Commit Graph

37929 Commits

Author SHA1 Message Date
Daniel Stenberg
a67ee591e0
RELEASE-NOTES: synced 2026-02-27 09:37:29 +01:00
Daniel Stenberg
61bcd1105a
cfilter: move a debug-only check into ifdef DEBUGBUILD
Pointed out by CodeSonar

Closes #20756
2026-02-27 08:21:15 +01:00
Daniel Stenberg
b48d02179a
ftp: remove two redundant assignments
Follow-up to 29bca12978

Pointed out by CodeSonar

Closes #20755
2026-02-27 08:10:11 +01:00
Viktor Szakats
b2076d3c2f
vquic: fix unused variable warning reported by clang-tidy
Silencing (seen in new GHA/Linux H3 v20 job):
```
lib/vquic/vquic.c:398:37: error: variable 'calls' set but not used [clang-diagnostic-unused-but-set-variable]
  398 |   size_t total_nread = 0, pkts = 0, calls = 0;
      |                                     ^
```

Cherry-picked from #20751

Closes #20752
2026-02-27 02:40:31 +01:00
Viktor Szakats
f76a54f890
clang-tidy: add missing and delete redundant parentheses
Reported by clang-tidy v22.1.0.

Ref: https://releases.llvm.org/22.1.0/tools/clang/tools/extra/docs/ReleaseNotes.html

Closes #20749
2026-02-27 01:03:41 +01:00
Daniel Stenberg
8d28ac612b
mailmap: Hamza Bensliman 2026-02-26 20:07:23 +01:00
Viktor Szakats
fb58b23256
cmake: fix confusing error when a dependency is undetected in curl-config.cmake
Fixing:
```
CMake Error at /path/to/CURL/CURLConfig.cmake:190 (get_target_property):
  get_target_property() called with non-existent target "CURL::libssh2".
```
and replacing it with the clearer message:
```
CMake Error at /path/to/CURL/CURLTargets.cmake:61 (set_target_properties):
  The link interface of target "CURL::libcurl_static" contains:

    CURL::libssh2

  but the target was not found.  Possible reasons include:
[...]
```

Reported-by: Val S.
Ref: #20729
Follow-up to 16f073ef49 #16973

Closes #20737
2026-02-26 19:44:28 +01:00
Viktor Szakats
c111275366
GHA/linux: delete unused autotools clang-tidy logic
Follow-up to 26eddf002f #20725

Closes #20747
2026-02-26 19:44:28 +01:00
Viktor Szakats
b3f1f69261
GHA/macos: bump runner to macos-26 in clang-tidy jobs
Tiny difference in practice:
Apple clang 17.0.0.17000013 -> 17.0.0.17000603

To use the most recent tools for static analyses.

Closes #20745
2026-02-26 19:24:32 +01:00
Viktor Szakats
ad72af4743
GHA/linux: enable clang-tidy for docs/examples
Also:
- imap-append: silence false positive (seen on Linux only).
  Follow-up to b1f853a384 #20731
  Follow-up to 725c5609ae #20723

Closes #20743
2026-02-26 19:24:32 +01:00
Viktor Szakats
9871f46069
GHA/macos: drop unused install_step values [ci skip] 2026-02-26 19:12:14 +01:00
hamza
05d991a8c5
rtsp: fix assertion failure on zero-length RTP payload
Fixes #20735
Reported-by: David Korczynski
Closes #20744
2026-02-26 18:35:10 +01:00
renovate[bot]
e86642909f
GHA: update ngtcp2/ngtcp2 to v1.21.0
Closes #20738
2026-02-26 17:15:22 +01:00
Daniel Stenberg
6789eb0ff9
multi: avoid a theoretical 32-bit wrap
If Curl_uint32_tbl_count() at some future point actually can return
UINT_MAX, this fixes the math to not wrap.

Closes #20742
2026-02-26 17:14:50 +01:00
Viktor Szakats
9b52d516bb
GHA/linux: bump sanitizer jobs to clang v20 (from v18)
To use the newest version offered by the runner's Ubuntu 24.04.

Ref: https://packages.ubuntu.com/search?suite=noble-updates&keywords=clang

Closes #20732
2026-02-26 17:13:16 +01:00
Viktor Szakats
dc4aef7352
GHA/macos: update comment about macOS targets vs. features
Closes #20741
2026-02-26 16:07:00 +01:00
Viktor Szakats
4a43eba3b1
cmake: silence potential unused var warnings in C++ test snippet
Follow-up to 6ad50dc285 #20687

Closes #20736
2026-02-26 13:39:43 +01:00
Daniel Stenberg
3cf86508fd
VULN-DISCLOSURE-POLICY.md: use hackerone
- bug_report.yml: use hackerone

Closes #20683
2026-02-26 07:57:19 +01:00
Viktor Szakats
26eddf002f
GHA/linux: switch clang-tidy job to cmake for 2x speed, bump to v20, enable for tests
Checking lib and src under 3m15s versus 7m15s.

Downside: autotools clang-tidy support is no longer CI-tested.

The reason for the slowness is invoking a single clang-tidy command with
all source files, and clang-tidy checking them in a single thread,
sequentially. clang-tidy offers a `run-clang-tidy` Python script for
parallel  processing, which may help with this. However at this point
it's more practical to use cmake, which also supports verifying the
whole codebase, not only lib and src.

Also:
- bump clang-tidy to the latest available, v20 (from v18).
- enable running clang-tidy on tests. Takes under 2 minutes.

Also tried `_CURL_TESTS_CONCAT=ON`, it brings down the build tests step
from 1m47s to 54s, saving 1 minute. Skipped using it for now.

Closes #20725
2026-02-26 05:08:30 +01:00
Viktor Szakats
137e87ca72
clang-tidy: enable scanning headers
By setting `HeaderFilterRegex: '.*'`.

Closes #20720
2026-02-26 05:08:30 +01:00
Viktor Szakats
b1f853a384
unit3205: suppress two clang-tidy false positives
Silencing:
```
tests/unit/unit3205.c:565:32: error: the result from calling 'memcpy' is not null-terminated [bugprone-not-null-terminated-result]
  565 |         expect = (const char *)memcpy(alt, "DHE-", 4);
      |                                ^~~~~~            ~~~
      |                                strcpy
tests/unit/unit3205.c:569:32: error: the result from calling 'memcpy' is not null-terminated [bugprone-not-null-terminated-result]
  569 |         expect = (const char *)memcpy(alt + 4, "DHE-", 4) - 4;
      |                                ^~~~~~                ~~~
      |                                strcpy
```
Ref: https://github.com/curl/curl/actions/runs/22425366818/job/64932197466?pr=20725

Cherry-picked from #20725

Closes #20731
2026-02-26 04:19:18 +01:00
Viktor Szakats
d38bf7949d
tests/server: fix to clear the complete srvr_sockaddr_union_t variable
Reported by clang-tidy (seen on Linux with v18, v19, v20, not on macOS):
```
tests/server/dnsd.c:552:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/dnsd.c:556:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/rtspd.c:1183:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/rtspd.c:1187:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/sws.c:2235:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/sws.c:2239:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/tftpd.c:1188:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/tftpd.c:1192:14: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/util.c:860:21: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
tests/server/util.c:864:21: error: 1st function call argument is an uninitialized value [clang-analyzer-core.CallAndMessage]
```
Ref: https://github.com/curl/curl/actions/runs/22424827575/job/64930560425?pr=20725

Cherry-picked from #20725

Closes #20730
2026-02-26 04:19:18 +01:00
Viktor Szakats
d110504e84
build: add missing GENERATEDCERTS files
Also alpha sort lists, while here.

Follow-up to 2cf19c245e #17493

Closes #20728
2026-02-26 03:09:16 +01:00
Viktor Szakats
2239879b74
cmake: minor fixes to test targets after prev
- run tests-clang-tidy when building testbins.
- drop redundant build-certs dependency for test targets.
  Already present via testdeps.

Follow-up to aae361242f #20708

Closes #20727
2026-02-26 02:44:39 +01:00
Viktor Szakats
b56e103d4d
build: do not include wolfSSL header in curl_setup.h
To fix building tests/server with cmake and both wolfSSL and OpenSSL
enabled (MultiSSL).

tests/server do not have libcurl dependency header paths setup because
it does not use libcurl. The code however includes `curl_setup.h`, which
tried including `wolfssl/version.h` before this patch to verify if the
wolfSSL coexist feature is available. Without a header path, it failed:
```
In file included from bld/tests/server/servers.c:3:
In file included from tests/server/first.h:40:
lib/curl_setup.h:737:12: fatal error: 'wolfssl/version.h' file not found
  737 | #  include <wolfssl/version.h>
      |            ^~~~~~~~~~~~~~~~~~~
1 error generated.
```
Ref: https://github.com/curl/curl/actions/runs/22410066319/job/64880787424#step:46:76

Fix by moving the include and version check to `vtls/wolfssl.c`.

Also: add an early version check to cmake.

Follow-up to 16f073ef49 #16973
Cherry-picked from #20720

Closes #20726
2026-02-26 01:36:16 +01:00
Viktor Szakats
aae361242f
cmake: replace internal option with a new testbins target
To allow building test binaries without test certs, replacing
`_CURL_SKIP_BUILD_CERTS` internal option with a build target that is
similar to `testdeps`, but without building the test certificates.

To make building test binaries a little bit faster, with less noisy
output, and without having to reconfigure the build.

Closes #20708
2026-02-25 22:57:02 +01:00
Viktor Szakats
3137f725cd
cmake: fix passing system header directories to clang-tidy for tests
Pass system directories with `-isystem` to avoid clang-tidy parsing
3rd-party and system headers with `HeaderFilterRegex: '.*' enabled.

Also:
- drop rule exception no longer necessary.
- sync normal vs. system header path order with compiler invocation.
- tidy up `set()` syntax.
- clear a temporary variable.

Bug: https://github.com/curl/curl/pull/20670#issuecomment-3940840176
Follow-up to e088e10454 #17705
Cherry-picked from: #20720

Closes #20724
2026-02-25 22:29:26 +01:00
Viktor Szakats
725c5609ae
clang-tidy: avoid/silence bugprone-not-null-terminated-result
Prefer `sizeof()` over `strlen()`, static const variables over macros.
Add a couple of `NOLINT`s to silence false positives.

Also sync similar code patterns between libtests.

Cherry-picked from #20720

Closes #20723
2026-02-25 22:11:05 +01:00
Viktor Szakats
39542f0993
cmake: add native clang-tidy support for tests, with concatenated sources
Tests are build in "unity"-style, by including sources into an umbrella
C files (similar to how CMake unity works). This does not play well with
clang-tidy, which seems to unconditionally ignore C sources included
like this. To fix it, curl's CMake implements a manual clang-tidy
support for tests, which  compiles sources one-by-one, while also making
sure sources compile cleanly standalone (e.g. all sources need to
include `first.h`). The manual clang-tidy implementation is fragile, and
performance, in particular when targeting Windows, is abysmal.

This patch introduces an alternate solution, enabled by the
`_CURL_TESTS_CONCAT=ON` option. In this mode, umbrella sources include
the actual sources instead of `#including` them. Allowing to use CMake's
built-in clang-tidy support to compile them, with clang-tidy actually
checking the sources. Making the manual clang-tidy support unnecessary.
In the Windows CI job it results in a 4x performance improvement (4m ->
1m), making it practical to run clang-tidy on tests on Windows, in CI.

The main downside is that clang-tidy doesn't understand the `#line`
directive. Meaning issues found show the wrong filename and line number
next to them. It's not impossible to locate errors this way, but also
not convenient.

Minor/potential downside is that the concatenated source needs to be
reassembled each time an original source is updated. This may result in
more copying on the disk when used in local development. The largest
source is 1.4MB, so probably not a show-stopper on most machines.

Another is the complexity of maintaining two methods in parallel, which
may be necessary till clang-tidy understands `#line`:
https://github.com/llvm/llvm-project/issues/62405

This solution may in theory also enable adding clang-tidy support for
tests in autotools, though I haven't tried.

Targeted for curl CI for now, and used in a GHA/windows job. 100%
experimental, not recommended outside these.

Closes #20667
2026-02-25 17:28:35 +01:00
Viktor Szakats
3b9d8412c0
clang-tidy: add more missing parentheses in macro values
Reported when running `HeaderFilterRegex: '.*'` in CI.

Also replace an underscored symbol with a regular one in macro
definition.

Cherry-picked from #20720

Closes #20721
2026-02-25 15:43:23 +01:00
Viktor Szakats
65f9426170
clang-tidy: enable more checks
Refs:
https://clang.llvm.org/extra/clang-tidy/checks/list.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/assert-side-effect.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/chained-comparison.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/dynamic-static-initializers.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/macro-repeated-side-effects.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/misplaced-operator-in-strlen-in-alloc.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/misplaced-pointer-arithmetic-in-alloc.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/not-null-terminated-result.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/posix-return.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/suspicious-enum-usage.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/suspicious-memset-usage.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/suspicious-missing-comma.html
https://clang.llvm.org/extra/clang-tidy/checks/bugprone/suspicious-semicolon.html
https://clang.llvm.org/extra/clang-tidy/checks/readability/redundant-declaration.html
https://clang.llvm.org/extra/clang-tidy/checks/readability/redundant-function-ptr-dereference.html
https://clang.llvm.org/extra/clang-tidy/checks/readability/redundant-parentheses.html

Closes #20622
2026-02-25 15:26:07 +01:00
Viktor Szakats
af78b199b2
tidy-up: miscellaneous
- vms/curlmsg_vms.h: delete unused/commented code.
- vtls/schannel_verify: sort includes.
- typecheck-gcc.h: fix indent and alignment.
- lib/config-win32.h: drop idle `#undef`.
- spacecheck: check for stray empty lines before after curly braces.
- make literals more readable: 1048576 -> 1024 * 1024
- scope variables.
- use ISO date in a comment.
- drop redundant parentheses.
- drop empty comments.
- unfold lines.
- duplicate/stray spaces in comments.
- fix indent, whitespace, minor typos.

Closes #20690
2026-02-25 14:44:56 +01:00
Viktor Szakats
ac46392f44
clang-tidy: enable bugprone-signed-char-misuse, fix fallouts
Examples:
```
lib/vtls/openssl.c:2585:18: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
 2585 |       msg_type = *(const char *)buf;
lib/vtls/openssl.c:2593:18: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
 2593 |       msg_type = *(const char *)buf;
tests/server/mqttd.c:514:10: warning: comparison between 'signed char' and 'unsigned char' [bugprone-signed-char-misuse]
  514 |       if(passwd_flag == (char)(conn_flags & passwd_flag)) {
tests/server/tftpd.c:362:13: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  362 |         c = test->rptr[0];
tests/server/tftpd.c:454:9: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  454 |     c = *p++;                     /* pick up a character */
src/tool_urlglob.c:272:46: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  272 |     pat->c.ascii.letter = pat->c.ascii.min = min_c;
src/tool_urlglob.c:273:24: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
  273 |     pat->c.ascii.max = max_c;
tests/libtest/cli_h2_pausing.c:164:23: warning: suspicious usage of 'sizeof()' on an expression of pointer type [bugprone-sizeof-expression]
  164 |   memset(&resolve, 0, sizeof(resolve));
tests/libtest/cli_upload_pausing.c:158:23: warning: suspicious usage of 'sizeof()' on an expression of pointer type [bugprone-sizeof-expression]
  158 |   memset(&resolve, 0, sizeof(resolve));
tests/libtest/first.c:86:15: warning: 'signed char' to 'int' conversion; consider casting to 'unsigned char' first. [bugprone-signed-char-misuse]
   86 |     coptopt = arg[optpos];
```

Also:
- tests/server/mqttd: drop a redundant and a wrongly signed cast.

Ref: https://clang.llvm.org/extra/clang-tidy/checks/bugprone/signed-char-misuse.html

Closes #20654
2026-02-25 14:44:56 +01:00
Daniel Stenberg
86772a76c7
RELEASE-NOTES: synced 2026-02-25 14:19:40 +01:00
Viktor Szakats
92eddc1fae
build: map Apple clang 26.4+ to llvm/clang 21.1
Ref: https://en.wikipedia.org/wiki/Xcode#Xcode_26.0_(since_version_number_change)_2

Closes #20717
2026-02-25 13:16:07 +01:00
Viktor Szakats
baf32a5cf4
build: enable -Wjump-misses-init for clang 21+
Refs:
543f112e14
43c05d9738

Follow-up to db4d617c1c #16252

Closes #20716
2026-02-25 12:28:58 +01:00
Hamza Bensliman
a4ce687af2
docs: add reproducible example for generating man page
Fixes #20699
Reported-by: sammydono on github
Closes #20703
2026-02-24 23:58:37 +01:00
Viktor Szakats
3e198f7586
build: fix building rare combinations
- http/2 + !headers
- gnutls + !verbose
- ssls-export + !verbose

Closes #20712
2026-02-24 20:49:06 +01:00
Viktor Szakats
102d4c8ba9
tidy-up: macro parentheses
Add missing and drop redundant parentheses.

Also: fix whitespace.

Ref: #20690

Closes #20710
2026-02-24 16:30:05 +01:00
Viktor Szakats
be2499f7dd
managen: silence Perl warnings
Closes #20707
2026-02-24 16:30:05 +01:00
Daniel Stenberg
c513b1d520
DEPRECATE.md: TLS SRP support gets removed in August 2026
Closes #20697
2026-02-24 16:02:34 +01:00
Daniel Stenberg
704a0a3fa9
config-riscos.h: drop all undefs
They are superfluous

Closes #20711
2026-02-24 15:54:45 +01:00
Daniel Stenberg
6ef6fb84ac
top-complexity: lower the max allowed complexity to 60
Closes #20706
2026-02-24 14:42:23 +01:00
Viktor Szakats
ba685ad5e5
openssl: fix potential NULL dereference when loading certs (Windows)
This could happen if the first cert to be loaded missed EKU (Enhanced
Key Usage) data, when using native CA on Windows.

Fix by skipping certs without Enhanced Key Usage data.

Detected by clang-tidy:
```
lib/vtls/openssl.c:2922:15: warning: Access to field 'cUsageIdentifier'
 results in a dereference of a null pointer (loaded from variable
 'enhkey_usage') [clang-analyzer-core.NullDereference]
 2922 |           if(!enhkey_usage->cUsageIdentifier) {
      |               ^
```

Refs:
https://learn.microsoft.com/windows/win32/secgloss/e-gly
https://learn.microsoft.com/windows/win32/api/wincrypt/nf-wincrypt-certgetenhancedkeyusage
https://gitlab.winehq.org/wine/wine/-/blob/wine-11.2/dlls/crypt32/cert.c?ref_type=tags#L3061-3164

Assisted-by: Stefan Eissing

Closes #20634
2026-02-24 12:34:19 +01:00
Daniel Stenberg
7981594df5
mbedtls: split mbed_connect_step1 into sub functions
Increase readability. Reduce complexity.

Closes #20689
2026-02-24 11:19:20 +01:00
Daniel Stenberg
956e1ae84f
setopt: refuse blobs with zero length
A blob must have a length or it will not be accepted. By enforcing the
check here, TLS backend code can rely on the fact that the length is
always non-zero from this point.

Reported-by: aisle-research-bot
URL: https://github.com/curl/curl/pull/20689#pullrequestreview-3846390367
Closes #20705
2026-02-24 11:18:12 +01:00
Diogo Correia
9d94b1a066
docs: use dot instead of comma at end of sentences
Some sentences incorrectly ended with a command instead of a dot.

Closes #20700
2026-02-24 08:15:39 +01:00
Viktor Szakats
67298a80b3
INSTALL-CMAKE.md: document the curl build target
Can be useful to together with `testdeps` to build all binaries.

Closes #20694
2026-02-24 01:11:17 +01:00
Viktor Szakats
453470fab1
spacecheck: double spaces in folded strings, fix fallouts
Closes #20695
2026-02-24 00:48:12 +01:00
Viktor Szakats
65262be0ab
clang-tidy: enable readability-math-missing-parentheses, adjust code
No functional changes.

Also:
- md4, md5: drop redundant parentheses from macro values.

Closes #20691
2026-02-23 18:57:40 +01:00