merge changed till curl 8.20

[fadedreamz]

No description provided.

[cycode-security]

❗Cycode: Secret of type: 'Private Key' was found.
Severity: High
SHA: 5ddfcc8f0f

Description

A private key is a cryptographic key that is used to authenticate the owner of a particular resource or service, typically used in combination with a public key.

Cycode Remediation Guideline

❗ How to revoke

---

• Generate a new key pair (public and private key).
• Update all systems and services to use the new public key.
• Revoke the old private key from any key management systems or services.
• Remove the old private key from all storage locations and backups.

Tell us how you wish to proceed using one of the following commands:

Tag	Short Description
#cycode_secret_false_positive <reason>	Applies to this secret value for all repos in your organization
#cycode_secret_revoked	Applies to this secret value for all repos in your organization

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

[cycode-security]

❗Cycode: SAST violation: 'Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')'.

Severity: High

Description

Format specifiers can take optional field widths, which should be
used to limit how many characters are copied into the target buffer.

Example:

  const char str[20] = "AAAAAAAAAAAAAAAAAAA";
  char buf[11] = {0};
  sscanf(str, "%10s", &buf); // buf = AAAAAAAAAA\0

Cycode Remediation Guideline

The possible violation in C code involving the scanf() family functions is the use of the %s specifier without specifying a limit. This mistake can lead to buffer overflow vulnerabilities, as the function reads input without restricting its length, potentially allowing more characters than the buffer is designed to hold.

Buffer overflows are dangerous because they can allow attackers to overwrite adjacent memory, which might lead to arbitrary code execution, crashes, or data corruption. To understand the vulnerability better, let's consider an example of vulnerable code:

#include <stdio.h>

int main() {
    char buffer[100];

    printf("Enter a string: ");
    scanf("%s", buffer); // Vulnerable: No limit specified for %s

    printf("You entered: %s\n", buffer);
    return 0;
}

In this example, the scanf() function reads user input without restricting its length, potentially leading to a buffer overflow if the input string exceeds the size of the buffer.

To fix this issue, developers can either specify a limit for the %s specifier or use alternative input functions like fgets(). Here's the fixed code using both methods:

1. Limiting the %s specifier in scanf():

#include <stdio.h>

int main() {
    char buffer[100];

    printf("Enter a string: ");
    scanf("%99s", buffer); // Fixed: Limit specified for %s (99 characters + null terminator)

    printf("You entered: %s\n", buffer);
    return 0;
}

2. Using fgets() instead of scanf():

#include <stdio.h>

int main() {
    char buffer[100];

    printf("Enter a string: ");
    fgets(buffer, sizeof(buffer), stdin); // Fixed: Using fgets with buffer size

    printf("You entered: %s", buffer); // Note: No need to add \n here as fgets retains the newline character
    return 0;
}

Both fixes prevent the buffer overflow vulnerability by limiting the number of characters being read into the buffer, ensuring safer and more secure code.

Tell us how you wish to proceed using one of the following commands:

Tag	Short Description
#cycode_sast_false_positive <reason>	Mark as false positive — applies to this violation only
#cycode_ai_remediation	Request remediation guidance using Cycode AI
#cycode_sast_ignore_here <reason>	Ignore this violation — applies to this violation only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Petezah]

I have a request: Can you squash down your two top commits (a14ca44 and 002903d), and then use the commit message from this commit: a73e8a5
Feel free to add to it if there is anything to add.
It is useful to have the reasoning and historical context if we have to do archeology later.

[Petezah]

Updates to unitytls.c make sense. I think all the other changes are most likely just from upstream.

[Petezah]

Leaving it on request changes just so the squash/comment is not forgotten. Will approve after that.