Merge tag 'curl-7_64_0'

curl 7.64.0

14 files changed, 108 insertions, 43 deletions

diff --git a/src/Makefile.am b/src/Makefile.am
index ae169f990..46a075249 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -5,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
+# Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@@ -69,10 +69,6 @@ endif
 gnurl_LDFLAGS = @LIBMETALINK_LDFLAGS@
 gnurl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBMETALINK_CPPFLAGS)
 
-@CODE_COVERAGE_RULES@
-gnurl_LDFLAGS += $(CODE_COVERAGE_LDFLAGS)
-CFLAGS += $(CODE_COVERAGE_CFLAGS)
-
 # if unit tests are enabled, build a static library to link them with
 if BUILD_UNITTESTS
 noinst_LTLIBRARIES = libcurltool.la
@@ -147,4 +143,4 @@ TIDYFLAGS=-checks=-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-op
 TIDY:=clang-tidy
 
 tidy:
-	$(TIDY) $(CURL_CFILES) $(TIDYFLAGS) -- $(AM_CPPFLAGS) $(CPPFLAGS) -DHAVE_CONFIG_H
+	$(TIDY) $(CURL_CFILES) $(TIDYFLAGS) -- $(curl_CPPFLAGS) $(CPPFLAGS) -DHAVE_CONFIG_H
diff --git a/src/tool_cb_hdr.c b/src/tool_cb_hdr.c
index 84b0d9c87..3844904c9 100644
--- a/src/tool_cb_hdr.c
+++ b/src/tool_cb_hdr.c
@@ -157,12 +157,12 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
         outs->filename = filename;
         outs->alloc_filename = TRUE;
         hdrcbdata->honor_cd_filename = FALSE; /* done now! */
-        if(!tool_create_output_file(outs, TRUE))
+        if(!tool_create_output_file(outs))
           return failure;
       }
       break;
     }
-    if(!outs->stream && !tool_create_output_file(outs, FALSE))
+    if(!outs->stream && !tool_create_output_file(outs))
       return failure;
   }
 
@@ -172,7 +172,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
     /* bold headers only for selected protocols */
     char *value = NULL;
 
-    if(!outs->stream && !tool_create_output_file(outs, FALSE))
+    if(!outs->stream && !tool_create_output_file(outs))
       return failure;
 
     if(hdrcbdata->global->isatty && hdrcbdata->global->styled_output)
diff --git a/src/tool_cb_prg.c b/src/tool_cb_prg.c
index 15ff5b2fa..0539e9895 100644
--- a/src/tool_cb_prg.c
+++ b/src/tool_cb_prg.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -106,6 +106,13 @@ static void fly(struct ProgressData *bar, bool moved)
 
 #define MAX_BARLENGTH 256
 
+#if (SIZEOF_CURL_OFF_T == 4)
+#  define CURL_OFF_T_MAX CURL_OFF_T_C(0x7FFFFFFF)
+#else
+   /* assume CURL_SIZEOF_CURL_OFF_T == 8 */
+#  define CURL_OFF_T_MAX CURL_OFF_T_C(0x7FFFFFFFFFFFFFFF)
+#endif
+
 int tool_progress_cb(void *clientp,
                      curl_off_t dltotal, curl_off_t dlnow,
                      curl_off_t ultotal, curl_off_t ulnow)
@@ -119,10 +126,16 @@ int tool_progress_cb(void *clientp,
   curl_off_t point;
 
   /* expected transfer size */
-  total = dltotal + ultotal + bar->initial_size;
+  if((CURL_OFF_T_MAX - bar->initial_size) < (dltotal + ultotal))
+    total = CURL_OFF_T_MAX;
+  else
+    total = dltotal + ultotal + bar->initial_size;
 
   /* we've come this far */
-  point = dlnow + ulnow + bar->initial_size;
+  if((CURL_OFF_T_MAX - bar->initial_size) < (dlnow + ulnow))
+    point = CURL_OFF_T_MAX;
+  else
+    point = dlnow + ulnow + bar->initial_size;
 
   if(bar->calls) {
     /* after first call... */
diff --git a/src/tool_cb_wrt.c b/src/tool_cb_wrt.c
index 2cb5e1b41..195d6e79c 100644
--- a/src/tool_cb_wrt.c
+++ b/src/tool_cb_wrt.c
@@ -32,8 +32,7 @@
 #include "memdebug.h" /* keep this as LAST include */
 
 /* create a local file for writing, return TRUE on success */
-bool tool_create_output_file(struct OutStruct *outs,
-                             bool append)
+bool tool_create_output_file(struct OutStruct *outs)
 {
   struct GlobalConfig *global = outs->config->global;
   FILE *file;
@@ -43,7 +42,7 @@ bool tool_create_output_file(struct OutStruct *outs,
     return FALSE;
   }
 
-  if(outs->is_cd_filename && !append) {
+  if(outs->is_cd_filename) {
     /* don't overwrite existing files */
     file = fopen(outs->filename, "rb");
     if(file) {
@@ -55,7 +54,7 @@ bool tool_create_output_file(struct OutStruct *outs,
   }
 
   /* open file for writing */
-  file = fopen(outs->filename, append?"ab":"wb");
+  file = fopen(outs->filename, "wb");
   if(!file) {
     warnf(global, "Failed to create the file %s: %s\n", outs->filename,
           strerror(errno));
@@ -142,7 +141,7 @@ size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
   }
 #endif
 
-  if(!outs->stream && !tool_create_output_file(outs, FALSE))
+  if(!outs->stream && !tool_create_output_file(outs))
     return failure;
 
   if(is_tty && (outs->bytes < 2000) && !config->terminal_binary_ok) {
diff --git a/src/tool_cb_wrt.h b/src/tool_cb_wrt.h
index 51e002bea..188d3ea7d 100644
--- a/src/tool_cb_wrt.h
+++ b/src/tool_cb_wrt.h
@@ -30,6 +30,6 @@
 size_t tool_write_cb(char *buffer, size_t sz, size_t nmemb, void *userdata);
 
 /* create a local file for writing, return TRUE on success */
-bool tool_create_output_file(struct OutStruct *outs, bool append);
+bool tool_create_output_file(struct OutStruct *outs);
 
 #endif /* HEADER_CURL_TOOL_CB_WRT_H */
diff --git a/src/tool_cfgable.c b/src/tool_cfgable.c
index 7d088ae0f..0eb941ef6 100644
--- a/src/tool_cfgable.c
+++ b/src/tool_cfgable.c
@@ -43,6 +43,7 @@ void config_init(struct OperationConfig* config)
   config->proto_default = NULL;
   config->tcp_nodelay = TRUE; /* enabled by default */
   config->happy_eyeballs_timeout_ms = CURL_HET_DEFAULT;
+  config->http09_allowed = TRUE;
 }
 
 static void free_config_fields(struct OperationConfig *config)
diff --git a/src/tool_cfgable.h b/src/tool_cfgable.h
index 501c96189..81680dbbb 100644
--- a/src/tool_cfgable.h
+++ b/src/tool_cfgable.h
@@ -146,6 +146,7 @@ struct OperationConfig {
   char *krblevel;
   char *request_target;
   long httpversion;
+  bool http09_allowed;
   bool nobuffer;
   bool readbusy;            /* set when reading input returns EAGAIN */
   bool globoff;
diff --git a/src/tool_doswin.c b/src/tool_doswin.c
index f360b92e6..8b5bdadaf 100644
--- a/src/tool_doswin.c
+++ b/src/tool_doswin.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -646,9 +646,9 @@ CURLcode FindWin32CACert(struct OperationConfig *config,
 
   /* Search and set cert file only if libcurl supports SSL.
    *
-   * If Schannel (WinSSL) is the selected SSL backend then these locations
-   * are ignored. We allow setting CA location for schannel only when
-   * explicitly specified by the user via CURLOPT_CAINFO / --cacert.
+   * If Schannel is the selected SSL backend then these locations are
+   * ignored. We allow setting CA location for schannel only when explicitly
+   * specified by the user via CURLOPT_CAINFO / --cacert.
    */
   if((curlinfo->features & CURL_VERSION_SSL) &&
      backend != CURLSSLBACKEND_SCHANNEL) {
diff --git a/src/tool_getparam.c b/src/tool_getparam.c
index c0d3a84f2..c7ba5f243 100644
--- a/src/tool_getparam.c
+++ b/src/tool_getparam.c
@@ -199,6 +199,7 @@ static const struct LongShort aliases[]= {
   {"01",  "http1.1",                 ARG_NONE},
   {"02",  "http2",                   ARG_NONE},
   {"03",  "http2-prior-knowledge",   ARG_NONE},
+  {"09",  "http0.9",                 ARG_BOOL},
   {"1",  "tlsv1",                    ARG_NONE},
   {"10",  "tlsv1.0",                 ARG_NONE},
   {"11",  "tlsv1.1",                 ARG_NONE},
@@ -1183,6 +1184,10 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
         /* HTTP version 2.0 over clean TCP*/
         config->httpversion = CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE;
         break;
+      case '9':
+        /* Allow HTTP/0.9 responses! */
+        config->http09_allowed = toggle;
+        break;
       }
       break;
     case '1': /* --tlsv1* options */
diff --git a/src/tool_help.c b/src/tool_help.c
index d2deed3cf..aeffd3dea 100644
--- a/src/tool_help.c
+++ b/src/tool_help.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -176,6 +176,8 @@ static const struct helptxt helptext[] = {
    "This help text"},
   {"    --hostpubmd5 <md5>",
    "Acceptable MD5 hash of the host public key"},
+  {"    --http0.9",
+   "Allow HTTP 0.9 responses"},
   {"-0, --http1.0",
    "Use HTTP 1.0"},
   {"    --http1.1",
@@ -411,7 +413,7 @@ static const struct helptxt helptext[] = {
   {"    --ssl-allow-beast",
    "Allow security flaw to improve interop"},
   {"    --ssl-no-revoke",
-   "Disable cert revocation checks (WinSSL)"},
+   "Disable cert revocation checks (Schannel)"},
   {"    --ssl-reqd",
    "Require SSL/TLS"},
   {"-2, --sslv2",
@@ -437,7 +439,7 @@ static const struct helptxt helptext[] = {
   {"-z, --time-cond <time>",
    "Transfer based on a time condition"},
   {"    --tls-max <VERSION>",
-   "Use TLSv1.0 or greater"},
+   "Set maximum allowed TLS version"},
   {"    --tls13-ciphers <list of TLS 1.3 ciphersuites>",
    "TLS 1.3 cipher suites to use"},
   {"    --tlsauthtype <type>",
diff --git a/src/tool_operate.c b/src/tool_operate.c
index e53a9d867..4516c8e6a 100644
--- a/src/tool_operate.c
+++ b/src/tool_operate.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -258,9 +258,9 @@ static CURLcode operate_do(struct GlobalConfig *global,
      * no environment-specified filename is found then check for CA bundle
      * default filename curl-ca-bundle.crt in the user's PATH.
      *
-     * If Schannel (WinSSL) is the selected SSL backend then these locations
-     * are ignored. We allow setting CA location for schannel only when
-     * explicitly specified by the user via CURLOPT_CAINFO / --cacert.
+     * If Schannel is the selected SSL backend then these locations are
+     * ignored. We allow setting CA location for schannel only when explicitly
+     * specified by the user via CURLOPT_CAINFO / --cacert.
      */
     if(tls_backend_info->backend != CURLSSLBACKEND_SCHANNEL) {
       char *env;
@@ -1005,6 +1005,8 @@ static CURLcode operate_do(struct GlobalConfig *global,
           /* new in libcurl 7.21.6 */
           if(config->tr_encoding)
             my_setopt(curl, CURLOPT_TRANSFER_ENCODING, 1L);
+          /* new in libcurl 7.64.0 */
+          my_setopt(curl, CURLOPT_HTTP09_ALLOWED, config->http09_allowed);
 
         } /* (built_in_protos & CURLPROTO_HTTP) */
 
@@ -1583,7 +1585,7 @@ static CURLcode operate_do(struct GlobalConfig *global,
             /* do not create (or even overwrite) the file in case we get no
                data because of unmet condition */
             curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &cond_unmet);
-            if(!cond_unmet && !tool_create_output_file(&outs, FALSE))
+            if(!cond_unmet && !tool_create_output_file(&outs))
               result = CURLE_WRITE_ERROR;
           }
 
diff --git a/src/tool_paramhlp.c b/src/tool_paramhlp.c
index 894d4d414..3a4286c67 100644
--- a/src/tool_paramhlp.c
+++ b/src/tool_paramhlp.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -456,9 +456,8 @@ static CURLcode checkpasswd(const char *kind, /* for what purpose */
                       kind, *userpwd);
     else
       curlx_msnprintf(prompt, sizeof(prompt),
-                      "Enter %s password for user '%s' on URL #%"
-                      CURL_FORMAT_CURL_OFF_TU ":",
-                      kind, *userpwd, (curl_off_t) (i + 1));
+                      "Enter %s password for user '%s' on URL #%zu:",
+                      kind, *userpwd, i + 1);
 
     /* get password */
     getpass_r(prompt, passwd, sizeof(passwd));
diff --git a/src/tool_util.c b/src/tool_util.c
index 1a5b773e2..9990a4634 100644
--- a/src/tool_util.c
+++ b/src/tool_util.c
@@ -47,7 +47,7 @@ struct timeval tvnow(void)
   DWORD milliseconds = GetTickCount();
 #endif
   now.tv_sec = (long)(milliseconds / 1000);
-  now.tv_usec = (milliseconds % 1000) * 1000;
+  now.tv_usec = (long)((milliseconds % 1000) * 1000);
   return now;
 }
 
diff --git a/src/tool_xattr.c b/src/tool_xattr.c
index 92b99db60..730381ba9 100644
--- a/src/tool_xattr.c
+++ b/src/tool_xattr.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -49,6 +49,46 @@ static const struct xattr_mapping {
   { NULL,                  CURLINFO_NONE } /* last element, abort loop here */
 };
 
+/* returns TRUE if a new URL is returned, that then needs to be freed */
+/* @unittest: 1621 */
+#ifdef UNITTESTS
+bool stripcredentials(char **url);
+#else
+static
+#endif
+bool stripcredentials(char **url)
+{
+  CURLU *u;
+  CURLUcode uc;
+  char *nurl;
+  u = curl_url();
+  if(u) {
+    uc = curl_url_set(u, CURLUPART_URL, *url, 0);
+    if(uc)
+      goto error;
+
+    uc = curl_url_set(u, CURLUPART_USER, NULL, 0);
+    if(uc)
+      goto error;
+
+    uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);
+    if(uc)
+      goto error;
+
+    uc = curl_url_get(u, CURLUPART_URL, &nurl, 0);
+    if(uc)
+      goto error;
+
+    curl_url_cleanup(u);
+
+    *url = nurl;
+    return TRUE;
+  }
+  error:
+  curl_url_cleanup(u);
+  return FALSE;
+}
+
 /* store metadata from the curl request alongside the downloaded
  * file using extended attributes
  */
@@ -62,17 +102,24 @@ int fwrite_xattr(CURL *curl, int fd)
     char *value = NULL;
     CURLcode result = curl_easy_getinfo(curl, mappings[i].info, &value);
     if(!result && value) {
+      bool freeptr = FALSE;
+      if(CURLINFO_EFFECTIVE_URL == mappings[i].info)
+        freeptr = stripcredentials(&value);
+      if(value) {
 #ifdef HAVE_FSETXATTR_6
-      err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0, 0);
+        err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0, 0);
 #elif defined(HAVE_FSETXATTR_5)
-      err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0);
+        err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0);
 #elif defined(__FreeBSD_version)
-      err = extattr_set_fd(fd, EXTATTR_NAMESPACE_USER, mappings[i].attr, value,
-                           strlen(value));
-      /* FreeBSD's extattr_set_fd returns the length of the extended attribute
-       */
-      err = err < 0 ? err : 0;
+        err = extattr_set_fd(fd, EXTATTR_NAMESPACE_USER, mappings[i].attr,
+                             value, strlen(value));
+        /* FreeBSD's extattr_set_fd returns the length of the extended
+           attribute */
+        err = err < 0 ? err : 0;
 #endif
+        if(freeptr)
+          curl_free(value);
+      }
     }
     i++;
   }