use_port(struct Curl_easy *data,
 
   if(data->set.str[STRING_FTPPORT] &&
      (strlen(data->set.str[STRING_FTPPORT]) > 1)) {
-    char *ip_end = NULL;
+    const char *ip_end = NULL;
 
 #ifdef USE_IPV6
     if(*string_ftpport == '[') {
@@ -1952,7 +1952,7 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
   if((ftpc->count1 == 0) &&
      (ftpcode == 229)) {
     /* positive EPSV response */
-    char *ptr = strchr(str, '(');
+    const char *ptr = strchr(str, '(');
     if(ptr) {
       char sep;
       ptr++;
diff --git a/lib/http.c b/lib/http.c
index 72316f7e41..b5627e61a8 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -3829,7 +3829,7 @@ static CURLcode verify_header(struct Curl_easy *data,
                               const char *hd, size_t hdlen)
 {
   struct SingleRequest *k = &data->req;
-  char *ptr = memchr(hd, 0x00, hdlen);
+  const char *ptr = memchr(hd, 0x00, hdlen);
   if(ptr) {
     /* this is bad, bail out */
     failf(data, "Nul byte in header");
@@ -4369,7 +4369,7 @@ static CURLcode http_parse_headers(struct Curl_easy *data,
   struct connectdata *conn = data->conn;
   CURLcode result = CURLE_OK;
   struct SingleRequest *k = &data->req;
-  char *end_ptr;
+  const char *end_ptr;
   bool leftover_body = FALSE;
 
   /* we have bytes for the next header, make sure it is not a folded header
diff --git a/lib/http_aws_sigv4.c b/lib/http_aws_sigv4.c
index 38e81fca43..1eb680fb13 100644
--- a/lib/http_aws_sigv4.c
+++ b/lib/http_aws_sigv4.c
@@ -333,8 +333,8 @@ static CURLcode merge_duplicate_headers(struct curl_slist *head)
 
     if(compare_header_names(curr->data, next->data) == 0) {
       struct dynbuf buf;
-      char *colon_next;
-      char *val_next;
+      const char *colon_next;
+      const char *val_next;
 
       curlx_dyn_init(&buf, CURL_MAX_HTTP_HEADER);
 
@@ -441,8 +441,9 @@ static CURLcode make_headers(struct Curl_easy *data,
      semi-colon, are not added to this list.
      */
   for(l = data->set.headers; l; l = l->next) {
-    char *dupdata, *ptr;
-    char *sep = strchr(l->data, ':');
+    char *dupdata;
+    const char *ptr;
+    const char *sep = strchr(l->data, ':');
     if(!sep)
       sep = strchr(l->data, ';');
     if(!sep || (*sep == ':' && !*(sep + 1)))
@@ -729,7 +730,7 @@ UNITTEST CURLcode canon_query(const char *query, struct dynbuf *dq)
   for(index = 0; index < num_query_components; index++) {
     const char *in_key;
     size_t in_key_len;
-    char *offset;
+    const char *offset;
     size_t query_part_len = curlx_dyn_len(&query_array[index]);
     char *query_part = curlx_dyn_ptr(&query_array[index]);
 
diff --git a/lib/netrc.c b/lib/netrc.c
index 0678733d22..baabe917a7 100644
--- a/lib/netrc.c
+++ b/lib/netrc.c
@@ -122,7 +122,7 @@ static NETRCcode parsenetrc(struct store_netrc *store,
                               any order */
   bool our_login = FALSE;  /* found our login name */
   bool done = FALSE;
-  char *netrcbuffer;
+  const char *netrcbuffer;
   struct dynbuf token;
   struct dynbuf *filebuf = &store->filebuf;
   DEBUGASSERT(!*passwordp);
@@ -326,7 +326,7 @@ static NETRCcode parsenetrc(struct store_netrc *store,
       tok = ++tok_end;
     }
     if(!done) {
-      char *nl = NULL;
+      const char *nl = NULL;
       if(tok)
         nl = strchr(tok, '\n');
       if(!nl)
diff --git a/lib/pingpong.c b/lib/pingpong.c
index 7de902492b..a2ca05ae47 100644
--- a/lib/pingpong.c
+++ b/lib/pingpong.c
@@ -292,8 +292,8 @@ CURLcode Curl_pp_readresp(struct Curl_easy *data,
     }
 
     do {
-      char *line = curlx_dyn_ptr(&pp->recvbuf);
-      char *nl = memchr(line, '\n', curlx_dyn_len(&pp->recvbuf));
+      const char *line = curlx_dyn_ptr(&pp->recvbuf);
+      const char *nl = memchr(line, '\n', curlx_dyn_len(&pp->recvbuf));
       if(nl) {
         /* a newline is CRLF in pp-talk, so the CR is ignored as
            the line is not really terminated until the LF comes */
diff --git a/lib/pop3.c b/lib/pop3.c
index fe9f4323de..857cf26c6b 100644
--- a/lib/pop3.c
+++ b/lib/pop3.c
@@ -809,8 +809,8 @@ static CURLcode pop3_state_servergreet_resp(struct Curl_easy *data,
   }
   else if(len > 3) {
     /* Does the server support APOP authentication? */
-    char *lt;
-    char *gt = NULL;
+    const char *lt;
+    const char *gt = NULL;
 
     /* Look for the APOP timestamp */
     lt = memchr(line, '<', len);
@@ -820,7 +820,7 @@ static CURLcode pop3_state_servergreet_resp(struct Curl_easy *data,
     if(gt) {
       /* the length of the timestamp, including the brackets */
       size_t timestamplen = gt - lt + 1;
-      char *at = memchr(lt, '@', timestamplen);
+      const char *at = memchr(lt, '@', timestamplen);
       /* If the timestamp does not contain '@' it is not (as required by
          RFC-1939) conformant to the RFC-822 message id syntax, and we
          therefore do not use APOP authentication. */
diff --git a/lib/telnet.c b/lib/telnet.c
index 56cabce0b8..c06b7a1b1f 100644
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -115,8 +115,8 @@ struct TELNET {
   int himq[256];
   int him_preferred[256];
   int subnegotiation[256];
-  char *subopt_ttype;                /* Set with suboption TTYPE */
-  char *subopt_xdisploc;             /* Set with suboption XDISPLOC */
+  const char *subopt_ttype;          /* Set with suboption TTYPE */
+  const char *subopt_xdisploc;       /* Set with suboption XDISPLOC */
   unsigned short subopt_wsx;         /* Set with suboption NAWS */
   unsigned short subopt_wsy;         /* Set with suboption NAWS */
   TelnetReceive telrcv_state;
@@ -860,9 +860,9 @@ static CURLcode check_telnet_options(struct Curl_easy *data,
 
   for(head = data->set.telnet_options; head && !result; head = head->next) {
     size_t olen;
-    char *option = head->data;
-    char *arg;
-    char *sep = strchr(option, '=');
+    const char *option = head->data;
+    const char *arg;
+    const char *sep = strchr(option, '=');
     if(sep) {
       olen = sep - option;
       arg = ++sep;
@@ -1037,7 +1037,7 @@ static CURLcode suboption(struct Curl_easy *data, struct TELNET *tn)
         return CURLE_BAD_FUNCTION_ARGUMENT;
       /* Add the variable if it fits */
       if(len + tmplen < (int)sizeof(temp) - 6) {
-        char *s = strchr(v->data, ',');
+        const char *s = strchr(v->data, ',');
         if(!s)
           len += curl_msnprintf((char *)&temp[len], sizeof(temp) - len,
                                 "%c%s", CURL_NEW_ENV_VAR, v->data);
diff --git a/lib/url.c b/lib/url.c
index c64dca1d56..943ae6ad62 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -2812,7 +2812,7 @@ static CURLcode parse_connect_to_string(struct Curl_easy *data,
     }
     else {
       /* check whether the URL's port matches */
-      char *ptr_next = strchr(ptr, ':');
+      const char *ptr_next = strchr(ptr, ':');
       if(ptr_next) {
         curl_off_t port_to_match;
         if(!curlx_str_number(&ptr, &port_to_match, 0xffff) &&
diff --git a/lib/urlapi.c b/lib/urlapi.c
index 9899f6aff3..1cce6aaee2 100644
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -265,7 +265,7 @@ static CURLUcode parse_hostname_login(struct Curl_URL *u,
    *
    * We need somewhere to put the embedded details, so do that first.
    */
-  char *ptr;
+  const char *ptr;
 
   DEBUGASSERT(login);
 
@@ -577,7 +577,7 @@ static int ipv4_normalize(struct dynbuf *host)
 /* if necessary, replace the host content with a URL decoded version */
 static CURLUcode urldecode_host(struct dynbuf *host)
 {
-  char *per = NULL;
+  const char *per;
   const char *hostname = curlx_dyn_ptr(host);
   per = strchr(hostname, '%');
   if(!per)
@@ -780,8 +780,8 @@ UNITTEST int dedotdotify(const char *input, size_t clen, char **outp)
           /* remove the last segment from the output buffer */
           size_t len = curlx_dyn_len(&out);
           if(len) {
-            char *ptr = curlx_dyn_ptr(&out);
-            char *last = memrchr(ptr, '/', len);
+            const char *ptr = curlx_dyn_ptr(&out);
+            const char *last = memrchr(ptr, '/', len);
             if(last)
               /* trim the output at the slash */
               curlx_dyn_setlen(&out, last - ptr);
diff --git a/lib/vauth/vauth.c b/lib/vauth/vauth.c
index 112838b0cc..bdf194b995 100644
--- a/lib/vauth/vauth.c
+++ b/lib/vauth/vauth.c
@@ -117,7 +117,7 @@ bool Curl_auth_user_contains_domain(const char *user)
 
   if(user && *user) {
     /* Check we have a domain name or UPN present */
-    char *p = strpbrk(user, "\\/@");
+    const char *p = strpbrk(user, "\\/@");
 
     valid = (p != NULL && p > user && p < user + strlen(user) - 1);
   }
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index aef5183087..b8dc9273ab 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -689,7 +689,7 @@ CURLcode Curl_ssl_random(struct Curl_easy *data,
 static CURLcode pubkey_pem_to_der(const char *pem,
                                   unsigned char **der, size_t *der_len)
 {
-  char *begin_pos, *end_pos;
+  const char *begin_pos, *end_pos;
   size_t pem_count, pem_len;
   CURLcode result;
   struct dynbuf pbuf;
diff --git a/src/tool_cb_hdr.c b/src/tool_cb_hdr.c
index 1381ffa317..876a599049 100644
--- a/src/tool_cb_hdr.c
+++ b/src/tool_cb_hdr.c
@@ -452,7 +452,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
     }
   }
   if(hdrcbdata->config->writeout) {
-    char *value = memchr(ptr, ':', cb);
+    const char *value = memchr(ptr, ':', cb);
     if(value) {
       if(per->was_last_header_empty)
         per->num_headers = 0;
@@ -466,7 +466,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
      (scheme == proto_http || scheme == proto_https ||
       scheme == proto_rtsp || scheme == proto_file)) {
     /* bold headers only for selected protocols */
-    char *value = NULL;
+    const char *value = NULL;
 
     if(!outs->stream && !tool_create_output_file(outs, per->config))
       return CURL_WRITEFUNC_ERROR;
diff --git a/src/tool_getparam.c b/src/tool_getparam.c
index a66f044799..991e769d68 100644
--- a/src/tool_getparam.c
+++ b/src/tool_getparam.c
@@ -1673,7 +1673,7 @@ static ParameterError parse_upload_flags(struct OperationConfig *config,
     bool negate;
     const struct flagmap *map;
     size_t len;
-    char *next = strchr(flag, ','); /* Find next comma or end */
+    const char *next = strchr(flag, ','); /* Find next comma or end */
     if(next)
       len = next - flag;
     else
diff --git a/src/tool_operhlp.c b/src/tool_operhlp.c
index ac209b440a..db3365e7f1 100644
--- a/src/tool_operhlp.c
+++ b/src/tool_operhlp.c
@@ -89,7 +89,7 @@ CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
   char *path = NULL;
   char *query = NULL;
   if(uh) {
-    char *ptr;
+    const char *ptr;
     uerr = curl_url_set(uh, CURLUPART_URL, *inurlp,
                         CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME);
     if(uerr) {
diff --git a/src/var.c b/src/var.c
index f796aa7ed7..4cc1b640fa 100644
--- a/src/var.c
+++ b/src/var.c
@@ -75,7 +75,7 @@ static const struct tool_var *varcontent(const char *name, size_t nlen)
 
 static ParameterError varfunc(char *c, /* content */
                               size_t clen, /* content length */
-                              char *f, /* functions */
+                              const char *f, /* functions */
                               size_t flen, /* function string length */
                               struct dynbuf *out)
 {
@@ -207,7 +207,7 @@ static ParameterError varfunc(char *c, /* content */
 ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced)
 {
   CURLcode result;
-  char *envp;
+  const char *envp;
   bool added = FALSE;
   const char *input = line;
   *replaced = FALSE;
@@ -232,8 +232,8 @@ ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced)
       char name[MAX_VAR_LEN];
       size_t nlen;
       size_t i;
-      char *funcp;
-      char *clp = strstr(envp, "}}");
+      const char *funcp;
+      const char *clp = strstr(envp, "}}");
       size_t prefix;
 
       if(!clp) {
@@ -304,7 +304,7 @@ ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced)
           if(value && vlen > 0) {
             /* A variable might contain null bytes. Such bytes cannot be shown
                using normal means, this is an error. */
-            char *nb = memchr(value, '\0', vlen);
+            const char *nb = memchr(value, '\0', vlen);
             if(nb) {
               errorf("variable contains null byte");
               return PARAM_EXPAND_ERROR;
diff --git a/tests/server/rtspd.c b/tests/server/rtspd.c
index b343c79bd4..c3878ea67a 100644
--- a/tests/server/rtspd.c
+++ b/tests/server/rtspd.c
@@ -149,7 +149,7 @@ static int rtspd_ProcessRequest(struct rtspd_httprequest *req)
   static char doc[MAXDOCNAMELEN];
   static char prot_str[5];
   int prot_major, prot_minor;
-  char *end = strstr(line, END_OF_HEADERS);
+  const char *end = strstr(line, END_OF_HEADERS);
 
   logmsg("rtspd_ProcessRequest() called with testno %ld and line [%s]",
          req->testno, line);
@@ -164,7 +164,7 @@ static int rtspd_ProcessRequest(struct rtspd_httprequest *req)
             prot_str,
             &prot_major,
             &prot_minor) == 5) {
-    char *ptr;
+    const char *ptr;
     const char *pval;
     curl_off_t testnum;
 
@@ -367,7 +367,7 @@ static int rtspd_ProcessRequest(struct rtspd_httprequest *req)
         else if(!strncmp(doc, "test", 4)) {
           /* if the hostname starts with test, the port number used in the
              CONNECT line will be used as test number! */
-          char *portp = strchr(doc, ':');
+          const char *portp = strchr(doc, ':');
           if(portp && (*(portp + 1) != '\0') && ISDIGIT(*(portp + 1))) {
             pval = portp + 1;
             if(!curlx_str_number(&pval, &testnum, INT_MAX))
diff --git a/tests/server/sws.c b/tests/server/sws.c
index 224cc9d888..43813c95f8 100644
--- a/tests/server/sws.c
+++ b/tests/server/sws.c
@@ -215,7 +215,7 @@ static int sws_parse_servercmd(struct sws_httprequest *req)
   }
   else {
     char *orgcmd = NULL;
-    char *cmd = NULL;
+    const char *cmd = NULL;
     size_t cmdsize = 0;
     int num = 0;
 
@@ -230,7 +230,7 @@ static int sws_parse_servercmd(struct sws_httprequest *req)
 
     cmd = orgcmd;
     while(cmd && cmdsize) {
-      char *check;
+      const char *check;
 
       if(!strncmp(CMD_AUTH_REQUIRED, cmd, strlen(CMD_AUTH_REQUIRED))) {
         logmsg("instructed to require authorization header");
@@ -308,7 +308,7 @@ static int sws_ProcessRequest(struct sws_httprequest *req)
   static char request[REQUEST_KEYWORD_SIZE];
   int prot_major = 0;
   int prot_minor = 0;
-  char *end = strstr(line, end_of_headers);
+  const char *end = strstr(line, end_of_headers);
   const char *pval;
   curl_off_t num;
 
@@ -329,7 +329,7 @@ static int sws_ProcessRequest(struct sws_httprequest *req)
   }
 
   else if(req->testno == DOCNUMBER_NOTHING) {
-    char *http;
+    const char *http;
     bool fine = FALSE;
     char *httppath = NULL;
     size_t npath = 0; /* httppath length */
@@ -512,7 +512,7 @@ static int sws_ProcessRequest(struct sws_httprequest *req)
   if(use_gopher) {
     /* when using gopher we cannot check the request until the entire
        thing has been received */
-    char *ptr;
+    const char *ptr;
 
     /* find the last slash in the line */
     ptr = strrchr(line, '/');
diff --git a/tests/server/tftpd.c b/tests/server/tftpd.c
index 1e0fcc9a48..031e4cf2be 100644
--- a/tests/server/tftpd.c
+++ b/tests/server/tftpd.c
@@ -548,7 +548,7 @@ static int tftpd_parse_servercmd(struct testcase *req)
   }
   else {
     char *orgcmd = NULL;
-    char *cmd = NULL;
+    const char *cmd = NULL;
     size_t cmdsize = 0;
     int num = 0;
 
@@ -562,7 +562,7 @@ static int tftpd_parse_servercmd(struct testcase *req)
 
     cmd = orgcmd;
     while(cmd && cmdsize) {
-      char *check;
+      const char *check;
       if(sscanf(cmd, "writedelay: %d", &num) == 1) {
         logmsg("instructed to delay %d secs between packets", num);
         req->writedelay = num;
@@ -600,7 +600,7 @@ static int tftpd_parse_servercmd(struct testcase *req)
 static int validate_access(struct testcase *test,
                            const char *filename, unsigned short mode)
 {
-  char *ptr;
+  const char *ptr;
 
   logmsg("trying to get file: %s mode %x", filename, mode);
 
diff --git a/tests/unit/unit1652.c b/tests/unit/unit1652.c
index da0df33b4d..a078000365 100644
--- a/tests/unit/unit1652.c
+++ b/tests/unit/unit1652.c
@@ -76,7 +76,7 @@ static void t1652_stop(struct Curl_easy *easy)
 static int verify(const char *info, const char *two)
 {
   /* the 'info' one has a newline appended */
-  char *nl = strchr(info, '\n');
+  const char *nl = strchr(info, '\n');
   if(!nl)
     return 1; /* nope */
   return strncmp(info, two, nl - info);