Frank Gevaerts [Wed, 18 May 2022 12:30:51 +0000 (14:30 +0200)]
strcase: some optimisations
Lookup tables for toupper() and tolower() make Curl_strcasecompare()
about 1.5 times faster. Reorganising Curl_strcasecompare() to fully exit
early then also allows simplifying the check at the end, for another
15%. In total, the changes make Curl_strcasecompare() around 1.6 to 1.7
times faster.
Note that these optimisation assume ASCII. The original
Curl_raw_toupper() and raw_tolower() look like they already made that
assumption.
Elms [Tue, 17 May 2022 04:55:24 +0000 (21:55 -0700)]
wolfSSL: explicitly use compatibility layer
This change removes adding an include `$prefix/wolfssl` or similar to
allow for openssl include aliasing. Include paths of `wolfssl/openssl/`
are used to explicitly use wolfSSL includes. This fixes cmake builds as
well as avoiding potentially using openSSL headers since include path
order is not guaranteed.
Daniel Stenberg [Tue, 17 May 2022 09:05:53 +0000 (11:05 +0200)]
opts: deprecate RANDOM_FILE and EGDSOCKET
These two options were only ever used for the OpenSSL backend for
versions before 1.1.0. They were never used for other backends and they
are not used with recent OpenSSL versions. They were never used much by
applications.
The defines RANDOM_FILE and EGD_SOCKET can still be set at build-time
for ancient EOL OpenSSL versions.
Commit 0ef54abf5208 accidentally used the conn variable before the
assertion for it being NULL. Fix by moving the assignment which use
conn to after the assertion.
Closes: #8857 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
docs: clarify data replacement policy for MIME API
The API documentation for the MIME functions specify that the parts
can be set twice, with the last call winning. While true, the user
can set the parts n times for n > 2, reword to specify multiple API
calls instead.
Closes: #8860 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Add Curl_quic_idle which is called when no HTTP level read or write is
performed. It is a good place to handle timer expiry for QUIC transport
(.e.g, retransmission).
Nick Zitzmann [Sun, 15 May 2022 21:57:20 +0000 (16:57 -0500)]
sectransp: check for a function defined when __BLOCKS__ is undefined
SecTrustEvaluateAsync() is defined in the macOS 10.7 SDK, but it
requires Grand Central Dispatch to be supported by the compiler, and
some third-party macOS compilers do not support Grand Central Dispatch.
SecTrustCopyPublicKey() is not present in macOS 10.6, so this shouldn't
adversely affect anything.
Commit 46d45ea3a incorrectly hardcoded the User-Agent in the test
output file which breaks when curlver is updated. Shift to using
the %VERSION macro instead.
The support for compiling on Mac OS 9 hasn't been modified since 2001
and has no active maintainer or packager, so it's time to remove it as
it's incredibly unlikely to work. If a maintainer re-emerges it can be
resurrected from Git history.
Closes: #8836 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Harry Sintonen [Sat, 14 May 2022 22:58:05 +0000 (01:58 +0300)]
Curl_parsenetrc: don't access local pwbuf outside of scope
Accessing local variables outside of the scope is forbidden and
depending on the compiler can result in the value being
overwritten. Fixed by moving the pwbuf to be in scope.
Frazer Smith [Sat, 14 May 2022 21:37:59 +0000 (23:37 +0200)]
ci: update github actions
- bump actions/checkout from 2 to 3
- bump actions/upload-artifact from 1 to 3
- bump github/codeql-actions from 1 to 2
- use version tag for actions/checkout
Jay Satiro [Mon, 9 May 2022 06:22:39 +0000 (02:22 -0400)]
FAQ: Clarify Windows double quote usage
- Windows command prompt doesn't use literal quoting via single quotes.
- Windows command prompt inner double quotes are escaped with a
backslash.
- Windows powershell does use single quotes but curl is not a powershell
script so the arguments may not be passed on correctly.
- Windows powershell inner double quotes seems can be passed to curl if
the outer quotes are double quotes and an escape of backslash-backtick
is used.
Command prompt example:
~~~
getargs -v -d "\"a\""
argv[0]: getargs
argv[1]: -v
argv[2]: -d
argv[3]: "a"
~~~
We need to check if the strchr() call returns NULL (due to missing
char) before we use the returned value in arithmetic. There is no
live bug here, but fixing it before it can become for hygiene.
Closes: #8814 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
We have lots of unchecked msnprintf calls, and this particular msnprintf
call isn't more interesting than the others, but this one yields a Coverity
warning so let's implicitly silence it. Going over the other invocations
is probably a worthwhile project, but for now let's keep the static
analyzers happy.
Closes: #8831 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Daniel Stenberg [Mon, 9 May 2022 14:47:06 +0000 (16:47 +0200)]
cookies: make bad_domain() not consider a trailing dot fine
The check for a dot in the domain must not consider a single trailing
dot to be fine, as then TLD + trailing dot is fine and curl will accept
setting cookies for it.
CVE-2022-27779
Reported-by: Axel Chong
Bug: https://curl.se/docs/CVE-2022-27779.html
Closes #8820
The asterisk in the abbreviation *NIX (for UNIX/Linux) needs to be
escaped to not mean start of italic formatting. This is consistent
with docs/RELEASE-PROCEDURE.md.
Closes: #8802 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
CC socksd-socksd.o
socksd.c:143:13: warning: no previous extern declaration for
non-static variable 'reqlogfile' [-Wmissing-variable-declarations]
const char *reqlogfile = DEFAULT_REQFILE;
^
socksd.c:143:7: note: declare 'static' if the variable is not
intended to be used outside of this translation unit
const char *reqlogfile = DEFAULT_REQFILE;
^
1 warning generated.
... when compiling with clang 13.
Closes: #8799 Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
param_place cannot be NULL here since we immediately efter this block
perform arithmetic on it (and use it in order to get here) so there is
little reason to check.
Closes: #8786 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
This function has been unused since the initial commit of the GSKit
backend in 0eba02fd4. The motivation for the code was getting the
whole certificate chain: the only place where the latter is available
is as a callback parameter. Unfortunately it is not possible to pass
a user pointer to this callback, which precludes the possibility to
associate the cert chain with a data/conn structure.
For further information, search for pgsk_cert_validation_callback on:
https://www.ibm.com/docs/api/v1/content/ssw_ibm_i_71/apis/gsk_attribute_set_callback.htm
As the upstream library never added a parameter like that to the API,
we give up the wait and remove the dead code.
Closes: #8782 Reviewed-by: Patrick Monnerat <patrick@monnerat.net>
curl: guard against size_t wraparound in no-clobber code
When generating the new filename, make sure we aren't overflowing the
size_t limit when calculating the new length. This is mostly academic
but good code hygeine nonetheless.
Closes: #8771 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
projects / thirdparty / curl.git / log
