Examples / Report #3973135 Saved analysis

CVE-2026-86409: stale SigV4 headers sent unintended

curl · 2026-08-27922.5s analysis · $0.032 in model calls

What the report claims

Setting CURLOPT_AWS_SIGV4 to NULL returns CURLE_OK but does not disable SigV4 authentication, causing stale authorization headers to be sent on subsequent requests.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2026-86409 stale SigV4 headers sent unintended

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Code supports the claim

The code supports the reported flaw. A maintainer should review its impact and decide what to do next.

Why this finding?

The code at lib/setopt.c:2061-2072 confirms the flaw: setting CURLOPT_AWS_SIGV4 to NULL clears the parameter string but lacks an else branch to clear CURLAUTH_AWS_SIGV4 from data->set.httpauth.
The deterministic checks confirm all cited symbols and files exist at the tested commit c2676bf9e639.
The code flow from lib/transfer.c:505 (copying stale httpauth to per-request state) through lib/http_aws_sigv4.c:820 (fallback to "aws:amz" when string is empty) demonstrates a concrete path from attacker-influenced URL to unintended credential transmission.
The documented API contract (set to NULL to disable) is violated, so this is not API misuse; the application correctly follows documentation but the feature remains enabled.
The fix commit c3c70440e8 post-dates the tested commit, confirming the flaw existed in the tested revision and was later fixed.

How this analysis ran 5 claims · 9 citations verified

Checked against curl tested commit c2676bf9e639 (c2676bf9e639). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

partially grounded

no model · 30 references checked out, 1 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 2766 tokens · $0.0003

3 · Evidence

17 code snippets

real curl source at c2676bf9e639 · 2 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

25056 tokens · 15.8s · $0.0318

5 · Receipts

9 of 9 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report. The code at lib/setopt.c:2061-2072 confirms the flaw: setting CURLOPT_AWS_SIGV4 to NULL clears the parameter string but does not clear the CURLAUTH_AWS_SIGV4 bit from data->set.httpauth. The subsequent curl_easy_perform() copies this stale bit (lib/transfer.c:505) and the SigV4 code falls back to "aws:amz" with hostname-derived parameters (lib/http_aws_sigv4.c:820), sending an Authorization header with retained credentials to the new URL. This violates the documented API and constitutes a security issue. The fix in commit c3c70440e8 adds the missing else branch. We will verify the fix and consider a regression test.

Inspect all claims and source code 5 claims · 17 code excerpts

Report claims

C1flaw supported

When CURLOPT_AWS_SIGV4 is set to NULL, the code clears the parameter string but does not clear the CURLAUTH_AWS_SIGV4 bit from data->set.httpauth

Read the reasoning

The code at lines 2061-2072 shows that when ptr is NULL, Curl_setstropt clears the parameter string, but the conditional only sets CURLAUTH_AWS_SIGV4 when the string is non-empty. There is no else branch to clear the bit, so it remains set from a previous non-NULL call.

lib/setopt.c:2061 lib/setopt.c:2070

C2location supported

The flaw is in lib/setopt.c lines 2061-2072 where the case for CURLOPT_AWS_SIGV4 lacks an else branch to clear the auth bit

Read the reasoning

The cited lines 2061-2072 in lib/setopt.c contain exactly the flaw described: the case handles the non-NULL path but has no else branch to clear the authentication bit when the string is cleared.

lib/setopt.c:2061

C3trigger supported

After resetting CURLOPT_AWS_SIGV4 to NULL, a subsequent curl_easy_perform() on the same handle sends an Authorization: AWS4-HMAC-SHA256 header

Read the reasoning

On curl_easy_perform(), transfer.c:505 copies data->set.httpauth (which still has CURLAUTH_AWS_SIGV4 set) into data->state.authhost.want. The authentication machinery then selects SigV4, and parse_sigv4_params at http_aws_sigv4.c:820 uses the fallback "aws:amz" when the parameter string is empty, causing a signature to be generated with derived region/service.

lib/transfer.c:505 lib/http_aws_sigv4.c:820

C4impact supported

The retained auth bit causes unintended SigV4 signing of later requests, exposing access-key identifier and credential scope to an attacker-controlled URL

Read the reasoning

The retained auth bit causes the SigV4 code path to run on subsequent requests. Because the parameter string was cleared, parse_sigv4_params falls back to "aws:amz" and derives region/service from the new hostname, producing a valid Authorization header with the retained credentials (access-key identifier from CURLOPT_USERPWD) sent to the new destination.

lib/http_aws_sigv4.c:820 lib/setopt.c:2070

C5reproduction supported

Create a handle, set CURLOPT_AWS_SIGV4 to a provider, perform a request, then set CURLOPT_AWS_SIGV4 to NULL and perform another request; the second request still contains a SigV4 Authorization header

Read the reasoning

The reproduction steps follow the code path: set CURLOPT_AWS_SIGV4 to a provider (sets httpauth bit), perform request (sends header), set CURLOPT_AWS_SIGV4 to NULL (clears string but not bit), change URL, perform again (stale bit causes header with fallback params). The control with CURLOPT_HTTPAUTH=CURLAUTH_NONE (include/curl/curl.h:830) would clear the bit and stop the header.

lib/setopt.c:2061 lib/easy.c@curl-8_21_0:818

Deterministic checks that failed

symbol no CURLOPT_HTTPSIG, but the CURLOPT_HTTPSIG_* family exists (e.g. CURLOPT_HTTPSIG_ALGORITHM)

Read the original report (excerpt)

Full report on HackerOne ↗

## Summary Setting `CURLOPT_AWS_SIGV4` to `NULL` returns `CURLE_OK` but does not disable SigV4 authentication. The handler in `lib/setopt.c` clears the parameter string (`STRING_AWS_SIGV4`) but never removes the `CURLAUTH_AWS_SIGV4` bit from `data->set.httpauth`. A subsequent `curl_easy_perform()` on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next. This contradicts the documentation in `docs/libcurl/opts/CURLOPT_AWS_SIGV4.md`: > Using this option multiple times makes the last set string override the previous ones. Set it to NULL to disable its use again. Tested at commit `c2676bf9e639e31e44b12a2cc82cf2046231b056`. ## Root cause `lib/setopt.c`, lines 2061-2072: ```c case CURLOPT_AWS_SIGV4: result = Curl_setstropt(data, STRING_AWS_SIGV4, ptr); if(CURL_EASY_STR(data, STRING_AWS_SIGV4)) s->httpauth = CURLAUTH_AWS_SIGV4; break; ``` When `ptr` is `NULL`, `Curl_setstropt` clears `STRING_AWS_SIGV4`, but the conditional only handles the non-NULL case. There is no `else` branch to clear `CURLAUTH_AWS_SIGV4` from `s->httpauth`. For comparison, `CURLOPT_HTTPSIG` in the same file handles this correctly: ```c if(arg) s->httpauth = (uint32_t)CURLAUTH_HTTPSIG; else s->httpauth &= ~(uint32_t)CURLAUTH_HTTPSIG; ``` On the next `curl_easy_perform()`, `lib/transfer.c:505` copies the stale `data->set.httpauth` (still containing `CURLAUTH_AWS_SIGV4`) into `data->state.authhost.want`. The authentication path in `lib/http.c` selects SigV4, and `Curl_output_aws_sigv4()` proceeds. Because the parameter string is now empty, `parse_sigv4_params()` in `lib/http_aws_sigv4.c:820` silently falls back to `"aws:amz"` and derives region/service from the hostname. ## Impact An application that reuses an easy handle, retains `CURLOPT_USERPWD` credentials, relies on the documented `NULL` reset, and then performs a request to an attacker-influenced URL will unintentionally send a signed SigV4 `Authorization` header to that destination. The header exposes the access-key identifier and a request-bound signature. The secret key is not transmitted and the signature is bound to method, host, path, headers, payload, and timestamp, which constrains replay. ## Affected versions curl 7.75.0 through 8.21.0, plus 8.22.0 prereleases before c3c70440e8. ## Reproduction 1. Build an affected curl release, starting with 7.75. …

Source code

lib/setopt.clines 2036–2097 · lines 2061-2072 cited by the report

            
              
                2036#ifndef CURL_DISABLE_HTTP
case CURLOPT_TRAILERDATA:
  s->trailer_data = ptr;
  break;
case CURLOPT_ACCEPT_ENCODING:
  /*
   * String to use at the value of Accept-Encoding header.
   *
   * If the encoding is set to "" we use an Accept-Encoding header that
   * encompasses all the encodings we support.
   * If the encoding is set to NULL we do not send an Accept-Encoding header
   * and ignore any received Content-Encoding header.
   *
   */
  if(ptr && !*ptr) {
    ptr = Curl_get_content_encodings();
    if(ptr)
      result = CURL_EASY_STR_SETN(data, STRING_ENCODING, ptr);
    else
      result = CURLE_OUT_OF_MEMORY;
    return result;
  }
  return Curl_setstropt(data, STRING_ENCODING, ptr);
2059
2060#ifndef CURL_DISABLE_AWS
case CURLOPT_AWS_SIGV4:
C1: case CURLOPT_AWS_SIGV4 calls Curl_setstropt which clears STRING_AWS_SIGV4 when ptr is NULL
C2: The CURLOPT_AWS_SIGV4 case (lines 2061-2072) lacks an else branch to clear CURLAUTH_AWS_SIGV4
C5: CURLOPT_AWS_SIGV4 handling code that exhibits the flaw
  /*
   * String that is merged to some authentication
   * parameters are used by the algorithm.
   */
  result = Curl_setstropt(data, STRING_AWS_SIGV4, ptr);
  /*
   * Basic has been set by default; it needs to be unset here.
   */
  if(CURL_EASY_STR(data, STRING_AWS_SIGV4))
C1: if(CURL_EASY_STR(data, STRING_AWS_SIGV4)) s->httpauth = CURLAUTH_AWS_SIGV4; — only sets the bit when string is non-empty; no else branch to clear it
C4: Stale CURLAUTH_AWS_SIGV4 bit remains in httpauth after NULL reset
    s->httpauth = CURLAUTH_AWS_SIGV4;
  break;
2073#endif
2074#ifndef CURL_DISABLE_HTTPSIG
case CURLOPT_HTTPSIG_KEY:
  result = Curl_setstropt(data, STRING_HTTPSIG_KEY, ptr);
  break;
case CURLOPT_HTTPSIG_KEYID:
  result = Curl_setstropt(data, STRING_HTTPSIG_KEYID, ptr);
  break;
case CURLOPT_HTTPSIG_HEADERS:
  result = Curl_setstropt(data, STRING_HTTPSIG_HEADERS, ptr);
  break;
2084#endif
case CURLOPT_REFERER:
  /*
   * String to set in the HTTP Referer: field.
   */
  Curl_bufref_free(&data->state.referer);
  result = Curl_setstropt(data, STRING_SET_REFERER, ptr);
  break;
2092
case CURLOPT_USERAGENT:
  /*
   * String to use in the HTTP User-Agent field
   */
  return Curl_setstropt(data, STRING_USERAGENT, ptr);

          

lib/transfer.clines 480–530 · lines 505-505 cited by the report

            
              
                480  if(data->set.postfields && data->set.set_resume_from) {
  /* we cannot */
  failf(data, "cannot mix POSTFIELDS with RESUME_FROM");
  return CURLE_BAD_FUNCTION_ARGUMENT;
}
485
data->state.prefer_ascii = data->set.prefer_ascii;
487#ifdef CURL_LIST_ONLY_PROTOCOL
data->state.list_only = data->set.list_only;
489#endif
data->state.httpreq = data->set.method;
491
/* initial transfer request coming up, forget the initial origin
 * from a previous perform() on this handle. */
Curl_peer_unlink(&data->state.initial_origin);
Curl_peer_unlink(&data->state.origin);
data->state.requests = 0;
data->state.followlocation = 0; /* reset the location-follow counter */
data->state.this_is_a_follow = FALSE; /* reset this */
data->state.http_ignorecustom = FALSE; /* use custom HTTP method */
data->state.errorbuf = FALSE; /* no error has occurred */
501#ifndef CURL_DISABLE_HTTP
Curl_http_neg_init(data, &data->state.http_neg);
503#endif
data->state.authproblem = FALSE;
data->state.authhost.want = data->set.httpauth;
C3: data->state.authhost.want = data->set.httpauth; — copies the stale httpauth bit into the per-request auth state
data->state.authproxy.want = data->set.proxyauth;
curlx_safefree(data->info.wouldredirect);
Curl_data_priority_clear_state(data);
if(data->set.http_auto_referer)
  Curl_bufref_free(&data->state.referer);
if(CURL_EASY_STR(data, STRING_SET_REFERER))
  Curl_bufref_set(&data->state.referer,
                  CURL_EASY_STR(data, STRING_SET_REFERER), 0, NULL);
else
  Curl_bufref_free(&data->state.referer);
516
if(data->state.httpreq == HTTPREQ_PUT)
  data->state.infilesize = data->set.filesize;
else if((data->state.httpreq != HTTPREQ_GET) &&
        (data->state.httpreq != HTTPREQ_HEAD)) {
  data->state.infilesize = data->set.postfieldsize;
  if(data->set.postfields && (data->state.infilesize == -1))
    data->state.infilesize = (curl_off_t)strlen(data->set.postfields);
}
else
  data->state.infilesize = 0;
527
/* If there is a list of cookie files to read, do it now! */
result = Curl_cookie_loadfiles(data,
                               data->set.cookiesession ?

          

lib/http_aws_sigv4.clines 795–864 · lines 820-820 cited by the report; definition of parse_sigv4_params

            
              
                795      else {
      /* Empty value is always encoded to key= */
      result = curlx_dyn_addf(dq, "%s=", key_ptr);
    }
  }
  if(result)
    break;
}
803
804fail:
if(counted_query_components)
  /* the encoded_query_array might not be initialized yet */
  pair_array_free(&encoded_query_array[0], counted_query_components);
dyn_array_free(&query_array[0], num_query_components);
return result;
810}
811
812static CURLcode parse_sigv4_params(struct Curl_easy *data,
                                 const char *hostname,
                                 struct Curl_str *provider0,
                                 struct Curl_str *provider1,
                                 struct Curl_str *region,
                                 struct Curl_str *service)
818{
const char *line = CURL_EASY_STR(data, STRING_AWS_SIGV4);
if(!line || !*line)
C3: if(!line || !*line) line = "aws:amz"; — when STRING_AWS_SIGV4 is empty, parse_sigv4_params falls back to default provider
C4: Fallback to "aws:amz" and hostname-derived region/service when parameter string is empty
  line = "aws:amz";
822
/* provider0[:provider1[:region[:service]]]
824
   No string can be longer than N bytes of non-whitespace */
if(curlx_str_until(&line, provider0, MAX_SIGV4_LEN, ':')) {
  failf(data, "first aws-sigv4 provider cannot be empty");
  return CURLE_BAD_FUNCTION_ARGUMENT;
}
if(curlx_str_single(&line, ':') ||
   curlx_str_until(&line, provider1, MAX_SIGV4_LEN, ':')) {
  *provider1 = *provider0;
}
else if(curlx_str_single(&line, ':') ||
        curlx_str_until(&line, region, MAX_SIGV4_LEN, ':') ||
        curlx_str_single(&line, ':') ||
        curlx_str_until(&line, service, MAX_SIGV4_LEN, ':')) {
  /* nothing to do */
}
840
if(!curlx_strlen(service)) {
  const char *p = hostname;
  if(curlx_str_until(&p, service, MAX_SIGV4_LEN, '.') ||
     curlx_str_single(&p, '.')) {
    failf(data, "aws-sigv4: service missing in parameters and hostname");
    return CURLE_URL_MALFORMAT;
  }
848
  infof(data, "aws_sigv4: picked service %.*s from host",
        (int)curlx_strlen(service), curlx_str(service));
851
  if(!curlx_strlen(region)) {
    if(curlx_str_until(&p, region, MAX_SIGV4_LEN, '.') ||
       curlx_str_single(&p, '.')) {
      failf(data, "aws-sigv4: region missing in parameters and hostname");
      return CURLE_URL_MALFORMAT;
    }
    infof(data, "aws_sigv4: picked region %.*s from host",
          (int)curlx_strlen(region), curlx_str(region));
  }
}
862
return CURLE_OK;
864}

          

lib/easy.c@curl-8_21_0lines 818–821 · definition of curl_easy_perform as in release curl-8_21_0; differs from master; commits that changed it since: a1bca29bdd lib: silence gcc-16 compiler warnings `-Wmaybe-uninitialized` | dfc01ea2a3 hardening: add API guards

            
                818CURLcode curl_easy_perform(CURL *curl)
C5: curl_easy_perform calls easy_perform which uses the stale auth state
819{
820  return easy_perform(curl, FALSE);
821}

include/curl/curl.hlines 845–845 · definition of CURLAUTH_AWS_SIGV4

Show 1 lines (not cited by the judge)

845	#define CURLAUTH_AWS_SIGV4 (((unsigned long)1) << 7)

lib/easy.clines 816–826 · definition of curl_easy_perform

Show 11 lines (not cited by the judge)

              816CURLcode curl_easy_perform(CURL *curl)
817{
818  struct Curl_eapi_guard guard = { 0 };
819  CURLcode result;
820
821  if(CURL_EAPI_ENTER(&guard, curl, easy_perform, &result)) {
822    result = easy_perform(curl, FALSE);
823  }
824  CURL_EAPI_LEAVE(&guard);
825  return result;
826}

include/curl/curl.hlines 830–830 · definition of CURLAUTH_NONE

Show 1 lines (not cited by the judge)

830	#define CURLAUTH_NONE ((unsigned long)0)

lib/urldata.hlines 1227–1228 · definition of CURL_EASY_STR

Show 2 lines (not cited by the judge)

              1227#define CURL_EASY_STR(d, id) \
1228        Curl_u8_strset_get(&(d)->set.strings, (uint8_t)(id))

lib/http_aws_sigv4.clines 1155–1236 · definition of Curl_output_aws_sigv4

Show 82 lines (not cited by the judge)

              1155CURLcode Curl_output_aws_sigv4(struct Curl_easy *data)
1156{
CURLcode result = CURLE_OUT_OF_MEMORY;
struct Curl_str provider0 = { NULL, 0 };
struct Curl_str provider1 = { NULL, 0 };
struct Curl_str region = { NULL, 0 };
struct Curl_str service = { NULL, 0 };
const char *hostname = data->state.origin->hostname;
char timestamp[TIMESTAMP_SIZE];
char date[9];
struct dynbuf canonical_headers;
struct dynbuf signed_headers;
char *date_header = NULL;
Curl_HttpReq httpreq;
const char *method = NULL;
const char *payload_hash = NULL;
size_t payload_hash_len = 0;
unsigned char sha_hash[CURL_SHA256_DIGEST_LENGTH];
char sha_hex[SHA256_HEX_LENGTH];
char content_sha256_hdr[CONTENT_SHA256_HDR_LEN + 2] = ""; /* add \r\n */
char *canonical_request = NULL;
char *request_type = NULL;
char *credential_scope = NULL;
char *str_to_sign = NULL;
1179
if(data->set.path_as_is) {
  failf(data, "Cannot use sigv4 authentication with path-as-is flag");
  return CURLE_BAD_FUNCTION_ARGUMENT;
}
1184
if(Curl_checkheaders(data, STRCONST("Authorization")))
  /* Authorization already present, Bailing out */
  return CURLE_OK;
1188
/* we init those buffers here, so goto fail will free initialized dynbuf */
curlx_dyn_init(&canonical_headers, CURL_MAX_HTTP_HEADER);
curlx_dyn_init(&signed_headers, CURL_MAX_HTTP_HEADER);
1192
result = parse_sigv4_params(data, hostname, &provider0, &provider1,
                            &region, &service);
if(!result) {
  Curl_http_method(data, &method, &httpreq);
  result = get_payload_hash(data, httpreq, &provider0, &provider1, &service,
                            sha_hash, sha_hex, content_sha256_hdr,
                            &payload_hash, &payload_hash_len);
}
1201
if(!result)
  result = get_timestamp(timestamp, sizeof(timestamp));
1204
if(!result)
  result = make_canonical_request(data, timestamp,
                                  &provider1, &service,
                                  method, payload_hash, payload_hash_len,
                                  &date_header, content_sha256_hdr,
                                  &canonical_headers, &signed_headers,
                                  &canonical_request);
if(!result) {
  /* the timestamp might have been updated in make_canonical_request */
  memcpy(date, timestamp, sizeof(date) - 1);
  date[sizeof(date) - 1] = 0;
1216
  result = make_string_to_sign(data, &provider0, &region, &service,
                               date, timestamp, canonical_request,
                               &request_type, &credential_scope,
                               &str_to_sign);
}
if(!result)
  result = sign_and_set_auth_headers(data, &provider0, &region, &service,
                                     request_type, credential_scope,
                                     date, str_to_sign, date_header,
                                     content_sha256_hdr, &signed_headers);
1227
curlx_dyn_free(&canonical_headers);
curlx_dyn_free(&signed_headers);
curlx_free(canonical_request);
curlx_free(request_type);
curlx_free(credential_scope);
curlx_free(str_to_sign);
curlx_free(date_header);
return result;
1236}

lib/http_aws_sigv4.c@curl-8_21_0lines 1165–1246 · definition of Curl_output_aws_sigv4 as in release curl-8_21_0; differs from master; commits that changed it since: 695aa15743 urldata: remove the aptr struct

Show 82 lines (not cited by the judge)

              1165CURLcode Curl_output_aws_sigv4(struct Curl_easy *data)
1166{
CURLcode result = CURLE_OUT_OF_MEMORY;
struct Curl_str provider0 = { NULL, 0 };
struct Curl_str provider1 = { NULL, 0 };
struct Curl_str region = { NULL, 0 };
struct Curl_str service = { NULL, 0 };
const char *hostname = data->state.origin->hostname;
char timestamp[TIMESTAMP_SIZE];
char date[9];
struct dynbuf canonical_headers;
struct dynbuf signed_headers;
char *date_header = NULL;
Curl_HttpReq httpreq;
const char *method = NULL;
const char *payload_hash = NULL;
size_t payload_hash_len = 0;
unsigned char sha_hash[CURL_SHA256_DIGEST_LENGTH];
char sha_hex[SHA256_HEX_LENGTH];
char content_sha256_hdr[CONTENT_SHA256_HDR_LEN + 2] = ""; /* add \r\n */
char *canonical_request = NULL;
char *request_type = NULL;
char *credential_scope = NULL;
char *str_to_sign = NULL;
1189
if(data->set.path_as_is) {
  failf(data, "Cannot use sigv4 authentication with path-as-is flag");
  return CURLE_BAD_FUNCTION_ARGUMENT;
}
1194
if(Curl_checkheaders(data, STRCONST("Authorization")))
  /* Authorization already present, Bailing out */
  return CURLE_OK;
1198
/* we init those buffers here, so goto fail will free initialized dynbuf */
curlx_dyn_init(&canonical_headers, CURL_MAX_HTTP_HEADER);
curlx_dyn_init(&signed_headers, CURL_MAX_HTTP_HEADER);
1202
result = parse_sigv4_params(data, hostname, &provider0, &provider1,
                            &region, &service);
if(!result) {
  Curl_http_method(data, &method, &httpreq);
  result = get_payload_hash(data, httpreq, &provider0, &provider1, &service,
                            sha_hash, sha_hex, content_sha256_hdr,
                            &payload_hash, &payload_hash_len);
}
1211
if(!result)
  result = get_timestamp(timestamp, sizeof(timestamp));
1214
if(!result)
  result = make_canonical_request(data, hostname, timestamp,
                                  &provider1, &service,
                                  method, payload_hash, payload_hash_len,
                                  &date_header, content_sha256_hdr,
                                  &canonical_headers, &signed_headers,
                                  &canonical_request);
if(!result) {
  /* the timestamp might have been updated in make_canonical_request */
  memcpy(date, timestamp, sizeof(date) - 1);
  date[sizeof(date) - 1] = 0;
1226
  result = make_string_to_sign(data, &provider0, &region, &service,
                               date, timestamp, canonical_request,
                               &request_type, &credential_scope,
                               &str_to_sign);
}
if(!result)
  result = sign_and_set_auth_headers(data, &provider0, &region, &service,
                                     request_type, credential_scope,
                                     date, str_to_sign, date_header,
                                     content_sha256_hdr, &signed_headers);
1237
curlx_dyn_free(&canonical_headers);
curlx_dyn_free(&signed_headers);
curlx_free(canonical_request);
curlx_free(request_type);
curlx_free(credential_scope);
curlx_free(str_to_sign);
curlx_free(date_header);
return result;
1246}

lib/setopt.clines 81–89 · definition of Curl_setstropt

Show 9 lines (not cited by the judge)

              81CURLcode Curl_setstropt(struct Curl_easy *data,
82                        enum dupstring id, const char *s)
83{
84  DEBUGASSERT((unsigned)id <= UINT8_MAX);
85  if(s && (strlen(s) > CURL_MAX_INPUT_LENGTH))
86    return CURLE_BAD_FUNCTION_ARGUMENT;
87
88  return CURL_EASY_STR_SET(data, (uint8_t)id, s);
89}

lib/setopt.c@curl-8_21_0lines 82–99 · definition of Curl_setstropt as in release curl-8_21_0; differs from master; commits that changed it since: c8df3defd9 lib: new easy option string storage

Show 18 lines (not cited by the judge)

              82CURLcode Curl_setstropt(char **charp, const char *s)
83{
84  /* Release the previous storage at `charp' and replace by a dynamic storage
85     copy of `s'. Return CURLE_OK or CURLE_OUT_OF_MEMORY. */
86
87  curlx_safefree(*charp);
88
89  if(s) {
90    if(strlen(s) > CURL_MAX_INPUT_LENGTH)
91      return CURLE_BAD_FUNCTION_ARGUMENT;
92
93    *charp = curlx_strdup(s);
94    if(!*charp)
95      return CURLE_OUT_OF_MEMORY;
96  }
97
98  return CURLE_OK;
99}

lib/setopt.clines 2928–2947 · definition of curl_easy_setopt

Show 20 lines (not cited by the judge)

              2928CURLcode curl_easy_setopt(CURL *curl, CURLoption option, ...)
2929{
2930  struct Curl_eapi_guard guard;
2931  CURLcode result;
2932
2933  if(CURL_EAPI_ENTER(&guard, curl, easy_setopt, &result)) {
2934    struct Curl_easy *data = curl;
2935    va_list arg;
2936
2937    va_start(arg, option);
2938
2939    result = Curl_vsetopt(data, option, arg);
2940
2941    va_end(arg);
2942    if(result == CURLE_BAD_FUNCTION_ARGUMENT)
2943      failf(data, "setopt 0x%x got bad argument", (unsigned int)option);
2944  }
2945  CURL_EAPI_LEAVE(&guard);
2946  return result;
2947}

lib/setopt.c@curl-8_21_0lines 2935–2952 · definition of curl_easy_setopt as in release curl-8_21_0; differs from master; commits that changed it since: dfc01ea2a3 hardening: add API guards

Show 18 lines (not cited by the judge)

              2935CURLcode curl_easy_setopt(CURL *curl, CURLoption option, ...)
2936{
2937  va_list arg;
2938  CURLcode result;
2939  struct Curl_easy *data = curl;
2940
2941  if(!data)
2942    return CURLE_BAD_FUNCTION_ARGUMENT;
2943
2944  va_start(arg, option);
2945
2946  result = Curl_vsetopt(data, option, arg);
2947
2948  va_end(arg);
2949  if(result == CURLE_BAD_FUNCTION_ARGUMENT)
2950    failf(data, "setopt 0x%x got bad argument", (unsigned int)option);
2951  return result;
2952}

lib/CMakeLists.txtlines 144–304 · definition of else (truncated)

Show 161 lines (not cited by the judge)

              144  set(LIB_SOURCE $<TARGET_OBJECTS:${LIB_OBJECT}>)
145else()
set(LIB_SOURCE ${HHEADERS} ${CSOURCES})
147endif()
148
149# We want it to be called libcurl on all platforms
150if(BUILD_STATIC_LIBS)
list(APPEND libcurl_export ${LIB_STATIC})
add_library(${LIB_STATIC} STATIC ${LIB_SOURCE})
add_library(${PROJECT_NAME}::${LIB_STATIC} ALIAS ${LIB_STATIC})
if(WIN32)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_STATICLIB")
endif()
target_link_libraries(${LIB_STATIC} PRIVATE ${CURL_LIBS})
# Remove the "lib" prefix since the library is already named "libcurl".
set_target_properties(${LIB_STATIC} PROPERTIES
  PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
  SUFFIX "${STATIC_LIB_SUFFIX}${CMAKE_STATIC_LIBRARY_SUFFIX}"
  INTERFACE_COMPILE_DEFINITIONS "CURL_STATICLIB")
set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
if(CURL_HIDES_PRIVATE_SYMBOLS)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
endif()
if(CURL_HAS_LTO)
  if(CMAKE_CONFIGURATION_TYPES)
    set_target_properties(${LIB_STATIC} PROPERTIES
      INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
      INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
  else()
    set_target_properties(${LIB_STATIC} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
  endif()
endif()
if(CURL_CLANG_TIDY)
  if(BUILD_SHARED_LIBS)  # disable clang-tidy for static, and limit to the shared library, if both enabled
    set_target_properties(${LIB_STATIC} PROPERTIES C_CLANG_TIDY "")
  else()
    set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
  endif()
endif()
if(CURL_ANALYZER_CFLAGS)
  set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
endif()
if(CURL_CODE_COVERAGE)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
endif()
192
target_include_directories(${LIB_STATIC} INTERFACE
  "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
  "$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
196endif()
197
198if(BUILD_SHARED_LIBS)
list(APPEND libcurl_export ${LIB_SHARED})
add_library(${LIB_SHARED} SHARED ${LIB_SOURCE})
add_library(${PROJECT_NAME}::${LIB_SHARED} ALIAS ${LIB_SHARED})
if(WIN32)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "dllmain.c")
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES ${LIB_RCFILES})
  if(CURL_HIDES_PRIVATE_SYMBOLS)
    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "${PROJECT_SOURCE_DIR}/lib/libcurl.def")
  endif()
endif()
target_link_libraries(${LIB_SHARED} PRIVATE ${CURL_LIBS})
# Remove the "lib" prefix since the library is already named "libcurl".
set_target_properties(${LIB_SHARED} PROPERTIES
  PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
  IMPORT_PREFIX "" IMPORT_SUFFIX "${IMPORT_LIB_SUFFIX}${CMAKE_IMPORT_LIBRARY_SUFFIX}"
  POSITION_INDEPENDENT_CODE ON)
set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
if(CURL_HIDES_PRIVATE_SYMBOLS)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
endif()
if(CURL_HAS_LTO)
  if(CMAKE_CONFIGURATION_TYPES)
    set_target_properties(${LIB_SHARED} PROPERTIES
      INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
      INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
  else()
    set_target_properties(${LIB_SHARED} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
  endif()
endif()
if(CURL_CLANG_TIDY)
  set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
endif()
if(CURL_ANALYZER_CFLAGS)
  set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
endif()
if(CURL_CODE_COVERAGE)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY LINK_OPTIONS ${CURL_COVERAGE_LDFLAGS})
endif()
241
target_include_directories(${LIB_SHARED} INTERFACE
  "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
  "$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
245
if(CMAKE_DLL_NAME_WITH_SOVERSION OR
  CYGWIN OR
  APPLE OR
  AIX OR CMAKE_SYSTEM_NAME STREQUAL "AIX" OR
  CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
  CMAKE_SYSTEM_NAME STREQUAL "SunOS" OR
  CMAKE_SYSTEM_NAME STREQUAL "Haiku" OR
  CMAKE_SYSTEM_NAME STREQUAL "OHOS" OR  # OpenHarmony
  # FreeBSD comes with the a.out and ELF flavors but a.out was supported
  # up to v3.x and ELF from v3.x. I cannot imagine someone running CMake
  # on those ancient systems.
  CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
  set(_soversion_default TRUE)
else()
  set(_soversion_default FALSE)
endif()
262
option(CURL_LIBCURL_SOVERSION "Enable libcurl SOVERSION" ${_soversion_default})
option(CURL_LIBCURL_VERSIONED_SYMBOLS "Enable libcurl versioned symbols" OFF)
265
if(CURL_LIBCURL_SOVERSION OR CURL_LIBCURL_VERSIONED_SYMBOLS)
  # Get VERSIONCHANGE, VERSIONADD, VERSIONDEL, VERSIONINFO variables
  curl_transform_makefile_inc("Makefile.soname" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
  include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
270
  math(EXPR _cmakesoname "${VERSIONCHANGE} - ${VERSIONDEL}")
  set(_cmakeversion "${_cmakesoname}.${VERSIONDEL}.${VERSIONADD}")
endif()
274
if(CURL_LIBCURL_SOVERSION)
  set_target_properties(${LIB_SHARED} PROPERTIES
    VERSION "${_cmakeversion}" SOVERSION "${_cmakesoname}")
endif()
279
## Versioned symbols
281
if(CURL_LIBCURL_VERSIONED_SYMBOLS)
  if(NOT DEFINED CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX)
    # Default to prefixes used by autotools
    if(CURL_WITH_MULTI_SSL)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MULTISSL_")
    elseif(CURL_USE_OPENSSL)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "OPENSSL_")
    elseif(CURL_USE_MBEDTLS)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MBEDTLS_")
    elseif(CURL_USE_WOLFSSL)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "WOLFSSL_")
    elseif(CURL_USE_GNUTLS)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "GNUTLS_")
    elseif(CURL_USE_RUSTLS)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "RUSTLS_")
    endif()
  endif()
  # Generate version script for the linker, for versioned symbols.
  # Consumed variables:
  #   CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX
  #   CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME
  set(CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME ${_cmakesoname})
  configure_file(

lib/CMakeLists.txt@curl-8_21_0lines 144–304 · definition of else as in release curl-8_21_0; differs from master

Show 161 lines (not cited by the judge)

              144  set(LIB_SOURCE $<TARGET_OBJECTS:${LIB_OBJECT}>)
145else()
set(LIB_SOURCE ${HHEADERS} ${CSOURCES})
147endif()
148
149# We want it to be called libcurl on all platforms
150if(BUILD_STATIC_LIBS)
list(APPEND libcurl_export ${LIB_STATIC})
add_library(${LIB_STATIC} STATIC ${LIB_SOURCE})
add_library(${PROJECT_NAME}::${LIB_STATIC} ALIAS ${LIB_STATIC})
if(WIN32)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_STATICLIB")
endif()
target_link_libraries(${LIB_STATIC} PRIVATE ${CURL_LIBS})
# Remove the "lib" prefix since the library is already named "libcurl".
set_target_properties(${LIB_STATIC} PROPERTIES
  PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
  SUFFIX "${STATIC_LIB_SUFFIX}${CMAKE_STATIC_LIBRARY_SUFFIX}"
  INTERFACE_COMPILE_DEFINITIONS "CURL_STATICLIB")
set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
if(CURL_HIDES_PRIVATE_SYMBOLS)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
endif()
if(CURL_HAS_LTO)
  if(CMAKE_CONFIGURATION_TYPES)
    set_target_properties(${LIB_STATIC} PROPERTIES
      INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
      INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
  else()
    set_target_properties(${LIB_STATIC} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
  endif()
endif()
if(CURL_CLANG_TIDY)
  if(BUILD_SHARED_LIBS)  # disable clang-tidy for static, and limit to the shared library, if both enabled
    set_target_properties(${LIB_STATIC} PROPERTIES C_CLANG_TIDY "")
  else()
    set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
  endif()
endif()
if(CURL_ANALYZER_CFLAGS)
  set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
endif()
if(CURL_CODE_COVERAGE)
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
  set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
endif()
192
target_include_directories(${LIB_STATIC} INTERFACE
  "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
  "$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
196endif()
197
198if(BUILD_SHARED_LIBS)
list(APPEND libcurl_export ${LIB_SHARED})
add_library(${LIB_SHARED} SHARED ${LIB_SOURCE})
add_library(${PROJECT_NAME}::${LIB_SHARED} ALIAS ${LIB_SHARED})
if(WIN32)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "dllmain.c")
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES ${LIB_RCFILES})
  if(CURL_HIDES_PRIVATE_SYMBOLS)
    set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "${PROJECT_SOURCE_DIR}/lib/libcurl.def")
  endif()
endif()
target_link_libraries(${LIB_SHARED} PRIVATE ${CURL_LIBS})
# Remove the "lib" prefix since the library is already named "libcurl".
set_target_properties(${LIB_SHARED} PROPERTIES
  PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
  IMPORT_PREFIX "" IMPORT_SUFFIX "${IMPORT_LIB_SUFFIX}${CMAKE_IMPORT_LIBRARY_SUFFIX}"
  POSITION_INDEPENDENT_CODE ON)
set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
if(CURL_HIDES_PRIVATE_SYMBOLS)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
endif()
if(CURL_HAS_LTO)
  if(CMAKE_CONFIGURATION_TYPES)
    set_target_properties(${LIB_SHARED} PROPERTIES
      INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
      INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
  else()
    set_target_properties(${LIB_SHARED} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
  endif()
endif()
if(CURL_CLANG_TIDY)
  set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
endif()
if(CURL_ANALYZER_CFLAGS)
  set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
endif()
if(CURL_CODE_COVERAGE)
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
  set_property(TARGET ${LIB_SHARED} APPEND PROPERTY LINK_OPTIONS ${CURL_COVERAGE_LDFLAGS})
endif()
241
target_include_directories(${LIB_SHARED} INTERFACE
  "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
  "$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
245
if(CMAKE_DLL_NAME_WITH_SOVERSION OR
  CYGWIN OR
  APPLE OR
  AIX OR CMAKE_SYSTEM_NAME STREQUAL "AIX" OR
  CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
  CMAKE_SYSTEM_NAME STREQUAL "SunOS" OR
  CMAKE_SYSTEM_NAME STREQUAL "Haiku" OR
  CMAKE_SYSTEM_NAME STREQUAL "OHOS" OR  # OpenHarmony
  CMAKE_SYSTEM_NAME STREQUAL "GNU/kFreeBSD" OR
  # FreeBSD comes with the a.out and ELF flavors but a.out was supported
  # up to v3.x and ELF from v3.x. I cannot imagine someone running CMake
  # on those ancient systems.
  CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
  set(_soversion_default TRUE)
else()
  set(_soversion_default FALSE)
endif()
263
option(CURL_LIBCURL_SOVERSION "Enable libcurl SOVERSION" ${_soversion_default})
option(CURL_LIBCURL_VERSIONED_SYMBOLS "Enable libcurl versioned symbols" OFF)
266
if(CURL_LIBCURL_SOVERSION OR CURL_LIBCURL_VERSIONED_SYMBOLS)
  # Get VERSIONCHANGE, VERSIONADD, VERSIONDEL, VERSIONINFO variables
  curl_transform_makefile_inc("Makefile.soname" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
  include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
271
  math(EXPR _cmakesoname "${VERSIONCHANGE} - ${VERSIONDEL}")
  set(_cmakeversion "${_cmakesoname}.${VERSIONDEL}.${VERSIONADD}")
endif()
275
if(CURL_LIBCURL_SOVERSION)
  set_target_properties(${LIB_SHARED} PROPERTIES
    VERSION "${_cmakeversion}" SOVERSION "${_cmakesoname}")
endif()
280
## Versioned symbols
282
if(CURL_LIBCURL_VERSIONED_SYMBOLS)
  if(NOT DEFINED CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX)
    # Default to prefixes used by autotools
    if(CURL_WITH_MULTI_SSL)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MULTISSL_")
    elseif(CURL_USE_OPENSSL)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "OPENSSL_")
    elseif(CURL_USE_MBEDTLS)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MBEDTLS_")
    elseif(CURL_USE_WOLFSSL)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "WOLFSSL_")
    elseif(CURL_USE_GNUTLS)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "GNUTLS_")
    elseif(CURL_USE_RUSTLS)
      set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "RUSTLS_")
    endif()
  endif()
  # Generate version script for the linker, for versioned symbols.
  # Consumed variables:
  #   CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX
  #   CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME
  set(CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME ${_cmakesoname})

lib/http_aws_sigv4.c@curl-8_21_0lines 820–873 · definition of parse_sigv4_params as in release curl-8_21_0; differs from master; commits that changed it since: c8df3defd9 lib: new easy option string storage | 3a0c600a1e tidy-up: fix comment indentation

Show 54 lines (not cited by the judge)

              820static CURLcode parse_sigv4_params(struct Curl_easy *data,
                                 const char *hostname,
                                 struct Curl_str *provider0,
                                 struct Curl_str *provider1,
                                 struct Curl_str *region,
                                 struct Curl_str *service)
826{
const char *line = data->set.str[STRING_AWS_SIGV4];
if(!line || !*line)
  line = "aws:amz";
830
/* provider0[:provider1[:region[:service]]]
832
   No string can be longer than N bytes of non-whitespace
*/
if(curlx_str_until(&line, provider0, MAX_SIGV4_LEN, ':')) {
  failf(data, "first aws-sigv4 provider cannot be empty");
  return CURLE_BAD_FUNCTION_ARGUMENT;
}
if(curlx_str_single(&line, ':') ||
   curlx_str_until(&line, provider1, MAX_SIGV4_LEN, ':')) {
  *provider1 = *provider0;
}
else if(curlx_str_single(&line, ':') ||
        curlx_str_until(&line, region, MAX_SIGV4_LEN, ':') ||
        curlx_str_single(&line, ':') ||
        curlx_str_until(&line, service, MAX_SIGV4_LEN, ':')) {
  /* nothing to do */
}
849
if(!curlx_strlen(service)) {
  const char *p = hostname;
  if(curlx_str_until(&p, service, MAX_SIGV4_LEN, '.') ||
     curlx_str_single(&p, '.')) {
    failf(data, "aws-sigv4: service missing in parameters and hostname");
    return CURLE_URL_MALFORMAT;
  }
857
  infof(data, "aws_sigv4: picked service %.*s from host",
        (int)curlx_strlen(service), curlx_str(service));
860
  if(!curlx_strlen(region)) {
    if(curlx_str_until(&p, region, MAX_SIGV4_LEN, '.') ||
       curlx_str_single(&p, '.')) {
      failf(data, "aws-sigv4: region missing in parameters and hostname");
      return CURLE_URL_MALFORMAT;
    }
    infof(data, "aws_sigv4: picked region %.*s from host",
          (int)curlx_strlen(region), curlx_str(region));
  }
}
871
return CURLE_OK;
873}

2036	#ifndef CURL_DISABLE_HTTP
2037	case CURLOPT_TRAILERDATA:
2038	s->trailer_data = ptr;
2039	break;
2040	case CURLOPT_ACCEPT_ENCODING:
2041	/*
2042	* String to use at the value of Accept-Encoding header.
2043	*
2044	* If the encoding is set to "" we use an Accept-Encoding header that
2045	* encompasses all the encodings we support.
2046	* If the encoding is set to NULL we do not send an Accept-Encoding header
2047	* and ignore any received Content-Encoding header.
2048	*
2049	*/
2050	if(ptr && !*ptr) {
2051	ptr = Curl_get_content_encodings();
2052	if(ptr)
2053	result = CURL_EASY_STR_SETN(data, STRING_ENCODING, ptr);
2054	else
2055	result = CURLE_OUT_OF_MEMORY;
2056	return result;
2057	}
2058	return Curl_setstropt(data, STRING_ENCODING, ptr);
2059
2060	#ifndef CURL_DISABLE_AWS
2061	case CURLOPT_AWS_SIGV4:
	C1: case CURLOPT_AWS_SIGV4 calls Curl_setstropt which clears STRING_AWS_SIGV4 when ptr is NULL
	C2: The CURLOPT_AWS_SIGV4 case (lines 2061-2072) lacks an else branch to clear CURLAUTH_AWS_SIGV4
	C5: CURLOPT_AWS_SIGV4 handling code that exhibits the flaw
2062	/*
2063	* String that is merged to some authentication
2064	* parameters are used by the algorithm.
2065	*/
2066	result = Curl_setstropt(data, STRING_AWS_SIGV4, ptr);
2067	/*
2068	* Basic has been set by default; it needs to be unset here.
2069	*/
2070	if(CURL_EASY_STR(data, STRING_AWS_SIGV4))
	C1: if(CURL_EASY_STR(data, STRING_AWS_SIGV4)) s->httpauth = CURLAUTH_AWS_SIGV4; — only sets the bit when string is non-empty; no else branch to clear it
	C4: Stale CURLAUTH_AWS_SIGV4 bit remains in httpauth after NULL reset
2071	s->httpauth = CURLAUTH_AWS_SIGV4;
2072	break;
2073	#endif
2074	#ifndef CURL_DISABLE_HTTPSIG
2075	case CURLOPT_HTTPSIG_KEY:
2076	result = Curl_setstropt(data, STRING_HTTPSIG_KEY, ptr);
2077	break;
2078	case CURLOPT_HTTPSIG_KEYID:
2079	result = Curl_setstropt(data, STRING_HTTPSIG_KEYID, ptr);
2080	break;
2081	case CURLOPT_HTTPSIG_HEADERS:
2082	result = Curl_setstropt(data, STRING_HTTPSIG_HEADERS, ptr);
2083	break;
2084	#endif
2085	case CURLOPT_REFERER:
2086	/*
2087	* String to set in the HTTP Referer: field.
2088	*/
2089	Curl_bufref_free(&data->state.referer);
2090	result = Curl_setstropt(data, STRING_SET_REFERER, ptr);
2091	break;
2092
2093	case CURLOPT_USERAGENT:
2094	/*
2095	* String to use in the HTTP User-Agent field
2096	*/
2097	return Curl_setstropt(data, STRING_USERAGENT, ptr);

480	if(data->set.postfields && data->set.set_resume_from) {
481	/* we cannot */
482	failf(data, "cannot mix POSTFIELDS with RESUME_FROM");
483	return CURLE_BAD_FUNCTION_ARGUMENT;
484	}
485
486	data->state.prefer_ascii = data->set.prefer_ascii;
487	#ifdef CURL_LIST_ONLY_PROTOCOL
488	data->state.list_only = data->set.list_only;
489	#endif
490	data->state.httpreq = data->set.method;
491
492	/* initial transfer request coming up, forget the initial origin
493	* from a previous perform() on this handle. */
494	Curl_peer_unlink(&data->state.initial_origin);
495	Curl_peer_unlink(&data->state.origin);
496	data->state.requests = 0;
497	data->state.followlocation = 0; /* reset the location-follow counter */
498	data->state.this_is_a_follow = FALSE; /* reset this */
499	data->state.http_ignorecustom = FALSE; /* use custom HTTP method */
500	data->state.errorbuf = FALSE; /* no error has occurred */
501	#ifndef CURL_DISABLE_HTTP
502	Curl_http_neg_init(data, &data->state.http_neg);
503	#endif
504	data->state.authproblem = FALSE;
505	data->state.authhost.want = data->set.httpauth;
	C3: data->state.authhost.want = data->set.httpauth; — copies the stale httpauth bit into the per-request auth state
506	data->state.authproxy.want = data->set.proxyauth;
507	curlx_safefree(data->info.wouldredirect);
508	Curl_data_priority_clear_state(data);
509	if(data->set.http_auto_referer)
510	Curl_bufref_free(&data->state.referer);
511	if(CURL_EASY_STR(data, STRING_SET_REFERER))
512	Curl_bufref_set(&data->state.referer,
513	CURL_EASY_STR(data, STRING_SET_REFERER), 0, NULL);
514	else
515	Curl_bufref_free(&data->state.referer);
516
517	if(data->state.httpreq == HTTPREQ_PUT)
518	data->state.infilesize = data->set.filesize;
519	else if((data->state.httpreq != HTTPREQ_GET) &&
520	(data->state.httpreq != HTTPREQ_HEAD)) {
521	data->state.infilesize = data->set.postfieldsize;
522	if(data->set.postfields && (data->state.infilesize == -1))
523	data->state.infilesize = (curl_off_t)strlen(data->set.postfields);
524	}
525	else
526	data->state.infilesize = 0;
527
528	/* If there is a list of cookie files to read, do it now! */
529	result = Curl_cookie_loadfiles(data,
530	data->set.cookiesession ?

795	else {
796	/* Empty value is always encoded to key= */
797	result = curlx_dyn_addf(dq, "%s=", key_ptr);
798	}
799	}
800	if(result)
801	break;
802	}
803
804	fail:
805	if(counted_query_components)
806	/* the encoded_query_array might not be initialized yet */
807	pair_array_free(&encoded_query_array[0], counted_query_components);
808	dyn_array_free(&query_array[0], num_query_components);
809	return result;
810	}
811
812	static CURLcode parse_sigv4_params(struct Curl_easy *data,
813	const char *hostname,
814	struct Curl_str *provider0,
815	struct Curl_str *provider1,
816	struct Curl_str *region,
817	struct Curl_str *service)
818	{
819	const char *line = CURL_EASY_STR(data, STRING_AWS_SIGV4);
820	if(!line \|\| !*line)
	C3: if(!line \|\| !*line) line = "aws:amz"; — when STRING_AWS_SIGV4 is empty, parse_sigv4_params falls back to default provider
	C4: Fallback to "aws:amz" and hostname-derived region/service when parameter string is empty
821	line = "aws:amz";
822
823	/* provider0[:provider1[:region[:service]]]
824
825	No string can be longer than N bytes of non-whitespace */
826	if(curlx_str_until(&line, provider0, MAX_SIGV4_LEN, ':')) {
827	failf(data, "first aws-sigv4 provider cannot be empty");
828	return CURLE_BAD_FUNCTION_ARGUMENT;
829	}
830	if(curlx_str_single(&line, ':') \|\|
831	curlx_str_until(&line, provider1, MAX_SIGV4_LEN, ':')) {
832	provider1 = provider0;
833	}
834	else if(curlx_str_single(&line, ':') \|\|
835	curlx_str_until(&line, region, MAX_SIGV4_LEN, ':') \|\|
836	curlx_str_single(&line, ':') \|\|
837	curlx_str_until(&line, service, MAX_SIGV4_LEN, ':')) {
838	/* nothing to do */
839	}
840
841	if(!curlx_strlen(service)) {
842	const char *p = hostname;
843	if(curlx_str_until(&p, service, MAX_SIGV4_LEN, '.') \|\|
844	curlx_str_single(&p, '.')) {
845	failf(data, "aws-sigv4: service missing in parameters and hostname");
846	return CURLE_URL_MALFORMAT;
847	}
848
849	infof(data, "aws_sigv4: picked service %.*s from host",
850	(int)curlx_strlen(service), curlx_str(service));
851
852	if(!curlx_strlen(region)) {
853	if(curlx_str_until(&p, region, MAX_SIGV4_LEN, '.') \|\|
854	curlx_str_single(&p, '.')) {
855	failf(data, "aws-sigv4: region missing in parameters and hostname");
856	return CURLE_URL_MALFORMAT;
857	}
858	infof(data, "aws_sigv4: picked region %.*s from host",
859	(int)curlx_strlen(region), curlx_str(region));
860	}
861	}
862
863	return CURLE_OK;
864	}

818	CURLcode curl_easy_perform(CURL *curl)
	C5: curl_easy_perform calls easy_perform which uses the stale auth state
819	{
820	return easy_perform(curl, FALSE);
821	}

816	CURLcode curl_easy_perform(CURL *curl)
817	{
818	struct Curl_eapi_guard guard = { 0 };
819	CURLcode result;
820
821	if(CURL_EAPI_ENTER(&guard, curl, easy_perform, &result)) {
822	result = easy_perform(curl, FALSE);
823	}
824	CURL_EAPI_LEAVE(&guard);
825	return result;
826	}

1227	#define CURL_EASY_STR(d, id) \
1228	Curl_u8_strset_get(&(d)->set.strings, (uint8_t)(id))

1155	CURLcode Curl_output_aws_sigv4(struct Curl_easy *data)
1156	{
1157	CURLcode result = CURLE_OUT_OF_MEMORY;
1158	struct Curl_str provider0 = { NULL, 0 };
1159	struct Curl_str provider1 = { NULL, 0 };
1160	struct Curl_str region = { NULL, 0 };
1161	struct Curl_str service = { NULL, 0 };
1162	const char *hostname = data->state.origin->hostname;
1163	char timestamp[TIMESTAMP_SIZE];
1164	char date[9];
1165	struct dynbuf canonical_headers;
1166	struct dynbuf signed_headers;
1167	char *date_header = NULL;
1168	Curl_HttpReq httpreq;
1169	const char *method = NULL;
1170	const char *payload_hash = NULL;
1171	size_t payload_hash_len = 0;
1172	unsigned char sha_hash[CURL_SHA256_DIGEST_LENGTH];
1173	char sha_hex[SHA256_HEX_LENGTH];
1174	char content_sha256_hdr[CONTENT_SHA256_HDR_LEN + 2] = ""; /* add \r\n */
1175	char *canonical_request = NULL;
1176	char *request_type = NULL;
1177	char *credential_scope = NULL;
1178	char *str_to_sign = NULL;
1179
1180	if(data->set.path_as_is) {
1181	failf(data, "Cannot use sigv4 authentication with path-as-is flag");
1182	return CURLE_BAD_FUNCTION_ARGUMENT;
1183	}
1184
1185	if(Curl_checkheaders(data, STRCONST("Authorization")))
1186	/* Authorization already present, Bailing out */
1187	return CURLE_OK;
1188
1189	/* we init those buffers here, so goto fail will free initialized dynbuf */
1190	curlx_dyn_init(&canonical_headers, CURL_MAX_HTTP_HEADER);
1191	curlx_dyn_init(&signed_headers, CURL_MAX_HTTP_HEADER);
1192
1193	result = parse_sigv4_params(data, hostname, &provider0, &provider1,
1194	&region, &service);
1195	if(!result) {
1196	Curl_http_method(data, &method, &httpreq);
1197	result = get_payload_hash(data, httpreq, &provider0, &provider1, &service,
1198	sha_hash, sha_hex, content_sha256_hdr,
1199	&payload_hash, &payload_hash_len);
1200	}
1201
1202	if(!result)
1203	result = get_timestamp(timestamp, sizeof(timestamp));
1204
1205	if(!result)
1206	result = make_canonical_request(data, timestamp,
1207	&provider1, &service,
1208	method, payload_hash, payload_hash_len,
1209	&date_header, content_sha256_hdr,
1210	&canonical_headers, &signed_headers,
1211	&canonical_request);
1212	if(!result) {
1213	/* the timestamp might have been updated in make_canonical_request */
1214	memcpy(date, timestamp, sizeof(date) - 1);
1215	date[sizeof(date) - 1] = 0;
1216
1217	result = make_string_to_sign(data, &provider0, &region, &service,
1218	date, timestamp, canonical_request,
1219	&request_type, &credential_scope,
1220	&str_to_sign);
1221	}
1222	if(!result)
1223	result = sign_and_set_auth_headers(data, &provider0, &region, &service,
1224	request_type, credential_scope,
1225	date, str_to_sign, date_header,
1226	content_sha256_hdr, &signed_headers);
1227
1228	curlx_dyn_free(&canonical_headers);
1229	curlx_dyn_free(&signed_headers);
1230	curlx_free(canonical_request);
1231	curlx_free(request_type);
1232	curlx_free(credential_scope);
1233	curlx_free(str_to_sign);
1234	curlx_free(date_header);
1235	return result;
1236	}

81	CURLcode Curl_setstropt(struct Curl_easy *data,
82	enum dupstring id, const char *s)
83	{
84	DEBUGASSERT((unsigned)id <= UINT8_MAX);
85	if(s && (strlen(s) > CURL_MAX_INPUT_LENGTH))
86	return CURLE_BAD_FUNCTION_ARGUMENT;
87
88	return CURL_EASY_STR_SET(data, (uint8_t)id, s);
89	}

82	CURLcode Curl_setstropt(char *charp, const char s)
83	{
84	/* Release the previous storage at `charp' and replace by a dynamic storage
85	copy of `s'. Return CURLE_OK or CURLE_OUT_OF_MEMORY. */
86
87	curlx_safefree(*charp);
88
89	if(s) {
90	if(strlen(s) > CURL_MAX_INPUT_LENGTH)
91	return CURLE_BAD_FUNCTION_ARGUMENT;
92
93	*charp = curlx_strdup(s);
94	if(!*charp)
95	return CURLE_OUT_OF_MEMORY;
96	}
97
98	return CURLE_OK;
99	}

2928	CURLcode curl_easy_setopt(CURL *curl, CURLoption option, ...)
2929	{
2930	struct Curl_eapi_guard guard;
2931	CURLcode result;
2932
2933	if(CURL_EAPI_ENTER(&guard, curl, easy_setopt, &result)) {
2934	struct Curl_easy *data = curl;
2935	va_list arg;
2936
2937	va_start(arg, option);
2938
2939	result = Curl_vsetopt(data, option, arg);
2940
2941	va_end(arg);
2942	if(result == CURLE_BAD_FUNCTION_ARGUMENT)
2943	failf(data, "setopt 0x%x got bad argument", (unsigned int)option);
2944	}
2945	CURL_EAPI_LEAVE(&guard);
2946	return result;
2947	}

144	set(LIB_SOURCE $<TARGET_OBJECTS:${LIB_OBJECT}>)
145	else()
146	set(LIB_SOURCE ${HHEADERS} ${CSOURCES})
147	endif()
148
149	# We want it to be called libcurl on all platforms
150	if(BUILD_STATIC_LIBS)
151	list(APPEND libcurl_export ${LIB_STATIC})
152	add_library(${LIB_STATIC} STATIC ${LIB_SOURCE})
153	add_library(${PROJECT_NAME}::${LIB_STATIC} ALIAS ${LIB_STATIC})
154	if(WIN32)
155	set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_STATICLIB")
156	endif()
157	target_link_libraries(${LIB_STATIC} PRIVATE ${CURL_LIBS})
158	# Remove the "lib" prefix since the library is already named "libcurl".
159	set_target_properties(${LIB_STATIC} PROPERTIES
160	PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
161	SUFFIX "${STATIC_LIB_SUFFIX}${CMAKE_STATIC_LIBRARY_SUFFIX}"
162	INTERFACE_COMPILE_DEFINITIONS "CURL_STATICLIB")
163	set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
164	if(CURL_HIDES_PRIVATE_SYMBOLS)
165	set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
166	set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
167	endif()
168	if(CURL_HAS_LTO)
169	if(CMAKE_CONFIGURATION_TYPES)
170	set_target_properties(${LIB_STATIC} PROPERTIES
171	INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
172	INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
173	else()
174	set_target_properties(${LIB_STATIC} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
175	endif()
176	endif()
177	if(CURL_CLANG_TIDY)
178	if(BUILD_SHARED_LIBS) # disable clang-tidy for static, and limit to the shared library, if both enabled
179	set_target_properties(${LIB_STATIC} PROPERTIES C_CLANG_TIDY "")
180	else()
181	set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
182	endif()
183	endif()
184	if(CURL_ANALYZER_CFLAGS)
185	set_target_properties(${LIB_STATIC} PROPERTIES UNITY_BUILD OFF)
186	set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
187	endif()
188	if(CURL_CODE_COVERAGE)
189	set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
190	set_property(TARGET ${LIB_STATIC} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
191	endif()
192
193	target_include_directories(${LIB_STATIC} INTERFACE
194	"$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
195	"$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
196	endif()
197
198	if(BUILD_SHARED_LIBS)
199	list(APPEND libcurl_export ${LIB_SHARED})
200	add_library(${LIB_SHARED} SHARED ${LIB_SOURCE})
201	add_library(${PROJECT_NAME}::${LIB_SHARED} ALIAS ${LIB_SHARED})
202	if(WIN32)
203	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "dllmain.c")
204	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES ${LIB_RCFILES})
205	if(CURL_HIDES_PRIVATE_SYMBOLS)
206	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY SOURCES "${PROJECT_SOURCE_DIR}/lib/libcurl.def")
207	endif()
208	endif()
209	target_link_libraries(${LIB_SHARED} PRIVATE ${CURL_LIBS})
210	# Remove the "lib" prefix since the library is already named "libcurl".
211	set_target_properties(${LIB_SHARED} PROPERTIES
212	PREFIX "" OUTPUT_NAME "${LIBCURL_OUTPUT_NAME}"
213	IMPORT_PREFIX "" IMPORT_SUFFIX "${IMPORT_LIB_SUFFIX}${CMAKE_IMPORT_LIBRARY_SUFFIX}"
214	POSITION_INDEPENDENT_CODE ON)
215	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAGS}")
216	if(CURL_HIDES_PRIVATE_SYMBOLS)
217	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS "${CURL_CFLAG_SYMBOLS_HIDE}")
218	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS "CURL_HIDDEN_SYMBOLS")
219	endif()
220	if(CURL_HAS_LTO)
221	if(CMAKE_CONFIGURATION_TYPES)
222	set_target_properties(${LIB_SHARED} PROPERTIES
223	INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
224	INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
225	else()
226	set_target_properties(${LIB_SHARED} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
227	endif()
228	endif()
229	if(CURL_CLANG_TIDY)
230	set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
231	endif()
232	if(CURL_ANALYZER_CFLAGS)
233	set_target_properties(${LIB_SHARED} PROPERTIES UNITY_BUILD OFF)
234	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_ANALYZER_CFLAGS})
235	endif()
236	if(CURL_CODE_COVERAGE)
237	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_COVERAGE_MACROS})
238	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY COMPILE_OPTIONS ${CURL_COVERAGE_CFLAGS})
239	set_property(TARGET ${LIB_SHARED} APPEND PROPERTY LINK_OPTIONS ${CURL_COVERAGE_LDFLAGS})
240	endif()
241
242	target_include_directories(${LIB_SHARED} INTERFACE
243	"$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
244	"$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>")
245
246	if(CMAKE_DLL_NAME_WITH_SOVERSION OR
247	CYGWIN OR
248	APPLE OR
249	AIX OR CMAKE_SYSTEM_NAME STREQUAL "AIX" OR
250	CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
251	CMAKE_SYSTEM_NAME STREQUAL "SunOS" OR
252	CMAKE_SYSTEM_NAME STREQUAL "Haiku" OR
253	CMAKE_SYSTEM_NAME STREQUAL "OHOS" OR # OpenHarmony
254	# FreeBSD comes with the a.out and ELF flavors but a.out was supported
255	# up to v3.x and ELF from v3.x. I cannot imagine someone running CMake
256	# on those ancient systems.
257	CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
258	set(_soversion_default TRUE)
259	else()
260	set(_soversion_default FALSE)
261	endif()
262
263	option(CURL_LIBCURL_SOVERSION "Enable libcurl SOVERSION" ${_soversion_default})
264	option(CURL_LIBCURL_VERSIONED_SYMBOLS "Enable libcurl versioned symbols" OFF)
265
266	if(CURL_LIBCURL_SOVERSION OR CURL_LIBCURL_VERSIONED_SYMBOLS)
267	# Get VERSIONCHANGE, VERSIONADD, VERSIONDEL, VERSIONINFO variables
268	curl_transform_makefile_inc("Makefile.soname" "${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
269	include("${CMAKE_CURRENT_BINARY_DIR}/Makefile.soname.cmake")
270
271	math(EXPR _cmakesoname "${VERSIONCHANGE} - ${VERSIONDEL}")
272	set(_cmakeversion "${_cmakesoname}.${VERSIONDEL}.${VERSIONADD}")
273	endif()
274
275	if(CURL_LIBCURL_SOVERSION)
276	set_target_properties(${LIB_SHARED} PROPERTIES
277	VERSION "${_cmakeversion}" SOVERSION "${_cmakesoname}")
278	endif()
279
280	## Versioned symbols
281
282	if(CURL_LIBCURL_VERSIONED_SYMBOLS)
283	if(NOT DEFINED CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX)
284	# Default to prefixes used by autotools
285	if(CURL_WITH_MULTI_SSL)
286	set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MULTISSL_")
287	elseif(CURL_USE_OPENSSL)
288	set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "OPENSSL_")
289	elseif(CURL_USE_MBEDTLS)
290	set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "MBEDTLS_")
291	elseif(CURL_USE_WOLFSSL)
292	set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "WOLFSSL_")
293	elseif(CURL_USE_GNUTLS)
294	set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "GNUTLS_")
295	elseif(CURL_USE_RUSTLS)
296	set(CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX "RUSTLS_")
297	endif()
298	endif()
299	# Generate version script for the linker, for versioned symbols.
300	# Consumed variables:
301	# CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX
302	# CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME
303	set(CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME ${_cmakesoname})
304	configure_file(