Upgrade curl to curl-8_22_0 () - #57
fadedreamz wants to merge 1063 commits into
Conversation
Torture jobs are arguably the most flaky nowadays. Make a blind try to see if re-enabling taskkill makes an observable improvement for torture. Follow-up to 208b877 curl#21039 Follow-up to f450f38 curl#19897 Follow-up to 2701ac6 curl#19421 Closes curl#22495
Before this patch modern systems used `sigaction()` and `SA_RESTART` to install signal handlers, but the signal handler function itself still made a call to the legacy `signal()` function to re-register itself before returning. Re-registering the handler is not necessary with `sigaction()`. It's also undesired to use the legacy API when the modern one is available. Fix by guarding off this call in builds that support the modern API. Follow-up to 3fb6e5a curl#6529 Follow-up to 18cbb4d Closes curl#22497
Replace `ipv_inuse` and `use_ipv6` with `socket_type` and `socket_domain` (where missing) to avoid dupliicate globals with overlapping purposes. The replacement variables also support Unix sockets. Also: - simplify/reduce IPv6 guards. - socksd: fix to reset `socket_domain` for `--ipv4` option. Closes curl#22498
To sync with the rest of code which already handled `got_exit_signal` and did the restoration on exit. Also syncing with rest of servers. Also: turn off `keep_sigalrm` to sync with most servers. Closes curl#22499
…ariables `uint16_t` Follow-up to 1637bbc curl#22498 Closes curl#22501
To share more common code between servers, and to log the same set of information for all of them. Also: - move server unix socket to global variable. Follow-up to d1eca38 curl#22501 Follow-up to 1637bbc curl#22498 Closes curl#22503
In year 2020 the Unixy signal handler received a `logmsg()` call to log the signal number, but at the same time it already saved it to a global variable and logged it on exit, meaning this extra `logmsg()` was redundant. Because `logmsg()` is not signal-safe, this call was replaced in 2025 with signal-safe logging, but without the signal number, while also adding complexity, spent on trying to open the log file and handle errors. All for nothing, because the signal number was logged all along. This patch removes all this, and simplifies it to a single, signal-safe `write()` to STDERR to say that the signal handler triggered. This is also non-critical, but may help debugging. Also: point the POSIX documentation to the 2004 revision, which has a shorter list of safe functions. (was: 2018) Follow-up to e95f509 curl#16852 Follow-up to 9869f6d curl#5218 Closes curl#22507
…dd exit message On Windows, the init code calls `SetConsoleCtrlHandler()`, and before this patch also set handlers for all Unixy signals. Of these, `SIGBREAK` (used on Windows-only), `SIGINT`, `SIGABRT` and `SIGTERM` were also setting up a `SetConsoleCtrlHandler()`, in addition to the call made directly. (The rest, `SIGHUP`, `SIGPIPE`, `SIGALRM` are either missing the macros, or ignored by `signal()` on Windows.) As per WINE sources, `SetConsolCtrlHandler(<h>, TRUE)` calls are additive, which means the test server set up two console ctrl handlers. Then the ctrl handler set directly (`ctrl_event_handler()`), was triggering the other signal handler via `raise()`, for the 'initiate exit' logic, which in turn triggered exiting a wait within `select_ws()` and other loops. The Windows window handler also made use of the `SIGTERM` event to initiate exit via `raise()` and the second signal handler. To simplify, de-duplicate the ctrl handlers by dropping `signal()` calls and keeping the direct Win32 call with `ctrl_event_handler()` doing all the signal handling on Windows. Break out the 'initiate exit' logic into a function and call it from both Unix and Windows signal/ctrl/window handlers. Also drop calling `raise()` on exit, because it's a no-op without a `signal()` pair. Also: - drop logging the actual ctrl type number, replace with just logging whether we handled the event, in `ctrl_event_handler()`. To avoid using non-signal-safe functions (e.g. `fprintf()`) from the handler. - also replace `logmsg()` with `WriteFile()` to prevent regressions. Ref: curl#22045 - replace `logmsg()` with `WriteFile()` in `main_window_proc()`. - fix to forward ctrl handling to the OS in the rare case of failed `exit_event` initialization on startup. To swap a possible hang (within `WaitForMultipleObjectsEx()`) with an ungraceful shutdown. - add support for an 'exit message' string, set by signal/ctrl handlers, and log it on app exit. To avoid the need to deal with logging within the handlers, yet have a static trace message about the event. Complementing the already logged signal number. - drop stderr trace message from `exit_signal_handler()` in favor of an exit message. runtests triggers it frequantly, which added much noise to stderr. As a bonus, this also allows dropping the compiler warning suppression. Reported-by: Stefan Eissing Bug: curl#22487 (comment) Follow-up to 3aae64e curl#22507 Refs: https://learn.microsoft.com/windows/console/setconsolectrlhandler https://learn.microsoft.com/windows/console/registering-a-control-handler-function https://learn.microsoft.com/cpp/c-runtime-library/reference/raise https://learn.microsoft.com/cpp/c-runtime-library/reference/signal https://gitlab.winehq.org/wine/wine/-/blob/wine-11.14/dlls/kernelbase/console.c#L1517-1526 https://github.com/huangqinjin/ucrt/blob/d6e817a4cc90f6f1fe54f8a0aa4af4fff0bb647d/misc/signal.cpp#L286-L348 Follow-up to fe28fcf 7dc8a98 0e05877 curl#5260 Closes curl#22487
- makes test names less complicated - makes them less likely to wrap lines when using narrow terminals - runtests now returns error for the test if the name is longer - replace the "..." with a singe space Closes curl#22492
- convert the method switch() to a simple table - avoid converting the methods from external to internal numbers, they were the same anyway so keep the external ones, just use the old defines. - fix range check. It wrongly used the method numbers as bitmask, which made the check not work previously. Also error on OOM. - Dropped the session-id check. It too wrongly did a bitmask check which was wrong and never worked. When fixed, it broke test cases so I dropped the entire check. - split out rtsp_setup_request() from rtsp_do() - replace the httpversion variable with a define Closes curl#22505
And drop: - Consider OCSP stapling by default It is a practice that is going out-of-style, so doing this by default now seems wrong. - Provide callback for cert verification We have lots of options already. Let's not do this. Closes curl#22504
To simplify and to avoid the chance of potential interference or thread-safety issues. If one these 3 Win32 API calls fail, there is likely a serious problem, out of the code's control. Knowing `GetLastError()` is unlikely to help. Refs: https://learn.microsoft.com/windows/win32/api/winuser/nc-winuser-wndproc https://learn.microsoft.com/previous-versions/windows/desktop/legacy/ms686736(v=vs.85) https://learn.microsoft.com/windows/win32/api/winuser/nf-winuser-getmessage https://learn.microsoft.com/windows/win32/api/winuser/nf-winuser-createwindowexa https://learn.microsoft.com/windows/win32/api/winuser/nf-winuser-registerclassa Ref: 9ea4881 curl#22487 Ref: 1c49f2f curl#18451 Follow-up to ac1e206 Closes curl#22045
Verified by test 409 Reported-by: 1rhino2 on hackerone Closes curl#22500
dnsd now opens UDP+TCP sockets and accepts http: DoH requests to obtain the same, configured answers (records, delays, error codes) as over UDP. DoH: use `async->queries_ongoing` like all other resolvers instead of the internal `pending` counter. Fixes waiting for results. Tests: in pytest, parameterize dnsd tests to use both DNS and DoH. Closes curl#22506
- (much) less code repetition - simplifies ldap_do somewhat Closes curl#22510
- Change --enable-debug help text to say it is for developing curl.
- Warn when --enable-debug is used.
This change copies the help text and warning from cmake ENABLE_DEBUG.
Also, it shortens the "for debugging curl itself" to just say "for
debugging curl".
Now it looks like this:
--enable-debug Enable curl debug features (for developing
curl)
--disable-debug Disable curl debug features
Ref: curl#22481 (comment)
Reported-by: Viktor Szakats
Closes curl#22512
Found by pyrefly.
- Use %hu for unsigned short instead of %u. Prior to this change some compilers could warn of an argument type mismatch. C argument promotion rules promote the unsigned short argument to an int, which does not match %u (unsigned int) but does match %hu (unsigned short). Assisted-by: Viktor Szakats Closes curl#22511
Link.ABI is a feature of pkgconf 3.0 and indicates the ABI against which a consumer must link the package. For libcurl, this is hard-coded as C. Source is a URL from which to download the package tarball. Closes curl#22519
The filter only leaves comments and strings in all files using .c or .h extensions. It is important that the filter runs after all the other checks are done on these files as this process destroys the files. Fixes curl#22508 Closes curl#22509
Verify in test 2118 Closes curl#22475
Aka `CURL_ETAGS_FILES`. Follow-up to b73a4f0 curl#22680 Closes curl#22773
- config-*.h: 'handcrafted' - tool_operate: rename `CURL *` variable to `curl` to match rest of code. - urldata.h: drop redundant parentheses from macro values. - curlinfo, dnsd: omit unused main arguments. - easy: sync function name in error message with source code. - cmake: drop period from version requirement messages. - tests/server/util: link three signal-related articles. - inline comments, fix indent, newlines, clang-format. Closes curl#22774
- Don't do premature write shutdown (SHUT_WR) on the socket used to read the stdin data (aka socket_r). - Don't do premature read shutdown (SHUT_RD) on the socket used to write the stdin data (aka socket_w). - Remove broken setsockopt call for SO_DONTLINGER on socket_r. - Wait until all data sent from socket_w is acknowledged by socket_r. Prior to this change a partial shutdown of the write side of the read socket that the main thread reads stdin data from (socket_r) happened before reading the data from the socket. The partial shutdown caused a FIN to be sent which lingered for ~2 minutes (typical OS configured time), and after that time the connection was terminated. Theory of operation to read stdin on windows is a connection is established to relay stdin from a dedicated thread (write to socket_w) to the main thread (read from socket_r) so reading stdin is non-blocking. Data truncation would occur if this process was not completed by the OS FIN reply wait time. Note this FIN wait time is not the same as SO_LINGER wait time, the latter only used by closesocket. Ref: curl#22383 (comment) Closes curl#22682
Remove the assert that every `data` triggering ingress processing has an opened HTTP/2 stream. This is not true for connection shutdown processing, at the least. Reported-By: Max Dymond Closes curl#22776
With the clarification that the application has to take extra care when changing an "ambient user" setting, remove the special check in connection matching that had been imperfect from the start. Documented here: https://curl.se/libcurl/c/CURLOPT_USERNAME.html Closes curl#22775
In the HTTP/2 proxy filter, remember the server announced "last_stream_id" form a GOAWAY frame, so that error handling does not report a perfectly fine stream as broken. Reported-By: Max Dymond Closes curl#22778
Save clock system calls by passing obtained timestamps to expire and progress calls. transfer: remove duplicate progress call cf-ip-happy: remove timestamps never used cf-https-connect: remove timestamps never used Closes curl#22779
- update `github/codeql-action/init` from 4.37.3 to 4.37.8 - update `github/codeql-action/analyze` from 4.37.3 to 4.37.8 - update `cryptography` from 49.0.0 to 50.0.0 - update `filelock` from 3.32.0 to 3.32.4 - update `ruff` from 0.16.2 to 0.16.5 - update `websockets` from 16.1.1 to 17.0.1 Closes curl#22781 Closes curl#22782
- CMake/win32-cache.cmake: sort and sync MSVC pre-fills with mingw-w64. - curl_sasl: use `uint32_t` for local `httpauth` value. To match struct. Follow-up to e369161 curl#20209 - libstests: move literal to the right-hand side of comparisons. - windows: drop `!= 0`/`== 0` from `WSAEventSelect()` result checks, to keep it short. - tool_cfgable: replace `CURL_GLOBAL_ALL` with `CURL_GLOBAL_DEFAULT` in debug builds to match the macro used in non-debug and libcurl init. (Both macros map to the same literal value; there is no code change.) - perf/urlparser: use double-const in test array. - examples: `CURL_GLOBAL_DEFAULT` -> `CURL_GLOBAL_ALL` to match rest of examples. - libtests: `CURL_GLOBAL_DEFAULT` -> `CURL_GLOBAL_ALL` to match rest of tests. Closes curl#22783
When the incoming DNS packet is broken, there might be bytes left at the end that the parser ignores so let's not assert on that. Reported-by: Max Dymond Closes curl#22785
Supported by clang-tidy 23.1.0+. Ref: https://clang.llvm.org/extra/clang-tidy/checks/bugprone/assignment-in-selection-statement.html Closes curl#22792
![cycode-security[bot]](https://avatars.githubusercontent.com/in/39308?s=60&v=4){kind=small}
| curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api"); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY, | ||
| "9f8362f87a484a954e6e740c5b4c0e84" |
There was a problem hiding this comment.
❗Cycode: Secret of type: 'Hex Entropy' was found.
Risk Score: 63 (MEDIUM)
Severity: Medium
Confidence Score: 96%
SHA: 168f7011be
Description
The Hex Entropy is designed to identify any strings with high entropy that are assigned to sensitive variables within Hex text.. Hexadecimal, or "hex," is a base-16 numbering system that uses the digits 0-9 and the letters A-F to represent numbers
Cycode Remediation Guideline
❗ How to revoke
- Identify the source and usage of the hex entropy secret.
- Generate a new secret with appropriate entropy and format.
- Update the system or application configuration to use the new secret.
- Revoke the old secret from any systems or services where it was used.
- Verify that the old secret is no longer accessible or usable.
- Test the system or application to ensure it functions correctly with the new secret.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_secret_false_positive <reason> | Applies to this secret value for all repos in your organization |
| #cycode_secret_revoked | Applies to this secret value for all repos in your organization |
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY, | ||
| "9f8362f87a484a954e6e740c5b4c0e84" | ||
| "229139a20aa8ab56ff66586f6a7d29c5"); |
There was a problem hiding this comment.
❗Cycode: Secret of type: 'Hex Entropy' was found.
Risk Score: 63 (MEDIUM)
Severity: Medium
Confidence Score: 91%
SHA: e7a17867d4
Description
The Hex Entropy is designed to identify any strings with high entropy that are assigned to sensitive variables within Hex text.. Hexadecimal, or "hex," is a base-16 numbering system that uses the digits 0-9 and the letters A-F to represent numbers
Cycode Remediation Guideline
❗ How to revoke
- Identify the source and usage of the hex entropy secret.
- Generate a new secret with appropriate entropy and format.
- Update the system or application configuration to use the new secret.
- Revoke the old secret from any systems or services where it was used.
- Verify that the old secret is no longer accessible or usable.
- Test the system or application to ensure it functions correctly with the new secret.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_secret_false_positive <reason> | Applies to this secret value for all repos in your organization |
| #cycode_secret_revoked | Applies to this secret value for all repos in your organization |
| curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api"); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY, | ||
| "9f8362f87a484a954e6e740c5b4c0e84" |
There was a problem hiding this comment.
❗Cycode: Secret of type: 'Hex Entropy' was found.
Risk Score: 63 (MEDIUM)
Severity: Medium
Confidence Score: 97%
SHA: 168f7011be
Description
The Hex Entropy is designed to identify any strings with high entropy that are assigned to sensitive variables within Hex text.. Hexadecimal, or "hex," is a base-16 numbering system that uses the digits 0-9 and the letters A-F to represent numbers
Cycode Remediation Guideline
❗ How to revoke
- Identify the source and usage of the hex entropy secret.
- Generate a new secret with appropriate entropy and format.
- Update the system or application configuration to use the new secret.
- Revoke the old secret from any systems or services where it was used.
- Verify that the old secret is no longer accessible or usable.
- Test the system or application to ensure it functions correctly with the new secret.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_secret_false_positive <reason> | Applies to this secret value for all repos in your organization |
| #cycode_secret_revoked | Applies to this secret value for all repos in your organization |
| curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api"); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY, | ||
| "9f8362f87a484a954e6e740c5b4c0e84" |
There was a problem hiding this comment.
❗Cycode: Secret of type: 'Hex Entropy' was found.
Risk Score: 63 (MEDIUM)
Severity: Medium
Confidence Score: 96%
SHA: 168f7011be
Description
The Hex Entropy is designed to identify any strings with high entropy that are assigned to sensitive variables within Hex text.. Hexadecimal, or "hex," is a base-16 numbering system that uses the digits 0-9 and the letters A-F to represent numbers
Cycode Remediation Guideline
❗ How to revoke
- Identify the source and usage of the hex entropy secret.
- Generate a new secret with appropriate entropy and format.
- Update the system or application configuration to use the new secret.
- Revoke the old secret from any systems or services where it was used.
- Verify that the old secret is no longer accessible or usable.
- Test the system or application to ensure it functions correctly with the new secret.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_secret_false_positive <reason> | Applies to this secret value for all repos in your organization |
| #cycode_secret_revoked | Applies to this secret value for all repos in your organization |
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY, | ||
| "9f8362f87a484a954e6e740c5b4c0e84" | ||
| "229139a20aa8ab56ff66586f6a7d29c5"); |
There was a problem hiding this comment.
❗Cycode: Secret of type: 'Hex Entropy' was found.
Risk Score: 63 (MEDIUM)
Severity: Medium
Confidence Score: 91%
SHA: e7a17867d4
Description
The Hex Entropy is designed to identify any strings with high entropy that are assigned to sensitive variables within Hex text.. Hexadecimal, or "hex," is a base-16 numbering system that uses the digits 0-9 and the letters A-F to represent numbers
Cycode Remediation Guideline
❗ How to revoke
- Identify the source and usage of the hex entropy secret.
- Generate a new secret with appropriate entropy and format.
- Update the system or application configuration to use the new secret.
- Revoke the old secret from any systems or services where it was used.
- Verify that the old secret is no longer accessible or usable.
- Test the system or application to ensure it functions correctly with the new secret.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_secret_false_positive <reason> | Applies to this secret value for all repos in your organization |
| #cycode_secret_revoked | Applies to this secret value for all repos in your organization |
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY, | ||
| "9f8362f87a484a954e6e740c5b4c0e84" | ||
| "229139a20aa8ab56ff66586f6a7d29c5"); |
There was a problem hiding this comment.
❗Cycode: Secret of type: 'Hex Entropy' was found.
Risk Score: 63 (MEDIUM)
Severity: Medium
Confidence Score: 91%
SHA: e7a17867d4
Description
The Hex Entropy is designed to identify any strings with high entropy that are assigned to sensitive variables within Hex text.. Hexadecimal, or "hex," is a base-16 numbering system that uses the digits 0-9 and the letters A-F to represent numbers
Cycode Remediation Guideline
❗ How to revoke
- Identify the source and usage of the hex entropy secret.
- Generate a new secret with appropriate entropy and format.
- Update the system or application configuration to use the new secret.
- Revoke the old secret from any systems or services where it was used.
- Verify that the old secret is no longer accessible or usable.
- Test the system or application to ensure it functions correctly with the new secret.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_secret_false_positive <reason> | Applies to this secret value for all repos in your organization |
| #cycode_secret_revoked | Applies to this secret value for all repos in your organization |
| curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api"); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519); | ||
| curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY, | ||
| "9f8362f87a484a954e6e740c5b4c0e84" |
There was a problem hiding this comment.
❗Cycode: Secret of type: 'Hex Entropy' was found.
Risk Score: 63 (MEDIUM)
Severity: Medium
Confidence Score: 96%
SHA: 168f7011be
Description
The Hex Entropy is designed to identify any strings with high entropy that are assigned to sensitive variables within Hex text.. Hexadecimal, or "hex," is a base-16 numbering system that uses the digits 0-9 and the letters A-F to represent numbers
Cycode Remediation Guideline
❗ How to revoke
- Identify the source and usage of the hex entropy secret.
- Generate a new secret with appropriate entropy and format.
- Update the system or application configuration to use the new secret.
- Revoke the old secret from any systems or services where it was used.
- Verify that the old secret is no longer accessible or usable.
- Test the system or application to ensure it functions correctly with the new secret.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_secret_false_positive <reason> | Applies to this secret value for all repos in your organization |
| #cycode_secret_revoked | Applies to this secret value for all repos in your organization |
|
|
||
| fail: | ||
| if(keybuf) { | ||
| memset(keybuf, 0, keylen); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'The invocation of memset() is easy to get wrong'.
Risk Score: 96 (CRITICAL)
Severity: High
Description
The invocation of memset() is easy to get wrong. The second argument is the character and the third argument is the size, but sometimes these arguments are in the wrong order. This results in a no-op.
Cycode Remediation Guideline
When programming in C, misuse of the memset() function by swapping the byte value and size arguments can introduce vulnerabilities. This common mistake can result in a no-op, leading to security risks and potential data exposure.
The incorrect use of memset() where the size is mistakenly passed as the byte value and vice versa can create security vulnerabilities. If sensitive data is not properly cleared from memory due to this error, it may be exposed to unauthorized access. Additionally, unintended behavior within the program could arise, potentially leading to crashes or data corruption.
An example of vulnerable code exemplifying this issue:
#include <stdio.h>
#include <string.h>
int main() {
char buffer[10];
// Vulnerable memset call with arguments swapped
memset(buffer, 10, '\0');
// Code continues...
return 0;
}To address this vulnerability, ensure that the arguments are correctly ordered in the memset() function call. The byte value should precede the size argument to correctly initialize or clear the desired memory block.
A corrected version of the vulnerable code snippet:
#include <stdio.h>
#include <string.h>
int main() {
char buffer[10];
// Corrected memset call with arguments in the right order
memset(buffer, '\0', 10);
// Code continues...
return 0;
}By making this adjustment, the memset() function will function as intended, properly initializing or clearing the specified memory block. This correction mitigates the risk of data exposure and unintended behavior, ensuring the secure handling of sensitive information within the program.
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
20 participants
Automated curl upgrade to
curl-8_22_0for .Merged upstream tag into
masteron branchcve/curl-curl-8_22_0.Files changed: 0.
The break reviewer flagged API-incompatible changes and the repair loop resolved them locally before this PR was opened:
Opened by cve-libcurl-updater. Do not auto-merge — human review required.