Commit Graph

1505 Commits

Author SHA1 Message Date
Daniel Stenberg
e65ba1bd34
hsts: make the HSTS read callback handle name dupes
Now the logic for handling name duplicates and picking the longest
expiry and strictest subdomain is the same for the callback as for when
reading from file.

Also strip trailing dots from the hostname added by the callback.

A minor side-effect is that the hostname provided by the callback can
now enable subdomains by starting the name with a dot, but we discourage
using such hostnames in documentation.

Amended test 1915 to verify.

Closes #21201
2026-04-02 18:01:20 +02:00
Viktor Szakats
0df6c01db3
tidy-up: rename Curl_safefree()/tool_safefree() to curlx_safefree()
To sync names for the same macro logic between lib and src, and to move
it to the curlx namespace, to match `curlx_free()` that it's calling.

Closes #21151
2026-04-01 19:53:53 +02:00
Stefan Eissing
2b3dfb4ad4
lib: make resolving HTTPS DNS records reliable:
- allow to specify when they are wanted on starting a resolve
- match dns cache entries accordingly. An entry which never
  tried to get HTTPS-RRs is no answer for a resolve that wants
  it.
- fix late arrivals of resolve answers to match the "async"
  records that started them - if it still exists.
- provide for multiple "async" resolves in a transfer at the
  same time. We may need to resolve an IP interface while the
  main connection resolve has not finished yet.
- allow lookup of HTTPS-RR information as soon as it is
  available, even if A/AAAA queries are still ongoing.

For this, the "async" infrastructure is changed:

- Defined bits for DNS queries `CURL_DNSQ_A`, `CURL_DNSQ_AAAA`
  and `CURL_DNSQ_HTTPS`. These replace `ip_version` which says
  nothing about HTTPS.
  Use them in dns cache entries for matching.
- enhance the `async->id` to be a unique `uint32_t` for
  resolves inside one multi. This is weak, as the id may
  wrap around. However it is combined with the `mid` of
  the easy handle, making collisions highly unlikely.
  `data->state.async` is only accessed in few places where
  the mid/async-id match is performed.
- vtls: for ECH supporting TLS backends (openssl, rustls, wolfssl),
  retrieve the HTTPS-RR information from the dns connection filter.
  Delay the connect if the HTTPS-RR is needed, but has not
  been resolved yet.

The implementation of all this is complete for the threaded
resolver. c-ares resolver and DoH do not take advantage of
all new async features yet. To be done in separate PRs.

Details:

c-ares: cleanup settings and initialisation. Any ares channel
is only being created on starting a resolve and propagating
operations in setopt.c to the channel are not helpful.

Changed threaded+ares pollset handling so that they do not
overwrite each others `ASYNC_NAME` timeouts.

Add trace name 'threads' for tracing thread queue and
pool used by threaded resolver.

Closes #21175
2026-04-01 15:36:31 +02:00
Viktor Szakats
ce6c441cf2
build: drop redundant HAVE_PTHREAD_H guard
Prior to this patch code used either `HAVE_PTHREAD_H`, or
`HAVE_THREADS_POSIX`, or both, to decide if POSIX Threads support is
present. In effect requiring both to be defined for a consistent build.

Drop detecting and guarding for `pthread.h`, and assume it present when
`HAVE_THREADS_POSIX` is set.

OS/400 had `HAVE_PTHREAD_H` set, but not `HAVE_THREADS_POSIX`, which
possibly left threading disabled in most sources.

Ref: https://pubs.opengroup.org/onlinepubs/009695399/basedefs/pthread.h.html
Ref: 930f2e8227 #21144

Closes #21158
2026-03-30 18:57:07 +02:00
Viktor Szakats
930f2e8227
build: drop duplicate pthread.h includes
Already included from `curl_setup.h`.

Closes #21144
2026-03-30 13:46:14 +02:00
Viktor Szakats
3c72928471
build: drop redundant USE_QUICHE guards
When used together with `USE_OPENSSL`. `USE_QUICHE` always implies
`USE_OPENSSL`.

Also: merge two (now identical) `#if` blocks in `openssl.c`.

Closes #21135
2026-03-30 13:46:14 +02:00
Stefan Eissing
335dc0e3c5
cf-dns: connection filter for DNS queries
New connection filter `cf-dns` that manages DNS queries. If hands
out addresses and HTTPS-RR records to anyone interested. Used by
HTTPS and IP happy eyeballing.

Information may become available *before* the libcurl "dns entry"
is complete, e.g. all queries have been answered. The cf-ip-happy
filter uses this information to start connection attempts as soon
as the first address is available.

The multi MSTATE_RESOLVING was removed. A new connection always
goes to MSTATE_CONNECTING. The connectdata bit `dns_resolved`
indicates when DNS information is complete. This is used for
error reporting and starting the progress meter.

Removed dns entries `data->state.dns[i]`, as the `cf-dns` filter
now keeps the reference now.

Many minor tweaks for making this work and pass address information
around safely.

Closes #21027
2026-03-30 13:28:38 +02:00
Viktor Szakats
20914e3753
perl: harden external command invocations
In `adddocsref.pl`, `checksrc-all.pl`, `singleuse.pl` and tests 307, 1013,
1022, 1275, 1707, 1708, 1710.

Closes #21097
2026-03-26 14:20:07 +01:00
Viktor Szakats
62d77b12fc
spacecheck: check long lines and repeat spaces, fix fallouts
Verify if lines are not longer than 192 characters. Also verify if lines
have less than 79 repeat spaces (and fix one fallout).

To improve readability by avoiding long lines and to prevent adding
overly long lines with text that may go unnoticed in an editor or diff
viewer.

In addition to pre-existing line length limits: 79 for C, 132 for CMake
sources.

Also:
- spacecheck: fix/harden allowlist regexes.
- spacecheck: tidy-up quotes and simplify escaping.
- spacecheck: allow folding strings with repeat spaces.
- GHA: fix a suppressed shellcheck warning.
- GHA/macos: simplify by dropping brew bundle.
- test1119.pl: precompile a regex.
- FAQ.md: delete very long link to a Windows 7/2008 support article
  that's lost it relevance.

Closes #21087
2026-03-25 11:02:08 +01:00
Daniel Stenberg
3ef422e128
lib1560: verify more URLs
- control codes at various places in URL, even when URL encoding
  is requested

- verify zone id extraction more

Closes #21071
2026-03-23 14:35:02 +01:00
Daniel Stenberg
e0be05cbab
urlapi: fix handling of "file:///"
When the path is exactly one byte, a single slash.

Extended test 1560 to verify.

Found by Codex Security

Closes #21070
2026-03-23 10:17:59 +01:00
Stefan Eissing
82009c4220
share: concurrency handling, easy updates
Replace the `volatile int dirty` with a reference counter
protected by a mutex when available.

Solve the problem of when to call application's lock function
by adding a volatile flag that indicates a share has been added
to easy handles in its lifetime. That flag ever goes from
FALSE to TRUE, so volatile might work (in the absence of a mutex).

(The problem is that the lock/unlock functions need 2-3
`curl_share_setopt()` invocations to become usable and there
is no way of telling if the third will ever happen. Calling
the lock function before the 3rd setopt may crash the
application.)

When removing a share from an easy handle (or replacing it with
another share), detach the easy connection on a share with a
connection pool.

When cleaning up a share, allow this even if it is still used in
easy handles. It will be destroyed when the reference count
drops to 0.

Closes #20870
2026-03-21 14:42:49 +01:00
Viktor Szakats
c3c2bf5941
libtest: drop duplicate include
Include moved to `unitcheck.h` earlier.

Follow-up to 96d5b5c688 #20864
Ref: 8a1f361716 #21024

Closes #21046
2026-03-21 13:14:46 +01:00
Stefan Eissing
96d5b5c688
dnscache: own source file, improvements
- Rename `Curl_resolv_unlink()` to `Curl_dns_entry_unlink()`.
- Change `Curl_dnscache_get()` to return CURLcode result. Returns
  now `CURLE_COULDNT_RESOLVE_HOST` for "negative" cache entries.
- Add `Curl_dnscache_add_negative()` to put a "negative" entry
  into the cache.

Closes #20864
2026-03-21 12:04:36 +01:00
Stefan Eissing
9bc8b078eb
multi: improve wakeup and wait code
- Split WINSOCK and POSIX code in `multi_wait()` as the ifdef'ery
  was becoming unreadable
- define `ENABLE_WAKEUP` to mean the wakeup socketpair is enabled,
  no additional USE_WINSOCK check needed. Under WINSOCK
  `ENABLE_WAKEUP` is not defined, so it's availability is as before
  under the double defined() checks
- When the multi handle has "alive" transfers, the admin handle's
  pollset include the wakeup receive socket. This results in the
  admin handle running when someone uses `curl_multi_wakeup()`.
- Without any "alive" transfers, the wakeup socket is removed from
  the pollset. Otherwise, event based processing would never finish,
  eg. leave the event loop.
- The wakeup socket was never registered for event processing before,
  e.g. `curl_multi_wakeup()` never worked in that mode.
- Adjust test exepectations on socket callback invocations and
  number of sockets appearing in waitfds sets.

Closes #20832
2026-03-21 11:58:24 +01:00
Viktor Szakats
8a1f361716
build: limit unitprotos.h include to units target
To omit it from `tunits`.

Also: move the include to `unitcheck.h` to save a guard.

Ref: https://github.com/curl/curl/pull/21014#issuecomment-4093742896
Reported-by: Daniel Stenberg
Fixes #21021
Follow-up to 98d8e82c74 #21014

Closes #21024
2026-03-20 11:31:35 +01:00
Daniel Stenberg
98d8e82c74
lib: move all UNITTEST prototypes to C files
- make extract-unit-protos handle multi-line prototypes - but they need
  to be above the implementation

- Prototypes for static functions we use in unit tests should not be in
  header files. We generate lib/unitprotos.h for this purpose

- Removed some function wrappers written for unit tests and make them
  use UNITTEST function directly.

- Renamed time2str() in the tool to timebuf() since we have the same
  name in lib/ and in unit tests they can both be used non-static in a
  build.

This reverts commit f95fadd116.

Follow-up to #21010

Closes #21014
2026-03-20 07:47:57 +01:00
Viktor Szakats
6b645f91f6
mk-lib1521.pl: fix 4 callback function types passed to setopt
Silencing these warnings (seen on Solaris 11 SPARC GCC 4.9.2 + OpenCSW):
```
lib1521.c: In function 'test_lib1521':
/include/curl/typecheck-gcc.h:93:13: warning: call to 'Wcurl_easy_setopt_err_conv_cb' declared with attribute warning: curl_easy_setopt expects a curl_conv_callback argument
curl_easy_setopt(curl, CURLOPT_CONV_FROM_NETWORK_FUNCTION,
curl_easy_setopt(curl, CURLOPT_CONV_TO_NETWORK_FUNCTION,
curl_easy_setopt(curl, CURLOPT_CONV_FROM_UTF8_FUNCTION,
/include/curl/typecheck-gcc.h:123:13: warning: call to 'Wcurl_easy_setopt_err_interleave_cb' declared with attribute warning: curl_easy_setopt expects a curl_interleave_callback argument
curl_easy_setopt(curl, CURLOPT_INTERLEAVEFUNCTION,
```
Ref: https://curl.se/dev/log.cgi?id=20260319160651-1785427#prob2

Follow-up to de0adda78c

Closes #21017
2026-03-20 01:42:47 +01:00
Viktor Szakats
51f813308e
scripts: harden / tidy up more Perl system() calls
Closes #21007
2026-03-19 14:26:56 +01:00
Viktor Szakats
59405ffb7d
build: enable -Wimplicit-int-enum-cast compiler warning, fix issues
Offered by clang 21+.

Closes #20990
2026-03-19 11:17:17 +01:00
Viktor Szakats
578ee6b79b
gcc: guard #pragma diagnostic in core code for <4.6, disable picky warnings
Extend `#pragma diagnostic push`/`pop` guards to the whole codebase
(from tests and examples only) to disable it for GCC <4.6. Rename guard
to `CURL_HAVE_DIAG` and make it include llvm/clang to be interchangeable
with `__GNUC__ || __clang__` in this context.

The above means no longer disabling certain warnings locally, so pair
this with disabling all picky warnings for GCC <4.6.

Also:
- drop global workarounds for misbehaving GCC <4.6 compiler warnings.
  Not needed with picky warnings disabled.

Reported-by: fds242 on github
Reported-by: Sergey Fedorov
Thanks-to: Orgad Shaneh
Follow-up to f07a98ae11 #20366
Fixes #20892
Fixes #20924
Closes #20902
Closes #20907
2026-03-18 11:33:37 +01:00
Viktor Szakats
030d6aeaf3
build: include curlx headers directly in src and tests
To include what's actually used.

Also:
- drop unused includes.
- scope includes where possible.
- drop `curlx/curlx.h` umbrella header.
- config2setopts: include `netinet/in.h` for Cygwin/MSYS2.
  Previously included by chance via an unused curlx include.

Closes #20776
2026-03-16 12:05:39 +01:00
Viktor Szakats
6d87eb2878
cmake: add CURL_GCC_ANALYZER option, enable in CI, fix/silence
Enable in one existing Linux, macOS and Windows job.

Cost:
- Linux: +1.3 minutes.
- macOS: +1.5 minutes.
- Windows: +2.5 minutes.

Fix or silence issues found:
- conncache: silence NULL deref warning.
  ```
  lib/conncache.c:564:18: warning: dereference of NULL '*data.multi' [CWE-476] [-Wanalyzer-null-dereference]
  ```
  Ref: ede6a8e087 #19378
- http2: check pointer for NULL.
  ```
  lib/http2.c:388:7: error: dereference of NULL ‘data’ [CWE-476] [-Wanalyzer-null-dereference]
  ```
- http2: silence potential NULL deref in `cf_h2_recv`.
  ```
  lib/http2.c: In function 'cf_h2_recv':
  lib/curl_trc.h:62:15: warning: dereference of NULL 'data' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- openldap: silence deref before NULL check.
  Seen in GHA/Linux.
  ```
  lib/openldap.c: In function ‘oldap_state_mechs_resp’:
  lib/curl_trc.h:140:7: warning: check of ‘data’ for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  ```
- sendf: silence NULL deref false positive in `Curl_creader_set_fread`.
  It looks impossible to happen.
  ```
  lib/sendf.c:1133:7: warning: dereference of NULL 'r' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- ws: silence deref before NULL check.
  ```
  lib/ws.c: In function 'ws_send_raw_blocking':
  lib/curl_trc.h:205:7: warning: check of 'data' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  ```
- var: fix potential NULL deref
  ```
  src/var.c:216:29: warning: dereference of NULL 'envp' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- cli_hx_upload.c: fix NULL check after dereference.
  ```
  tests/libtest/cli_hx_upload.c:170:7: warning: check of '*t.method' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  ```
- unit1607, unit1609: fix theoretical NULL ptr dereference.
  ```
  tests/unit/unit1607.c:211:12: warning: dereference of NULL 'addr' [CWE-476] [-Wanalyzer-null-dereference]
  tests/unit/unit1609.c:193:12: warning: dereference of NULL 'addr' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- globally disable checks triggering false positives only:
  ```
  docs/examples/externalsocket.c:135:8: warning: 'connect' on possibly invalid file descriptor 'sockfd' [-Wanalyzer-fd-use-without-check]
  lib/bufq.c:465:16: warning: infinite loop [CWE-835] [-Wanalyzer-infinite-loop] (gcc-15 Windows)
  lib/doh.c:1035:34: warning: stack-based buffer over-read [CWE-126] [-Wanalyzer-out-of-bounds] (gcc-15 macOS)
  lib/ftp.c:4022:20: warning: infinite loop [CWE-835] [-Wanalyzer-infinite-loop] (gcc-15 macOS)
  lib/http2.c:689:28: warning: buffer over-read [CWE-126] [-Wanalyzer-out-of-bounds] (gcc-15 macOS)
  lib/socketpair.c:195:5: warning: leak of file descriptor 'curl_dbg_socket(2, 1, 0, 192, "D:/a/curl/curl/lib/socketpair.c")' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_doswin.c:810:7: warning: leak of file descriptor '*tdata.socket_l' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_doswin.c:816:9: warning: leak of file descriptor '*tdata.socket_l' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_main.c:96:1: warning: leak of file descriptor 'fd[0]' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_main.c:96:1: warning: leak of file descriptor 'fd[1]' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_urlglob.c:48:17: warning: leak of 'malloc(8)' [CWE-401] [-Wanalyzer-malloc-leak]
  src/tool_writeout.c:870:3: warning: leak of FILE 'stream2' [CWE-775] [-Wanalyzer-file-leak]
  tests/libtest/lib518.c:90:1: warning: leak of FILE [CWE-775] [-Wanalyzer-file-leak]
  tests/libtest/lib537.c:87:1: warning: leak of FILE [CWE-775] [-Wanalyzer-file-leak]
  tests/server/tftpd.c:1147:10: warning: 'bind' on possibly invalid file descriptor 'sock' [-Wanalyzer-fd-use-without-check]
  tests/server/tftpd.c:1155:10: warning: 'bind' on possibly invalid file descriptor 'sock' [-Wanalyzer-fd-use-without-check]
  tests/server/tftpd.c:1259:10: warning: 'connect' on possibly invalid file descriptor '4294967295' [-Wanalyzer-fd-use-without-check]
  ```

Also:
- cmake: update clang-tidy typecheck comment.

Ref: https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html

Closes #20921
2026-03-16 11:49:34 +01:00
Viktor Szakats
6ada2e3dce
autotools: limit checksrc target to ignore non-repo test sources
Syncing tests with lib and src behavior.

Also:
- fix OS400 checksrc to find the per-directory `.checksrc` file.

Closes #20898
2026-03-12 01:45:24 +01:00
Daniel Stenberg
11c14b5ca5
urlapi: verify the last letter of a scheme when set explictly
A logic error made the function not check the last character, which thus
could make it accept invalid schemes.

Added test 1965 to verify

Reported-by: Otis Cui Lei

Closes #20893
2026-03-11 23:48:53 +01:00
Felipe Mesquita
f25124338c
badwords: avoid 'simply'
It's mostly a filler word. I've read through each use of it in the code
base and did minor rephrasings when "simply" carried some meaning. The
overwhelming majority of cases, removing it improved the text
significantly. Inspired by #20793.

Closes #20822
2026-03-10 19:34:06 +01:00
Viktor Szakats
ccba492024
tidy-up: miscellaneous
Closes #20851
2026-03-09 11:35:19 +01:00
Viktor Szakats
a5c6a4067a
clang-tidy: fix readability-suspicious-call-argument
Also:
- curlx/strerr: avoid a false positive by dropping an interim variable.
- enable this check.

Ref: #20627 (initial attempt)

Closes #20777
2026-03-02 15:28:25 +01:00
Viktor Szakats
1b35c9e1e3
cmake: rename testbins target to tt, restore internal option
To make it easy to type. The internal option is used in CI.

Follow-up to aae361242f #20708

Closes #20768
2026-03-01 00:24:47 +01:00
Viktor Szakats
aae361242f
cmake: replace internal option with a new testbins target
To allow building test binaries without test certs, replacing
`_CURL_SKIP_BUILD_CERTS` internal option with a build target that is
similar to `testdeps`, but without building the test certificates.

To make building test binaries a little bit faster, with less noisy
output, and without having to reconfigure the build.

Closes #20708
2026-02-25 22:57:02 +01:00
Viktor Szakats
725c5609ae
clang-tidy: avoid/silence bugprone-not-null-terminated-result
Prefer `sizeof()` over `strlen()`, static const variables over macros.
Add a couple of `NOLINT`s to silence false positives.

Also sync similar code patterns between libtests.

Cherry-picked from #20720

Closes #20723
2026-02-25 22:11:05 +01:00
Viktor Szakats
39542f0993
cmake: add native clang-tidy support for tests, with concatenated sources
Tests are build in "unity"-style, by including sources into an umbrella
C files (similar to how CMake unity works). This does not play well with
clang-tidy, which seems to unconditionally ignore C sources included
like this. To fix it, curl's CMake implements a manual clang-tidy
support for tests, which  compiles sources one-by-one, while also making
sure sources compile cleanly standalone (e.g. all sources need to
include `first.h`). The manual clang-tidy implementation is fragile, and
performance, in particular when targeting Windows, is abysmal.

This patch introduces an alternate solution, enabled by the
`_CURL_TESTS_CONCAT=ON` option. In this mode, umbrella sources include
the actual sources instead of `#including` them. Allowing to use CMake's
built-in clang-tidy support to compile them, with clang-tidy actually
checking the sources. Making the manual clang-tidy support unnecessary.
In the Windows CI job it results in a 4x performance improvement (4m ->
1m), making it practical to run clang-tidy on tests on Windows, in CI.

The main downside is that clang-tidy doesn't understand the `#line`
directive. Meaning issues found show the wrong filename and line number
next to them. It's not impossible to locate errors this way, but also
not convenient.

Minor/potential downside is that the concatenated source needs to be
reassembled each time an original source is updated. This may result in
more copying on the disk when used in local development. The largest
source is 1.4MB, so probably not a show-stopper on most machines.

Another is the complexity of maintaining two methods in parallel, which
may be necessary till clang-tidy understands `#line`:
https://github.com/llvm/llvm-project/issues/62405

This solution may in theory also enable adding clang-tidy support for
tests in autotools, though I haven't tried.

Targeted for curl CI for now, and used in a GHA/windows job. 100%
experimental, not recommended outside these.

Closes #20667
2026-02-25 17:28:35 +01:00
Viktor Szakats
af78b199b2
tidy-up: miscellaneous
- vms/curlmsg_vms.h: delete unused/commented code.
- vtls/schannel_verify: sort includes.
- typecheck-gcc.h: fix indent and alignment.
- lib/config-win32.h: drop idle `#undef`.
- spacecheck: check for stray empty lines before after curly braces.
- make literals more readable: 1048576 -> 1024 * 1024
- scope variables.
- use ISO date in a comment.
- drop redundant parentheses.
- drop empty comments.
- unfold lines.
- duplicate/stray spaces in comments.
- fix indent, whitespace, minor typos.

Closes #20690
2026-02-25 14:44:56 +01:00
Viktor Szakats
ac46392f44
clang-tidy: enable bugprone-signed-char-misuse, fix fallouts
Examples:
```
lib/vtls/openssl.c:2585:18: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
 2585 |       msg_type = *(const char *)buf;
lib/vtls/openssl.c:2593:18: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
 2593 |       msg_type = *(const char *)buf;
tests/server/mqttd.c:514:10: warning: comparison between 'signed char' and 'unsigned char' [bugprone-signed-char-misuse]
  514 |       if(passwd_flag == (char)(conn_flags & passwd_flag)) {
tests/server/tftpd.c:362:13: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  362 |         c = test->rptr[0];
tests/server/tftpd.c:454:9: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  454 |     c = *p++;                     /* pick up a character */
src/tool_urlglob.c:272:46: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  272 |     pat->c.ascii.letter = pat->c.ascii.min = min_c;
src/tool_urlglob.c:273:24: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  273 |     pat->c.ascii.max = max_c;
tests/libtest/cli_h2_pausing.c:164:23: warning: suspicious usage of 'sizeof()' on an expression of pointer type [bugprone-sizeof-expression]
  164 |   memset(&resolve, 0, sizeof(resolve));
tests/libtest/cli_upload_pausing.c:158:23: warning: suspicious usage of 'sizeof()' on an expression of pointer type [bugprone-sizeof-expression]
  158 |   memset(&resolve, 0, sizeof(resolve));
tests/libtest/first.c:86:15: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
   86 |     coptopt = arg[optpos];
```

Also:
- tests/server/mqttd: drop a redundant and a wrongly signed cast.

Ref: https://clang.llvm.org/extra/clang-tidy/checks/bugprone/signed-char-misuse.html

Closes #20654
2026-02-25 14:44:56 +01:00
Viktor Szakats
65262be0ab
clang-tidy: enable readability-math-missing-parentheses, adjust code
No functional changes.

Also:
- md4, md5: drop redundant parentheses from macro values.

Closes #20691
2026-02-23 18:57:40 +01:00
Viktor Szakats
139307865a
clang-tidy: check bugprone-macro-parentheses, fix fallouts
Also:
- lib/parsedate: avoid relying on side-effect of missing parentheses.
- lib/http: drop redundant parentheses.
- fix cases in headers missed by clang-tidy.

Ref: https://clang.llvm.org/extra/clang-tidy/checks/bugprone/macro-parentheses.html

Closes #20647
2026-02-22 00:58:04 +01:00
Viktor Szakats
947775a613
libtests: drop two redundant memset()s
Reported by clang-tidy `bugprone-sizeof-expression`.

Silencing:
```
tests/libtest/cli_h2_pausing.c:164:23: warning: suspicious usage of 'sizeof()' on an expression of pointer type [bugprone-sizeof-expression]
  164 |   memset(&resolve, 0, sizeof(resolve));
      |                       ^
tests/libtest/cli_upload_pausing.c:158:23: warning: suspicious usage of 'sizeof()' on an expression of pointer type [bugprone-sizeof-expression]
  158 |   memset(&resolve, 0, sizeof(resolve));
      |                       ^
```

Ref: https://clang.llvm.org/extra/clang-tidy/checks/bugprone/sizeof-expression.html

Closes #20649
2026-02-20 17:15:49 +01:00
Viktor Szakats
eabd452d27
tests: avoid assignment in if conditions in first.h
Found by clang-tidy `bugprone-assignment-in-if-condition`.

Ref: https://clang.llvm.org/extra/clang-tidy/checks/bugprone/assignment-in-if-condition.html

Closes #20646
2026-02-20 17:09:20 +01:00
Viktor Szakats
8712fac111
clang-tidy: drop redundant casts
Found via `readability-redundant-casting`. Prone to false positives, not
enabled.

Ref: https://clang.llvm.org/extra/clang-tidy/checks/readability/redundant-casting.html

Closes #20630
2026-02-19 15:27:17 +01:00
Viktor Szakats
c878160e9c
clang-tidy: sync argument names in prototype and definition
Discovered with clang-tidy checker
`readability-inconsistent-declaration-parameter-name`.

Also:
- do not enforce the above because of inconsistencies still present
  between public API prototypes and definitions. (Also betwen man page
  protos, and man page examples, and other parts of the code, e.g.
  `easy` vs `curl` vs `d` vs `handle`) Perhaps subject for a future
  effort:
  https://github.com/curl/curl/actions/runs/22166472728/job/64094691653
- enable and fix `readability-named-parameter` where missing.

Refs:
https://clang.llvm.org/extra/clang-tidy/checks/readability/inconsistent-declaration-parameter-name.html
https://clang.llvm.org/extra/clang-tidy/checks/readability/named-parameter.html

Closes #20624
2026-02-19 12:44:37 +01:00
Viktor Szakats
61df5f466c
tidy-up: miscellaneous
- curl_ntlm_core, smtp, schannel: fix comments.
- curl_setup.h: fix to undef before define.
- tool_doswin, server/sockfilt: reduce variables scopes.
- tool_doswin: drop an interim variable.
- windows: replace `SOCKET_ERROR` with `0` to align with rest of code.
- libssh2: rename variable to align with rest of code.
- gtls, unit1398: use `#if 0`.
- curl_trc.h, curlx/inet_ntop.h: add missing parentheses in macro
  expressions.
- ldap.c: set empty macro to `do {} while(0)`.
- examples/crawler: rename a non-CURLcode `result` variable.
- CURLINFO_TLS_SESSION: drop stray colon.
- add `const` to casts where missing.
- drop unnecessary parentheses.
- fix indent.
- quote style.
- comment style.
- whitespace, newlines, fold/unfold.

Closes #20554
2026-02-12 14:52:16 +01:00
Viktor Szakats
85a895c59f
cli_hx_download: add Schannel support
Fixes:
```
$ wine libtests.exe cli_hx_download https://curl.se/
[...]
Assertion failed: t->checked_ssl, file .../curl/tests/libtest/cli_hx_download.c, line 563
```

into:
```
[t-0] info Schannel TLS version 0x00000800
```

Refs:
https://learn.microsoft.com/windows/win32/secauthn/querycontextattributes--general
https://learn.microsoft.com/windows/win32/api/schannel/ns-schannel-secpkgcontext_connectioninfo

Ref: c220674ac4 #20564
Follow-up to ba9ddb9357 #18066

Closes #20556
2026-02-11 18:00:55 +01:00
Viktor Szakats
cdfc8dc7ad
build: tidy up and simplify setmode() detection and use
- move macro to `curl_setup.h` (from curlx), and rename.
  It's required by src, test servers, libtests. Also used by unit/tunit,
  (which is fixable but this patch doesn't touch it.)
- special-case it for Windows/Cygwin/MS-DOS.
- build: drop `setmode()`/`_setmode()` detection.
  This also avoids detecting the different `setmode()` on BSDs,
  and a lot of complexity and overhead.
- use `CURL_O_BINARY`.

Follow-up to 250d613763 #15787
Follow-up to 5e70566094 #15169

Closes #20539
2026-02-08 15:47:47 +01:00
Viktor Szakats
85de995208
tidy-up: move literals to right-side of if expressions (where missing)
Closes #20535
2026-02-07 16:41:51 +01:00
Viktor Szakats
0495425c69
lib518, 537: drop #error on unlikely/impossible build condition
`FD_SETSIZE` is used in core code and expected to be present.

Closes #20530
2026-02-05 23:46:49 +01:00
Viktor Szakats
443a539fcf
build: move curl stat struct type to the curlx namespace
To match surrounding curlx symbols and functions.

Follow-up to a84b041281 #20496

Closes #20508
2026-02-04 02:07:16 +01:00
Viktor Szakats
31a4f415af
build: tidy up and dedupe strdup functions
- de-dupe lib/src strdup/memdup functions into curlx.
- introduce `CURLX_STRDUP_LOW()` for mapping `strdup()`, and to do it at
  one place within the code, in `curl_setup.h`.
- tests/server: use `curlx_strdup()`. (Also to fix building without
  a system `strdup()`.)
- curlx/curlx.h: shorten and tidy up.
- adjust Windows build path to not need `HAVE_STRDUP`.
- build: stop detecting `HAVE_STRDUP` on Windows.

Closes #20497
2026-02-03 14:02:30 +01:00
Viktor Szakats
a84b041281
build: tidy up curl-specific fstat calls and stat struct type
To avoid redefining the `fstat` system symbol, and to clarify
`struct_stat` is a curl symbol.

- introduce `curlx_fstat()` macro and use it.
- rename `struct_stat` to `curl_struct_stat`.

Also:
- tests: replace direct `curlx_win32_stat()` call with `curlx_stat()`.
- checksrc: disallow direct `_fstati64` and `fstat()` calls, except in
  examples.

Closes #20496
2026-02-02 18:57:13 +01:00
Viktor Szakats
9630593650
build: use more const
Mostly with `char *` types.

Also:
- mime, x509asn1, tool_operate, lib3207: drop redundant casts.
- examples/smooth-gtk-thread: add missing variable declaration.
- reduce variable scopes.
- tests/server: move `data_to_hex()` to its only user: `sws`.

Closes #20489
2026-02-02 12:32:49 +01:00
Viktor Szakats
3003c32cb2
tidy-up: miscellaneous
- INSTALL-CMAKE.md: add missing periods, text fixes.
- md4, md5: sync variables names.
- curl_trc: sync an argument type.
- docs/examples: sync debug/trace function copies, constify, tidy-ups.
- replace commented code with `#if 0`.
- drop redundant parenthesis (macro values, `return`, around single
  variables, function calls).
- fix indentation, apply clang-format in places.

Closes #20481
2026-02-01 00:54:23 +01:00