Stefan Eissing [Tue, 14 Oct 2025 12:39:50 +0000 (14:39 +0200)]
scorecard: add perf support on linux
When calling scorecard with --flame to produce a flamegraph, use
"perf" on linux platforms to do the measurements. Update the scorecard
documentation about it.
Viktor Szakats [Mon, 13 Oct 2025 14:30:18 +0000 (16:30 +0200)]
examples: improve global init, error checks and returning errors
- add `curl_global_init()` and `curl_global_cleanup()` where missing.
- check the result of `curl_global_init()` where missing.
- return the last curl error from `main()`.
- drop Win32-specific socket initialization in favor of `curl_global_init()`.
- rename some outliers to `res` for curl result code.
- fix cleanup in some error cases.
Daniel Stenberg [Sun, 12 Oct 2025 09:15:08 +0000 (11:15 +0200)]
sws: pass in socket reference to allow function to close it
The function service_connection() now passes in a reference to the
socket instead of by value since the sub function http_connect() might
close it and set *infdp = CURL_SOCKET_BAD. This would previously not be
detected when service_connection() returned and potentially cause a
double close of the socket.
Daniel Stenberg [Sun, 12 Oct 2025 09:05:46 +0000 (11:05 +0200)]
libssh/libssh2: reject quote command lines with too much data
If there is lingering letters left on the right side after the paths
have been parsed, they are syntactically incorrect so returning error is
the safe thing to do.
Viktor Szakats [Fri, 10 Oct 2025 21:11:14 +0000 (23:11 +0200)]
cmake: pre-fill three more type sizes on Windows
Use `CMAKE_SIZEOF_VOID_P` to fill the size of three types that differ
on 32 and 64-bit Windows: `curl_socket_t`, `size_t`, and on mingw-w64:
`ssize_t`.
`time_t` remains the only type needing detection at configuration time,
with MSVC or mingw-w64.
Stefan Eissing [Fri, 10 Oct 2025 08:15:38 +0000 (10:15 +0200)]
thread: errno on thread creation
When thread creation fails, the code uses `errno` to remember the cause.
But pthread_create() never sets errno and gives the error as return value.
Fix that by setting the return value into errno on failure.
Windows: I think the ifdef was the wrong way around. Also set a generic
Windows Error code on CE systems.
Stefan Eissing [Wed, 8 Oct 2025 12:29:54 +0000 (14:29 +0200)]
socks: advance iobuf instead of reset
During the SOCKS connect phase, the `iobuf` is used to receive repsonses
from the server. If the server sends more bytes than expected, the code
discarded them silently.
Fix this by advancing the iobuf only with the length consumed.
Viktor Szakats [Fri, 10 Oct 2025 04:37:45 +0000 (06:37 +0200)]
cmake/FindGSS: drop wrong header check for GNU GSS
GNU GSS offers `gss.h`; do not check for `gssapi.h`. `gssapi.h`
was originally published by Heimdal, and later MIT Kerberos also added it
for Heimdal compatibility.
Viktor Szakats [Fri, 10 Oct 2025 01:09:16 +0000 (03:09 +0200)]
kerberos: bump minimum to 1.3 (2003-07-08), drop legacy logic
Previous minimum was: 1.2.4 (2002-02-28)
- assume `gssapi/gssapi.h` header for MIT Kerberos.
Drop logic detecting this header, and drop alternate logic including
a bare "gssapi.h". Bare `gssapi.h` is Heimdal-specific. MIT Kerberos
added support for it for Heimdal compatibility on 2006-11-09,
redirecting to `gssapi/gssapi.h`. MIT Kerberos supported the latter
header in the 1990s already.
There were still mentions of it after this patch, when using versions
<1.2.3, but those versions aren't supported since: 99185417952da30c8ddd82ab962fb58da96260b2 (2008-06-12)
This header remains in use by autotools and cmake to detect MIT Kerberos
(vs. Heimdal, which doesn't have it.)
Daniel Stenberg [Thu, 9 Oct 2025 20:32:09 +0000 (22:32 +0200)]
ftp: simplify the 150/126 size scanner
The file size is weirdly returned in a 150 or 126 response as "XXX
bytes" mentioned somewhere in the response string. This is a rewrite of
the size scanner to replace the strange strstr() + backwards search from
before with a plain forward search until '[number] + " bytes"' is a
match.
Triggered by a report by Joshua Rogers about the previous parser.
Daniel Stenberg [Thu, 9 Oct 2025 15:23:56 +0000 (17:23 +0200)]
asyn-ares: use the duped hostname pointer for all calls
In one c-ares call the passed in pointer was used and not the new
duplicated one. This is probably fine but might as well use the new
pointer as all the other calls do, which will survive longer.
Jay Satiro [Fri, 18 Oct 2024 18:12:31 +0000 (14:12 -0400)]
tool_operate: keep failed partial download for retry auto-resume
- Keep data from a failed download instead of discarding it on retry in
some limited cases when we know it's ok (currently only HTTP 200/206).
Prior to this change on failed transfer the tool truncated any outfile
data written before retrying the transfer. This change adds an exception
for HTTP downloads when the user requested auto-resume, because in that
case we can keep the outfile data and resume from the new position.
Joshua Rogers [Wed, 8 Oct 2025 22:06:40 +0000 (06:06 +0800)]
libssh2/sftp: fix resume corruption by avoiding O_APPEND with rresume
Opening the remote file with O_APPEND while attempting to resume causes
all writes to be forced to EOF on servers/implementations where O_APPEND
semantics override a prior seek(). As a result, sftp_seek64() is ignored
and the resumed data is appended, duplicating/corrupting the file.
Fix by:
- Using O_WRONLY (without O_APPEND) when resume_from > 0.
- Skipping the seek entirely if remote_append mode is requested.
Joshua Rogers [Wed, 8 Oct 2025 22:03:08 +0000 (06:03 +0800)]
libssh/sftp: fix resume corruption by avoiding O_APPEND with rresume
Opening the remote file with O_APPEND while attempting to resume causes
all writes to be forced to EOF on servers/implementations where O_APPEND
semantics override a prior seek(). As a result, sftp_seek64() is ignored
and the resumed data is appended, duplicating/corrupting the file.
Fix by:
- Using O_WRONLY (without O_APPEND) when resume_from > 0.
- Skipping the seek entirely if remote_append mode is requested.
Viktor Szakats [Wed, 8 Oct 2025 10:03:18 +0000 (12:03 +0200)]
build: drop Heimdal support, update docs, replace with MIT Kerberos in CI
The kerberos5 library Heimdal is one of three GSS libraries curl support.
It has a memory leak triggered by the new test in #18917 and the project
seems mostly abandoned.
Drop support and steer users to the MIT krb5 or GNU GSS libraries.
Co-authored-by: Daniel Stenberg
Ref: #18928
Closes #18928
Closes #18932
Stefan Eissing [Wed, 8 Oct 2025 09:56:09 +0000 (11:56 +0200)]
apple sectrust: check correct result on old OS versions
On ancient Apple OS versions where SecTrustEvaluateWithError() is not
available, the deprected SecTrustEvaluate() is used. In that code
branch, the code checked the wong variable for the verified result.
Viktor Szakats [Wed, 8 Oct 2025 16:49:51 +0000 (18:49 +0200)]
cmake/FindGSS: fix `pkg-config` fallback logic for CMake <3.16
The documented `<prefix>_<moduleName>_VERSION` variables are empty in
all tested versions since 3.7.2 to 4.1.2. Stop using it as a fallback
for <3.16 versions, and replace with the undocumented, but working,
`FindPkgConfig` internal variable `_pkg_check_modules_pkg_name`. It
contains the module name which was found.
In practice it caused that with CMake <3.16 + `pkg-config`, curl always
detected the Heimdal flavor of GSS.
Also: Delete a fallback version detection method, which was already
marked with a question mark in comments, and used the same, always
empty, CMake variables.
dependabot[bot] [Wed, 8 Oct 2025 12:46:51 +0000 (12:46 +0000)]
GHA: bump dependencies
- cryptography from 44.0.1 to 46.0.2 in tests/http
- ruff from 0.13.2 to 0.14.0 in .github/scripts
- reuse from 6.0.0 to 6.1.2 in .github/scripts
- github/codeql-action from 3.30.5 to 4.30.7
Viktor Szakats [Wed, 8 Oct 2025 12:50:58 +0000 (14:50 +0200)]
GHA/dependabot: tweak dir list to avoid a dupe, rename .txt file to avoid the bot
It correctly picked all pips, but also picked
`tests/http/requirements.txt` twice and also
`.github/scripts/codespell-ignore.txt`. Try avoid these issues with this
patch.
projects / thirdparty / curl.git / log
